: My First LUA Parser - converts LDAP://ou=blah,cn=blah,ou=blah blah/username into username - Useful for websense logs works on user.dst

Document created by RSA Admin Employee on Nov 26, 2015
Version 1Show Document
  • View in full screen mode

[root@LOGDECCOL1 parsers]# more ldappath.lua

 

 

local ldappath = nw.createParser("LDAP_PATH", "Extract LDAP Path and username ")

 

--[[

    DESCRIPTION

 

        Extract the final username from an LDAP Path.

        Assumes Username is stored in user.dst

        If the username contains LDAP:// ..... .... /username then username gets put in user.dst field.

 

 

    VERSION

 

       26 November 2015 - Initial Developemnt

 

    AUTHOR

 

        david.waugh2@rsa.com

 

 

    DEPENDENCIES

        None

 

    NOTES

 

None

 

--]]

 

-- Since we are using an external module, we declare it here.

-- This must be in the parsers directory

 

-- These are the meta keys that we will write meta into

ldappath:setKeys({

nwlanguagekey.create("user.dst"),

})

 

-- This is our function.  What we want to do when we match a token...or in this case, the

-- URL meta callback.

function ldappath:urlMeta(index, url)

    local someURL = url

    local username = username

    --nw.logInfo("URL:  " .. url)

    -- check if the url contains the method (http:// or https:// typically) in first

    -- few bytes

        local first,last = string.find(url, "://", 1,10)

    if last then

        someURL = string.sub(someURL, last + 1, -1)

    end

 

    --nw.logInfo("someURL:  " .. someURL)

 

    foundPosition = string.find(someURL, "/")

    if foundPosition then

        username = string.sub(someURL,foundPosition+1,-1)

--nw.logInfo("username:  " .. username)

nw.createMeta(self.keys["user.dst"], username)

    end

 

end

 

ldappath:setCallbacks({

[nwlanguagekey.create("user.dst")] = ldappath.urlMeta,  -- this is the meta callback key

})

2 people found this helpful

Attachments

    Outcomes