Forum Discussion
Which audit log are you talking about? If it's the LM audit log, you might consider fetching the audit log via API. That should allow you to fetch only the "signs in" entries. The endpoint and filter would look like this:
/setting/accesslogs?happenedOn>:"1661777168",happenedOn<"1661780798",_all~"*signs%20in*"&size=1000
So, you'll need to do an API call through Groovy to the above endpoint. In the above example, I'm also filtering by a specific timeframe and limiting the results to at most 1000 entries. You might want to change the filter to only catch failures, i'm not sure what the filter text would be as I don't have any recent failures on my portal.
After you fetch the data, you should be able to go through it and count up the number of failures per user.
Documentation on that API endpoint: https://www.logicmonitor.com/support/rest-api-developers-guide/v1/access-logs/get-access-log-entries
This script should get you most of the way there. You'll want to modify the resource.logs.data.each loop so that it counts up login failures per user. Right now it just prints them out. You'll also want to dynamically fill in the happenedOn filter to be the timestamp from however far back you want the failures to be counted. Some helpful Groovy time examples.
import javax.crypto.Mac import javax.crypto.spec.SecretKeySpec import org.apache.commons.codec.binary.Hex import groovy.json.JsonSlurper import com.santaba.agent.util.Settings Map credentials = [ "id" : hostProps.get("lmaccess.id"), "key" : hostProps.get("lmaccess.key"), "account": hostProps.get("lmaccount")?:Settings.getSetting(Settings.AGENT_COMPANY) ] Map resources = [ "logs": ["path": "/setting/accesslogs","details": ["filter": "happenedOn>:1661777168,_all~\"*signs%20in*\"", "size": 1000]], ] if (credentials.account && credentials.id && credentials.key) { resources.each() { k, v -> Map headers = generate_headers(credentials.id, credentials.key, v.path) if (headers) { Map response = get_response(k, v, credentials.account, headers) if (response?.success) {resources[k]["data"] = response.response} } } } else { println("Device is not configured with the necessary portal credentials to proceed with API queries.\nExiting Program...") return 1 } resources.logs.data.each(){ println("${it.id}\t${it.username}\t${it.happenedOn}\t${it.ip}\t${it.description}") } return 0 def generate_headers(id, key, path) { try { // Create encryption signature for authorization request Long epoch_time = System.currentTimeMillis() // Get current system time (epoch time) Mac hmac = Mac.getInstance("HmacSHA256") hmac.init(new SecretKeySpec(key.getBytes(), "HmacSHA256")) signature = Hex.encodeHexString(hmac.doFinal("GET${epoch_time}${path}".getBytes())).bytes.encodeBase64() // return headers to main function return ["Authorization": "LMv1 $id:$signature:$epoch_time", "Content-Type": "application/json"] } catch (Exception err) { // If error occurred, print the error message println("ERROR: Unable to establish encryption for $path. Attempting next resource...\n${err.message}") } } def get_response(resource, parameters, account, headers) { try { boolean proceed = true // Boolean used to determine if additional pagination is required // Map to store query results for each endpoint. Contains a list to store actual returned values and a boolean to determine if successful Map results = ["response": [], "success" : true] add_query_parameters(resource, parameters) // Add initial offset and size values to appropriate categories (skips metrics category since it's stagnate) while (proceed) { // Used for paginating through all availabe results. Grabs 1000 at a time and moves offset if another query is required. Map query = query_resource(account, parameters, headers) // Query each API endpoint for a response (Should receive as Map) // If the response was successful (including status and error messages), proceed to printing results if (query && query?.data && query?.status == 200 && query?.errmsg?.toUpperCase() == "OK") { if (resource != "metrics") { results.response.addAll(query.data.items) // Add all the data items found to our results map data list if (query?.data?.items?.size() < parameters.details.size) { // If we received less than 1000 results proceed = false // There is no need to execute another API query with a shifted offset } else { // Otherwise parameters.details.offset += parameters.details.size // Shift the offset to start 1000 numbers from current position } } else { results.response = query.data // Add all the data items found to our results map data list proceed = false // We've successfully queried all values. End while loop } } else { // If response was not successful, print eror message for each category that failed and continue to next endpoint // If response error and status can be determined, print them. Otherwise, use UNKNOWN println("ERROR: Failed to query $resource API Endpoint...\n" + "${query?.errmsg?.toUpperCase() ?: 'UNKNOWN'} (STATUS: ${query?.status ?: 'UNKNOWN'})") results.success = false // Set success value to false since we failed our API query proceed = false // End while loop because of failure and proceed to next endpoint } } return results // Return results to main function } catch (Exception err) { println("ERROR: Script failed while attempting to query $resource API endpoint...\n${err?.message}") } } def add_query_parameters(category, parameters) { // Add size and offset field to map (only if collectors or admins category) if (category != "metrics") { Map query_details = ["size" : 1000, "offset": 0] // If there's already a details key in the details map if (parameters.details) { parameters.details << query_details // Append the query details information to the pre-existing details map } else { // Otherwise, create a details key and assign it the query details map as a value parameters.put("details", query_details) } } } def query_resource(account, details, headers) { try { // Configure request url from account, path, and authorization headers String url = "https://${account}.logicmonitor.com/santaba/rest${details.path}?${pack_parameters(details.details)}" // Return query response, converted from JSON to usable map return new JsonSlurper().parseText(url.toURL().getText(useCaches: true, allowUserInteraction: false, requestProperties: headers)) } catch (Exception err) { // If error occurred, print the error message println("ERROR: Unable to query ${details.path} for details.\n${err.message}") } } def pack_parameters(query_details) { // If additional query details are located in map, include them in url string List pairs = [] query_details?.each { k, v -> pairs.add("${k}=${v}")} return pairs.join("&") }
Related Content
- 6 months ago
- 8 months ago
- 13 days ago
- 2 months ago