HashiCorp Mensajes de eventos de muestra de bóveda
Utilice estos mensajes de evento de muestra para verificar que la integración con QRadar®.
Importante: Debido a problemas de formato, pegue el formato del mensaje en un editor de texto y, a continuación, elimine cualquier carácter de retorno de carro o avance de línea.
El siguiente mensaje de evento de muestra muestra Sample Logs recogido de la aplicación HashiCorp Vault
Muestra de registro de solicitudes
<38>Nov 13 23:47:09 hashicorp.vault.test vault[966]: {"auth":{"policy_results":{"allowed":true},"token_type":"default"},"request":{"headers":{"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"]},"id":"cd9f32a0-a040-3b8e-a111-a1a111a1a1e6","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.20.4+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"read","path":"sys/activation-flags","remote_address":"10.0.0.1","remote_port":63209},"time":"2025-11-14T07:47:09.422038596Z","type":"request"}| QRadar Nombre del campo de | Nombre del campo de carga útil resaltado |
|---|---|
| ID de suceso | operación_ clase_ de_montaje_ tipo_ de_montaje |
| Hora de dispositivo | time |
| IP de origen | remote_address |
| Puerto de origen | remote_port |
Muestra del registro de respuestas
<38>Nov 13 23:47:09 hashicorp.vault.test vault[966]: {"auth":{"policy_results":{"allowed":true},"token_type":"default"},"request":{"headers":{"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"]},"id":"cd9f32a0-a040-3b8e-a111-a1a111a1a1e6","mount_accessor":"system_45667fef","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.20.4+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"read","path":"sys/activation-flags","remote_address":"10.0.0.1","remote_port":63209},"response":{"data":{"activated":["hmac-sha256:63d32938f3c265bf0612bf659ba93e0897809d900d603faa1aaa1111aa1111a1"],"unactivated":["hmac-sha256:d0a2c111111a11a1a111111721693ff5fcc86ad839a9b0a8e245fd9b950bd4a2"]},"mount_accessor":"system_45667fef","mount_class":"secret","mount_point":"sys/","mount_running_plugin_version":"v1.20.4+builtin.vault","mount_type":"system"},"time":"2025-11-14T07:47:09.423423265Z","type":"response"}| QRadar Nombre del campo de | Nombre del campo de carga útil resaltado |
|---|---|
| ID de suceso | operation_ mount_class_mount_type |
| Hora de dispositivo | time |
| IP de origen | remote_address |
| Puerto de origen | remote_port |
Ejemplo de registro de respuestas con error
<38>Nov 6 03:23:58 hashicorp.vault.test vault[954]: {"error":"2 errors occurred:\n\t* permission denied\n\t* invalid token\n\n","request":{"client_token":"hmac-sha256:efeedcf2d4e01148a1111a111a111aa011eb052f244dc851d305f9f3613255b5","headers":{"user-agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0"]},"id":"b0103be1-11aa-111a-a111-9ae3d4e2f88b","mount_class":"auth","mount_point":"auth/token/","mount_running_version":"v1.20.4+builtin.vault","mount_type":"token","namespace":{"id":"root"},"operation":"read","path":"auth/token/lookup-self","remote_address":"10.0.0.1","remote_port":52782},"response":{"data":{"error":"hmac-sha256:f3d1c18789a08c114dc11aa1a11a1111ac6f34f6314c16c60706bf279dbb5f8c"},"mount_class":"auth","mount_point":"auth/token/","mount_running_plugin_version":"v1.20.4+builtin.vault","mount_type":"token"},"time":"2025-11-06T11:23:58.76004865Z","type":"response"}| QRadar Nombre del campo de | Nombre del campo de carga útil resaltado |
|---|---|
| ID de suceso | operation_ mount_class_mount_type |
| Hora de dispositivo | time |
| IP de origen | remote_address |
| Puerto de origen | remote_port |