Cisco Advanced Web Security Reporting -

Tomas Moser — Thu, 20 Apr 2017 14:57:20 GMT

Hi Team,

Cisco Advanced Web Security Reporting v6.1 tool does not work correctly with LDAP.

This tool is actually Splunk 6.3 with Cisco app on top of it packaged in one piece to parse some Cisco WSA logs. After following configuration manual for LDAP authentication and department reporting I believe it does not work correctly.

Problem:

File /opt/cisco_wsa_reporting/etc/apps/cisco_wsa_reporting/lookups/departments.csv contains confusing content. Every LDAP user is a member of multiple groups. However I can see that script "discovery.py populated department field in csv file with value "Alef-CZ" which is NOT any of our groups. On top of that weird string " name" " folows in the next line. I know that "name" is one of LDAP object attributes.

I think there is a problem with parsing data from LDAP quiery via ldapsearch command in a script. However, not being python expert, I do not know how to fix it. There is no detailed documentation available.

departments.csv:

"user_id","displayName","department"
"login1","Firstname Surname","Alef-CZ
name"
"login2","Firstname2 Surname2","Alef-CZ
name"

...

Source of all available information:

http://www.cisco.com/c/dam/en/us/td/docs/security/wsa/Advanced_Reporting/WSA_Advanced_Reporting_6/Advanced_Web_Security_Reporting_6_1.pdf

Any ideas? Can Cisco DEV team look into it? I probably cannot open a TAC case as it's just evaluation.

Tomas

Hello Tomas,

Tao Yang — Fri, 21 Apr 2017 07:09:52 GMT

Hello Tomas,

Eval customer can also create the TAC case. Please create a new TAC case to fix this issue.

Hi Tao,

Tomas Moser — Fri, 21 Apr 2017 08:23:02 GMT

Hi Tao,

OK, I'd love to. But how? I do not have any S/N, P/N or VLN identificators. No input I have tried on TAC opening case page works.

Best regards,

Tomas

Re: Hi Tao,

ccnarc — Sun, 28 Jul 2019 12:41:00 GMT

We opened TAC case, and they suggested to use like below; It worked.

CN=Username_In_AD,OU=Admins,OU=A-Team,DC=DOMAIN_NAME,DC=DOMAIN_PREFIX"

ex: CN=ravi,OU=Admins,OU=ADMIN_Team,DC=NIKE,,DC=COM

topic Hi Tao, in Web Security

Cisco Advanced Web Security Reporting -

Hello Tomas,

Hi Tao,

Re: Hi Tao,