search

CiscoSecurity / fp-05-firepower-cli

Public Repo for an eStreamer CLI project
10 stars 8 forks source link

suser view problem #24

Open cporcell opened 5 months ago

cporcell commented 5 months ago

Hi, I have a problem with the info about the user at the last version of the firepower. The Estreamer is sending info to Sentinel with the cef format, and the info about the user is not correct, i can't see the user, instead i see 9999999 or 9999997 (sometimes other numbers, but mostly are that ones).

image

I was diving into the last version that I'm testing and the productive one and i found some changes. one of them is that at the file view.py was a user ID part commented:

#            self.__addValueIfAvailable(
#                View.USER_ID,
#                [ Cache.USERS, record['userId']] )

I change it and then change at the cef.py the view.USER to View.USER_ID and started to see the data but not correctly parsed. like this: 'blockLength': 8, 'blockType': 0, 'data': 'username'

If i change at the cef.py the userId parse configuration adding .data the estreamer stops working. It does not start. 'userId': 'suser' ---> 'userId.data': 'suser'

Do you know how it can show the real userID, like the old version?

Thank you so much!