As `Hostname` is a singular value in the UDM Entity Graph, i.e., not a repeated field, you can't create an Asset context record with multiple hostnames. One alternative is creating an Asset context record for each hostname, i.e., duplicate the record just to have the hostname or FQDN match, but that's not out of the box and requires additional work on your export script from AD.
As you say, an option of using Parser extensions is effective to fix the hostname issue, e.g.,
...
grok {
match => {
"Hostname" => [
"^(?P<_Hostname>[^$|^\\\\.]+)"
]
}
overwrite => ["_Hostname"]
on_error => "grok_error_on_hostname"
}
if ![grok_error_on_hostname] {
mutate {
lowercase => [ "_Hostname"]
}
mutate {
replace => {
"event.idm.read_only_udm.principal.hostname" => "%{_Hostname}"
}
}
}
...
The above you apply to any Windows Event log integration, e.g., WINEVTLOG, WINDOWS_SYSMON, WINDOWS_DEFENDER_AV, and then it'll only normalize the hostname and drop the domain part.
One caveat, *if* the parser puts the `Hostname` field into target.hostname or src.hostname this logic fails.
It does require a more thorough approach to then apply different logic for the override based upon those specific (but few) event IDs where the value is not normalized into principal.
As `Hostname` is a singular value in the UDM Entity Graph, i.e., not a repeated field, you can't create an Asset context record with multiple hostnames. One alternative is creating an Asset context record for each hostname, i.e., duplicate the record just to have the hostname or FQDN match, but that's not out of the box and requires additional work on your export script from AD.
As you say, an option of using Parser extensions is effective to fix the hostname issue, e.g.,
...
grok {
match => {
"Hostname" => [
"^(?P<_Hostname>[^$|^\\\\.]+)"
]
}
overwrite => ["_Hostname"]
on_error => "grok_error_on_hostname"
}
if ![grok_error_on_hostname] {
mutate {
lowercase => [ "_Hostname"]
}
mutate {
replace => {
"event.idm.read_only_udm.principal.hostname" => "%{_Hostname}"
}
}
}
...
The above you apply to any Windows Event log integration, e.g., WINEVTLOG, WINDOWS_SYSMON, WINDOWS_DEFENDER_AV, and then it'll only normalize the hostname and drop the domain part.
One caveat, *if* the parser puts the `Hostname` field into target.hostname or src.hostname this logic fails.
It does require a more thorough approach to then apply different logic for the override based upon those specific (but few) event IDs where the value is not normalized into principal.
Thank you for the reply and the code example. I'll think about which way to normalize it works better for us
