Graylog Security - Asset Enrichment / Sync /

Graylog Central (peer support)
1

Hi everyone,

I’m trying to wrap my head around the use of Asset Enrichtment, especially the part where the Assets are synced / created / updated.

Either I’m really missing something or it is really tedious to manage.

  1. I’m missing a way for consolidating assets (e.g. Import from AD and import from M365). Imagine a hybrid-joined device - you willö have two or more entries for every device and you can’t be sure, which one will be used for the asset enrichment or during asset updates. Ideally, you’d be able to consolidate the machine assets based on hostname / ip / whatever
  2. Connection to existing asset management tools would be a great enhancement too, as they usually already hold the necessary information such as hostnames, ip addresses, owners, … (e.g. CMDB in ServiceNow)
  3. Is there any way to attach a pipeline to the sync process? The IP and MAC address of a device are usually neither stored in the AD nor M365. A quick lookup in a lookup table would already suffice here, but as there is no stream attached to the sync, I wasn’t able to find a way to attach a pipeline.
  4. The sync doesn’t allow to specify custom attributes. Custom attributes are only available during manual creation / update, or am I missing something?

If you have looked into any of these or have found a way to work around these, please let me know. I’m thankful for any hint, that might lead me into the right direction.

Cheers
Robin

Graylog Version: Package Version: Graylog 7.0.3+cf37d91

2

Hello @rbnkng,

These questions would be better placed to Graylog support, as you have a Security license you should have access to Enterprise Support or you could request a sync with your CSM.

Currently there isn’t a way to consolidate assets, in the event a log is parsed by Graylog and one of the fields that links to an asset is present, both the 365 and AD asset would be come associated with that log. As the accounts are technically different it’s an interesting conversation to have if they should be consolidated, at the very least having a custom field that points to on being AD and the other 365 is a good idea.

For existing Asset Management tools, the best route to putting this on the roadmap would be a feature request within the Graylog git.

Any updates to assets will have to be carried out within a pipeline, available functions are below.

add_asset_categories(asset_name, categories) : Void Add a list of categories to an asset.
debug(value) : Void Print the passed value as string in the server log. You can also pass $message to print the current Message object. Note that this will only appear in the log of the server node that is processing the message you are trying to debug.
machine_asset_lookup(lookup_type, value) : Map Look up a single machine asset. If multiple assets match the input parameters, only one will be returned.
machine_asset_update(lookup_type, lookup_value, [ip_addresses], [hostnames]) : Void Update the IP or MAC addresses for a machine asset. If multiple assets match the input parameters, only one will be selected.
remove_asset_categories(asset_name, categories) : Void Remove a list of categories from an asset.
set_associated_assets([message]) : Void Adds Associated Asset Information.
user_asset_lookup(lookup_type, value) : Map Look up a single user asset. If multiple assets match the input parameters, only one will be returned.