HashiCorp Beispiel-Ereignismeldungen speichern
Verwenden Sie diese Beispiel-Ereignismeldungen, um die erfolgreiche Integration mit zu überprüfen QRadar®.
Wichtig: Aufgrund von Formatierungsproblemen fügen Sie das Nachrichtenformat in einen Texteditor ein und entfernen Sie anschließend alle Wagenrücklauf- oder Zeilenvorschubzeichen.
Die folgende Beispiel-Ereignismeldung wurde aus der Anwendung „ HashiCorpSample Logs Vault“ erfasst
Anforderungsprotokoll-Beispiel
<38>Nov 13 23:47:09 hashicorp.vault.test vault[966]: {"auth":{"policy_results":{"allowed":true},"token_type":"default"},"request":{"headers":{"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"]},"id":"cd9f32a0-a040-3b8e-a111-a1a111a1a1e6","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.20.4+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"read","path":"sys/activation-flags","remote_address":"10.0.0.1","remote_port":63209},"time":"2025-11-14T07:47:09.422038596Z","type":"request"}| QRadar Feldname | Hervorgehobener Name des Nutzlastfeldes |
|---|---|
| Ereignis-ID | operation_ mount_class_ mount_type |
| Einheitenzeit | time |
| Quellen-IP | remote_address |
| Quellenport | remote_port |
Beispiel für ein Antwortprotokoll
<38>Nov 13 23:47:09 hashicorp.vault.test vault[966]: {"auth":{"policy_results":{"allowed":true},"token_type":"default"},"request":{"headers":{"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"]},"id":"cd9f32a0-a040-3b8e-a111-a1a111a1a1e6","mount_accessor":"system_45667fef","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.20.4+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"read","path":"sys/activation-flags","remote_address":"10.0.0.1","remote_port":63209},"response":{"data":{"activated":["hmac-sha256:63d32938f3c265bf0612bf659ba93e0897809d900d603faa1aaa1111aa1111a1"],"unactivated":["hmac-sha256:d0a2c111111a11a1a111111721693ff5fcc86ad839a9b0a8e245fd9b950bd4a2"]},"mount_accessor":"system_45667fef","mount_class":"secret","mount_point":"sys/","mount_running_plugin_version":"v1.20.4+builtin.vault","mount_type":"system"},"time":"2025-11-14T07:47:09.423423265Z","type":"response"}| QRadar Feldname | Hervorgehobener Name des Nutzlastfeldes |
|---|---|
| Ereignis-ID | operation_ mount_class_mount_type |
| Einheitenzeit | time |
| Quellen-IP | remote_address |
| Quellenport | remote_port |
Beispiel für ein Antwortprotokoll mit Fehler
<38>Nov 6 03:23:58 hashicorp.vault.test vault[954]: {"error":"2 errors occurred:\n\t* permission denied\n\t* invalid token\n\n","request":{"client_token":"hmac-sha256:efeedcf2d4e01148a1111a111a111aa011eb052f244dc851d305f9f3613255b5","headers":{"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0"]},"id":"b0103be1-11aa-111a-a111-9ae3d4e2f88b","mount_class":"auth","mount_point":"auth/token/","mount_running_version":"v1.20.4+builtin.vault","mount_type":"token","namespace":{"id":"root"},"operation":"read","path":"auth/token/lookup-self","remote_address":"10.0.0.1","remote_port":52782},"response":{"data":{"error":"hmac-sha256:f3d1c18789a08c114dc11aa1a11a1111ac6f34f6314c16c60706bf279dbb5f8c"},"mount_class":"auth","mount_point":"auth/token/","mount_running_plugin_version":"v1.20.4+builtin.vault","mount_type":"token"},"time":"2025-11-06T11:23:58.76004865Z","type":"response"}| QRadar Feldname | Hervorgehobener Name des Nutzlastfeldes |
|---|---|
| Ereignis-ID | operation_ mount_class_mount_type |
| Einheitenzeit | time |
| Quellen-IP | remote_address |
| Quellenport | remote_port |