Forum Discussion

Yann_Desmarest's avatar
Yann_Desmarest
Icon for Cirrus rankCirrus
Aug 17, 2017

Hi,

You can have a look at the iApp Analytics written by Ken Bocchino.

On my side, I write a custom log in the format key/value to be natively parsed by Splunk.

You can write an icall that periodically dump (

sessiondump --allkeys
) all session variables from active sessions and send it to the HTTP API of Splunk.

Then, you have all at your disposal to build some custom dashboard based on easy to write splunk queries.

Hope it helps

Yann

  • CX_280703's avatar
    CX_280703
    Icon for Nimbostratus rankNimbostratus
    Aug 23, 2017

    We have set up our APM using HSL to send our logs to our syslog server on policy completion. This works well and allows us to choose the info we send.

    when ACCESS_POLICY_COMPLETED {
  if { ![catch {set hsl [HSL::open -proto TCP -pool $static::syslogPool]} ] } {
         HSL::send $hsl "<190>    id=$static::siemId    action=auth    auth-result=\ACCESS::policy result]    dst-ip=[IP::local_addr]    src-ip=[IP::remote_addr]user=[ACCESS::session data get session.sso.token.last.username]@[ACCESS::session data get session.sso.token.last.domain]    vip=[virtual name]    use-case=[ACCESS::session data get session.sso.token.last.useCase]    ad-errmsg=[ACCESS::session data get session.ad.last.errmsg]  ad-empid=[ACCESS::session data get session.ad.last.attr.employeeID]   device=$static::location    module=APM    user-agent=[ACCESS::session data get session.user.agent]    auth-method=[ACCESS::session data get session.sso.token.last.method]    sessionID=[ACCESS::session data get session.user.sessionid] \n"
  }
}