文件操作 - cyberark_test_rule.yml

文件: /usr/lib/python3.12/site-packages/ansible_collections/cyberark/pas/rulebooks/cyberark_test_rule.yml

编辑文件内容

- name: Demo rules with CyberArk syslog as source
  hosts: localhost 
  sources:
    - cyberark.pas.syslog:
        host: 0.0.0.0 
        port: 1514
  rules:
    - name: Check For User Suspension Event, Then Disable The User and Notify
      condition: event.cyberark.syslog.audit_record.Severity == "Error" and event.cyberark.syslog.audit_record.MessageID == "5"
      action:
        run_playbook:
          name: disable_user.yml
          extra_vars:
            username: "{{ event.cyberark.syslog.audit_record.Issuer }}"  
    - name: Check For PTA irregular IP OR irregular Hours Access and Notify
      condition: event.cyberark.DeviceEventClassID == "25" or event.cyberark.DeviceEventClassID == "23"
      action:
        run_playbook:
          name: pta_disable_notify.yml
          extra_vars:
            username: "{{ event.cyberark.suser }}"
            #username: "{{ event.cyberark.suser | ansible.builtin.regex_search('^[a-zA-Z0-9_]+') }}"
            eventname: "{{ event.cyberark.DeviceName }}"
            eventurl: "{{ event.cyberark.PTALink }}"
            station: "{{ event.cyberark.shost }}"

文件操作 - cyberark_test_rule.yml

文件: /usr/lib/python3.12/site-packages/ansible_collections/cyberark/pas/rulebooks/cyberark_test_rule.yml

编辑文件内容

修改文件时间

删除文件