FileMgr

✏️ /lib/python3.9/site-packages/ansible_collections/cyberark/pas/rulebooks/cyberark_test_rule.yml

✕ Tutup

- name: Demo rules with CyberArk syslog as source
  hosts: localhost 
  sources:
    - cyberark.pas.syslog:
        host: 0.0.0.0 
        port: 1514
  rules:
    - name: Check For User Suspension Event, Then Disable The User and Notify
      condition: event.cyberark.syslog.audit_record.Severity == "Error" and event.cyberark.syslog.audit_record.MessageID == "5"
      action:
        run_playbook:
          name: disable_user.yml
          extra_vars:
            username: "{{ event.cyberark.syslog.audit_record.Issuer }}"  
    - name: Check For PTA irregular IP OR irregular Hours Access and Notify
      condition: event.cyberark.DeviceEventClassID == "25" or event.cyberark.DeviceEventClassID == "23"
      action:
        run_playbook:
          name: pta_disable_notify.yml
          extra_vars:
            username: "{{ event.cyberark.suser }}"
            #username: "{{ event.cyberark.suser | ansible.builtin.regex_search('^[a-zA-Z0-9_]+') }}"
            eventname: "{{ event.cyberark.DeviceName }}"
            eventurl: "{{ event.cyberark.PTALink }}"
            station: "{{ event.cyberark.shost }}"

Batal

⬅ pas 7 item

Nama	Tipe	Ukuran	Diubah	Perm	Aksi
📄 cyberark_test_rule.yml	yml	1.1 KB	08/11/23 12:12	0644	✏️ ⬇
📄 disable_pas_user_kafka.yml	yml	560 B	08/11/23 12:12	0644	✏️ ⬇
📄 disable_pas_user_webhook.yml	yml	540 B	08/11/23 12:12	0644	✏️ ⬇
📄 disable_user.yml	yml	1.2 KB	08/11/23 12:12	0644	✏️ ⬇
📄 inventory.yml	yml	69 B	08/11/23 12:12	0644	✏️ ⬇
📄 pta_disable_notify.yml	yml	1.3 KB	08/11/23 12:12	0644	✏️ ⬇
📄 pta_notify.yml	yml	602 B	08/11/23 12:12	0644	✏️ ⬇

✏️ Rename

🔑 Ubah Permission