From 5948d0244ce8658b4aa53b571491026b02feeb72 Mon Sep 17 00:00:00 2001 From: rombernier Date: Tue, 17 Dec 2024 10:21:42 +0100 Subject: [PATCH 1/2] update test --- Tenable/alsid/tests/alert_certificate.json | 6 +++--- Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json | 6 +++--- Tenable/alsid/tests/alert_certificate_DANG_ACCESS2.json | 6 +++--- Tenable/alsid/tests/alert_certificate_template_acl.json | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Tenable/alsid/tests/alert_certificate.json b/Tenable/alsid/tests/alert_certificate.json index a08095e2e..05bfe61bf 100644 --- a/Tenable/alsid/tests/alert_certificate.json +++ b/Tenable/alsid/tests/alert_certificate.json @@ -1,9 +1,9 @@ { "input": { - "message": "\"0\" \"1\" \"ad.corp\" \"ad.corp\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate \nTemplates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=corp\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.corp\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-34\n5849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.corp\\\\AC750-DSI-SDAT-Espace de \ntravail-FOO-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-109881018\n9-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.corp\\\\Ordinateurs du \ndomaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\"\n,\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.corp\\\\AC750-DSI-SDAT-Espace de \ntravail-FOO-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \n\"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \n\"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \n\"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \n\"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"" + "message": "\"0\" \"1\" \"ad.corp\" \"ad.corp\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate \nTemplates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=corp\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.corp\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-34\n5849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.corp\\\\Espace de \ntravail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-109881018\n9-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.corp\\\\Ordinateurs du \ndomaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\"\n,\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.corp\\\\Espace de \ntravail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \n\"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \n\"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \n\"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \n\"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"" }, "expected": { - "message": "\"0\" \"1\" \"ad.corp\" \"ad.corp\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate \nTemplates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=corp\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.corp\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-34\n5849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.corp\\\\AC750-DSI-SDAT-Espace de \ntravail-FOO-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-109881018\n9-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.corp\\\\Ordinateurs du \ndomaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\"\n,\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.corp\\\\AC750-DSI-SDAT-Espace de \ntravail-FOO-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \n\"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \n\"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \n\"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \n\"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"", + "message": "\"0\" \"1\" \"ad.corp\" \"ad.corp\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate \nTemplates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=corp\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.corp\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-34\n5849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.corp\\\\Espace de \ntravail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-109881018\n9-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.corp\\\\Ordinateurs du \ndomaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\"\n,\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.corp\\\\Espace de \ntravail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \n\"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \n\"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \n\"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \n\"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"", "event": { "kind": "alert", "outcome": "success" @@ -19,7 +19,7 @@ "ADobject": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=corp", "ApproveCertifTestOptionChecked": "\u2610", "CertificateNameDeviantAces": "\u274c\ufe0f", - "DangerousAceList": "{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.corp\\\\AC750-DSI-SDAT-Espace de travail-FOO-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.corp\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.corp\\\\AC750-DSI-SDAT-Espace de travail-FOO-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}", + "DangerousAceList": "{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.corp\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.corp\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.corp\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}", "DisplayName": "DSC UCN Export", "DomainName": "ad.corp", "EkuAttributeDeviantAces": "\u274c\ufe0f", diff --git a/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json b/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json index 7802789c2..b5b64dca2 100644 --- a/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json +++ b/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json @@ -1,9 +1,9 @@ { "input": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.domain\\\\AC750-DSI-FOO-Espace de \n travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"" + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\AC750-DSI-FOO-Espace de \n travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"" }, "expected": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.domain\\\\AC750-DSI-FOO-Espace de \n travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"", + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\AC750-DSI-FOO-Espace de \n travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"", "event": { "kind": "alert", "outcome": "success" @@ -17,7 +17,7 @@ "ADdomainName": "ad.domain", "ADforestName": "ad.domain", "ADobject": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", - "DangerousAceList": "{\"Item1\": \"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item2\": \"S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item3\": \"urdom.ad.domain\\\\AC750-DSI-FOO-Espace de travail-GSW-Adm\", \"Item4\": [{\"Item1\": \"Modify permissions\", \"Item2\": \"\"}, {\"Item1\": \"Modify owner\", \"Item2\": \"\"}, {\"Item1\": \"Write all properties\", \"Item2\": \"\"}]}", + "DangerousAceList": "{\"Item1\": \"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item2\": \"S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item3\": \"test.ad.domain\\\\AC750-DSI-FOO-Espace de travail-GSW-Adm\", \"Item4\": [{\"Item1\": \"Modify permissions\", \"Item2\": \"\"}, {\"Item1\": \"Modify owner\", \"Item2\": \"\"}, {\"Item1\": \"Write all properties\", \"Item2\": \"\"}]}", "DistinguishedName": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", "alertID": 1, "alertSeverityLevel": "critical", diff --git a/Tenable/alsid/tests/alert_certificate_DANG_ACCESS2.json b/Tenable/alsid/tests/alert_certificate_DANG_ACCESS2.json index 67912a8a6..71be5247d 100644 --- a/Tenable/alsid/tests/alert_certificate_DANG_ACCESS2.json +++ b/Tenable/alsid/tests/alert_certificate_DANG_ACCESS2.json @@ -1,9 +1,9 @@ { "input": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item\n3\":\"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693\n739-515\",\"Item3\":\"ad.domain\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"u\nrdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \n\"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \n\"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"" + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item\n3\":\"test.ad.domain\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693\n739-515\",\"Item3\":\"ad.domain\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \n\"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \n\"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"" }, "expected": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item\n3\":\"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693\n739-515\",\"Item3\":\"ad.domain\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"u\nrdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \n\"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \n\"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"", + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996840\" \"2\" \n\"R-CERTIF-TEMPLATE-MISCONFIG\" \"76485473\" \"DisplayName\"=\"DSC UCN Export\" \"DomainName\"=\"ad.domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item\n3\":\"test.ad.domain\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693\n739-515\",\"Item3\":\"ad.domain\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended \nright\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}]\" \"TrustEnrollServiceAceOptionChecked\"=\"\u2610\" \n\"TrustEnrollServicesList\"=\"\u29b0\" \"ApproveCertifTestOptionChecked\"=\"\u2610\" \"EnrollmentFlagDeviantAces\"=\"?\" \"EnrollmentFlagAttributeMisconfigured\"=\"?\" \"RaSignatureAttributeDeviantAces\"=\"\u274c\ufe0f\" \n\"RaSignatureAttributeMisconfigured\"=\"\u274c\ufe0f\" \"EkuAttributeDeviantAces\"=\"\u274c\ufe0f\" \"EkuContainAuthAttribute\"=\"\u2714\ufe0f\" \"EkuContainAuthList\"=\"\u29b0\" \"SanConfigCsrOptionChecked\"=\"\u2612\" \n\"CertificateNameDeviantAces\"=\"\u274c\ufe0f\" \"SanConfigCsrMisconfigured\"=\"\u2714\ufe0f\"", "event": { "kind": "alert", "outcome": "success" @@ -19,7 +19,7 @@ "ADobject": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", "ApproveCertifTestOptionChecked": "\u2610", "CertificateNameDeviantAces": "\u274c\ufe0f", - "DangerousAceList": "{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.domain\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}", + "DangerousAceList": "{\"Item1\":\"OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1098810189-8133351-2328693739-515\",\"Item2\":\"S-1-5-21-1098810189-8133351-2328693739-515\",\"Item3\":\"ad.domain\\\\Ordinateurs du domaine\",\"Item4\":[{\"Item1\":\"[Certificate Template] Extended right\",\"Item2\":\"Certificate-Enrollment\"}]},{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de travail\",\"Item4\":[{\"Item1\":\"[Certificate Template] Write all properties\",\"Item2\":\"\"}]}", "DisplayName": "DSC UCN Export", "DomainName": "ad.domain", "EkuAttributeDeviantAces": "\u274c\ufe0f", diff --git a/Tenable/alsid/tests/alert_certificate_template_acl.json b/Tenable/alsid/tests/alert_certificate_template_acl.json index 21b602beb..5d19a88c4 100644 --- a/Tenable/alsid/tests/alert_certificate_template_acl.json +++ b/Tenable/alsid/tests/alert_certificate_template_acl.json @@ -1,9 +1,9 @@ { "input": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \n\"76485473\" \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de \ntravail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"" + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \n\"76485473\" \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de \ntravail\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"" }, "expected": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \n\"76485473\" \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de \ntravail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"", + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \n\"76485473\" \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n\"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de \ntravail\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"", "event": { "kind": "alert", "outcome": "success" @@ -17,7 +17,7 @@ "ADdomainName": "ad.domain", "ADforestName": "ad.domain", "ADobject": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", - "DangerousAceList": "{\"Item1\": \"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item2\": \"S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item3\": \"urdom.ad.domain\\\\AC750-DSI-SDAT-Espace de travail-GSW-Adm\", \"Item4\": [{\"Item1\": \"Modify permissions\", \"Item2\": \"\"}, {\"Item1\": \"Modify owner\", \"Item2\": \"\"}, {\"Item1\": \"Write all properties\", \"Item2\": \"\"}]}", + "DangerousAceList": "{\"Item1\": \"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item2\": \"S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item3\": \"test.ad.domain\\\\Espace de travail\", \"Item4\": [{\"Item1\": \"Modify permissions\", \"Item2\": \"\"}, {\"Item1\": \"Modify owner\", \"Item2\": \"\"}, {\"Item1\": \"Write all properties\", \"Item2\": \"\"}]}", "DistinguishedName": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", "alertID": 1, "alertSeverityLevel": "critical", From 635b9c87a2711e3c0f845a64647d0e7cdbbcb768 Mon Sep 17 00:00:00 2001 From: rombernier Date: Tue, 17 Dec 2024 10:27:21 +0100 Subject: [PATCH 2/2] update test --- Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json b/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json index b5b64dca2..0cb12607b 100644 --- a/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json +++ b/Tenable/alsid/tests/alert_certificate_DANG_ACCESS.json @@ -1,9 +1,9 @@ { "input": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\AC750-DSI-FOO-Espace de \n travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"" + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de \n travail-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"" }, "expected": { - "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\AC750-DSI-FOO-Espace de \n travail-GSW-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"", + "message": "\"0\" \"1\" \"ad.domain\" \"ad.domain\" \"C-PKI-DANG-ACCESS\" \"critical\" \"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \"1996839\" \"2\" \"R-CERTIF-TEMPLATE-ACL\" \"76485473\" \n \"DistinguishedName\"=\"CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain\" \n \"DangerousAceList\"=\"[{\"Item1\":\"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item2\":\"S-1-5-21-1229472208-2678311744-2345022811-345849\",\"Item3\":\"test.ad.domain\\\\Espace de \n travail-Adm\",\"Item4\":[{\"Item1\":\"Modify permissions\",\"Item2\":\"\"},{\"Item1\":\"Modify owner\",\"Item2\":\"\"},{\"Item1\":\"Write all properties\",\"Item2\":\"\"}]}]\"", "event": { "kind": "alert", "outcome": "success" @@ -17,7 +17,7 @@ "ADdomainName": "ad.domain", "ADforestName": "ad.domain", "ADobject": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", - "DangerousAceList": "{\"Item1\": \"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item2\": \"S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item3\": \"test.ad.domain\\\\AC750-DSI-FOO-Espace de travail-GSW-Adm\", \"Item4\": [{\"Item1\": \"Modify permissions\", \"Item2\": \"\"}, {\"Item1\": \"Modify owner\", \"Item2\": \"\"}, {\"Item1\": \"Write all properties\", \"Item2\": \"\"}]}", + "DangerousAceList": "{\"Item1\": \"A;;LCRPWPRCWDWO;;;S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item2\": \"S-1-5-21-1229472208-2678311744-2345022811-345849\", \"Item3\": \"test.ad.domain\\\\Espace de travail-Adm\", \"Item4\": [{\"Item1\": \"Modify permissions\", \"Item2\": \"\"}, {\"Item1\": \"Modify owner\", \"Item2\": \"\"}, {\"Item1\": \"Write all properties\", \"Item2\": \"\"}]}", "DistinguishedName": "CN=DSCUCNExport,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=ad,DC=domain", "alertID": 1, "alertSeverityLevel": "critical",