XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to SIEM.
TACL> PARAM  ZTNT^LOG^CONNECTS YES
TACL> PARAM  ZTNT^LOG^SERVICENAME YES
TACL> PARAM  ZTNT^LOG^CONNECTS^COLLECTOR <alternate-EMS-collector>

Below is an XMA FILTER example that sends Syslog messages for TELSERV connection/disconnection operations to a SIEM server.

FILTERDEFBEGIN $EXAMPLE-TELSERV-CONN-DISCONN
STATUS ACTIVE
EVALUATE_MSG CONTINUE

! MOVER selection ? EMS MOVER
  MOVER_BEGIN
    MOVER_SELECT_BEGIN
      PRODUCT = EMS
    MOVER_SELECT_END
MOVER_END

! DATA selection ? EMS event 10, 11
! TELSERV Event number 10: Telserv CONNECT
! TELSERV Event number 11: Telserv DISCONNECT
  DATA_BEGIN
    ! Event number 10: Telserv CONNECT
    DATA_SELECT_BEGIN
      FILTERTYPE STRINGFILTER
      AUDIT.OBJECTTYPE LIKE "TANDEM.TELSERV.*"
      AUDIT.MESSAGEID = 10
    DATA_SELECT_END
    ! Event number 11: Telserv DISCONNECT
    DATA_SELECT_BEGIN
      FILTERTYPE STRINGFILTER
      AUDIT.OBJECTTYPE LIKE "TANDEM.TELSERV.*"
      AUDIT.MESSAGEID = 11
    DATA_SELECT_END
 DATA_END

! ACTION definition ? sends the following format message to SIEM
! The Message format:
! ? HEADER          : the HEADER fields shown in RFC 5424
! ? STRUCTURED-DATA : Nil, ZERO structured-data field
! ? MSG             : a free format message starts with "XMA Audit data:"
! ?
!== Example of the message: HEADER + (nil) + MSG
ACTION_BEGIN
     ACTIONTYPE SYSLOGQ
     IPALERT_MSGDELIMITER CR
     IPALERT_IPPROCESS $ZTC0
     IPALERT_ADDRESS 10.12.34.56
     IPALERT_PORT 7890
!==
!==  ALERTSTRINGs for IEFT format : HEADER + (nil) + MSG
!==  
!==  ALERTSTRINGs for HEADER
     ALERTSTRING <1> VERSION
     ALERTSTRING |(substr(AUDIT.RECORDLCT,1,10)}|T|{substr(AUDIT.RECORDLCT,12,12))|
     ALERTSTRING |(INSTALL.SYSTEMNAME)|
     ALERTSTRING |(SESSION.CLIENTPROGRAM)|
     ALERTSTRING |(SESSION.PROCESSTHREADID)|
     ALERTSTRING |(SESSION.SESSIONID)|
!== 
!==  STRUCTURED-DATA: (nil) contains ZERO STRUCTURED-DATA elements
!==
!==  ALERTSTRINGs for MSG (free format)
     ALERTSTRING XMA AUDIT data::
     ALERTSTRING GMT date:|{substr(AUDIT.RECORDGMT,1,10))|
     ALERTSTRING GMT time:|{substr(AUDIT.RECORDGMT,12,12))|
     ALERTSTRING outcome:|{AUDIT.OUTCOME)|
     ALERTSTRING productcode:|{AUDIT.PRODUCTCODE)|
     ALERTSTRING subject_userid:|{AUDIT.SUBJECT_USERNUMBER_MAJOR)|
     ALERTSTRING |(AUDIT.SUBJECT_USERNUMBER_MINOR)|
     ALERTSTRING subject_loginname:|{AUDIT.SUBJECTLOGIN)|
     ALERTSTRING target_loginname:|{AUDIT.TARGETLOGIN)|
     ALERTSTRING objecttype:|{AUDIT.OBJECTTYPE)|
     ALERTSTRING objectname:|{AUDIT.OBJECTNAME)|
     ALERTSTRING operation:|{AUDIT.OPERATION)|
     ALERTSTRING terminal:|{AUDIT.TERMINAL)|
     ALERTSTRING user_data:|{AUDIT.USER_DATA)|
     ALERTSTRING result:|{AUDIT.RESULT)|
     ALERTSTRING XMA SESSION data::
     ALERTSTRING sessionid:|{SESSION.SESSIONID)|
     ALERTSTRING sessionname:|{SESSION.SESSIONNAME)|
     ALERTSTRING ipaddr:|{SESSION.IPADDRV46)|
     ALERTSTRING dnsname:|{SESSION.DNSNAME)|
     ALERTSTRING clientprogram:|{SESSION.CLIENTPROGRAM)|
ACTION_END