Piped

Overview

The Unified Assurance Event Pipe Aggregator is a generic application that runs a command on the local system, then parses the results with customizable rules and creates de-duplicated events within Unified Assurance.

Pipe Aggregator Setup

1. Review the command that is run in the configuration to see what will be run for processing. Update the command as needed.

2. Review the logic in the rules files referenced in the configuration to see the processing that will be done on the data that is returned:

   • LoadRules will be run during application startup to load data that might be needed during processing.

   • IncludeRules will be read during application startup to load additional files that might be called during processing.

   • BaseRules will be run for each event that is selected from the query.

   Update the logic as needed.

3. Enable the default Service, unless a specific configuration option is needed:

   Configuration -> Broker Control -> Services

Default Service

Default Configuration

Best Practices

The following list shows the best practices for working with this application:

• The PIPE Aggregator can run any executable that is accessible to the local system. An executable that is located on a remote system can be run by mounting the remote file system to the server running the PIPE Aggregator service.

Rules

This aggregator uses the Unified Assurance standard rules architecture in Perl syntax. For information about creating rules, see the following in Unified Assurance Developer's Guide:

• Core for information about core rules functions.

• Events for information about Event rules functions.

• Application Logging

Tokens

The aggregator exposes the following tokens for rules processing.

$CustomHash->{SubObject} = &share({});

Example Integration

In this example, the Pipe Aggregator will be used to tail the /var/log/secure file and create an event when an unauthorized user tries to sudo. When the file is tailed and the specified line is logged, an event will be created with Severity 5 (Critical) and the other values set below. The data will be parsed out so useful information can be shown directly in the event.

1. Go to the Rules UI:

   Configuration -> Rules

2. Expand the folder path: core -> default -> collection -> event -> pipe

3. Select the base.rules file, then add the following logic before the else block of code. This will watch the file for the line user NOT in sudoers and create an event when found:

   • Logic

     elsif ($line =~ /user NOT in sudoers/){
         $Event->{'Method'}    = "PIPE";
         $Event->{'SubMethod'} = "sudo Pipe";
         $Event->{'Severity'}  = 5;
         $Event->{'Node'}      = hostfqdn();
     
         $line                 =~ /TTY=(.*); PWD=(.*) ; USER=(.*) ; COMMAND=(.*)/;
         $Event->{'Summary'}   = "User: $3 On Terminal: $1 ran command $4 in Directory $2";
     }
     

   • Click Submit, then enter a commit message, then click OK.

4. Go to the Services UI:

   Configuration -> Broker Control -> Services

5. Select the Event Pipe Aggregator, then click the Clone button. Set the following:

   • Command => tail -f /var/log/secure

   • Click Submit.

6. Verify the service starts and events are received.

Administration Details

The following list shows the technical details you will need for advanced administration of the application:

• Package - coreCollection-app

• Synopsis - ./Piped [OPTIONS]

• Options:

   -c, --AppConfigID N   Application Config ID (Service, Job, or Request ID)
   -?, -h, --Help        Print usage and exit
  

• Threaded - Multithreaded