Skip to main content

LoadResources_AD

A Task rather than a report to read: it loads Active Directory assets into a resource table for other content to enrich against, filtering out disabled accounts on the way in. Use it as the skeleton for any resource-loading task — the shape is the same whatever the source directory. See SIEM → Resources for the table it writes into.

The Task​

/**
 * Main method. This method is a skeleton method of loading AD assets. 
 *  
 * @returns {object} - Returns an object containing all the tables/metric/alert obtained from the queries
 */
function main() {
  let assets = Fluency_ResourceLoad("AD", "asset", "*", (obj, customer) => {
      let fields = obj["@ADAsset"]
      let {customer, name, sAMAccountName, description, dNSHostName, updatedOn, propertyFlags} = fields    
      // return {name, sAMAccountName, description, dNSHostName, updatedOn, propertyFlags} 
      if (propertyFlags.Some((_, e) => e == "ACCOUNTDISABLE")) {
        return null
      }   
      return {
         aggregate:{
           groupBy:{name},
           columns: {
             argmax:{updatedOn, sAMAccountName, description, dNSHostName, propertyFlags, customer} 
         }
       }   
      }    
  })
  return {assets}
}