Enmascaramiento de registros de acceso e informe de actividades para cumplir las normas de privacidad

Utilice los scripts de esta sección para automatizar el proceso de enmascaramiento de información en el Informe de actividad o los Registros de acceso para cumplir con las leyes de privacidad y para, si lo desea, enviar por correo electrónico el informe a un destinatario.

1. Cree un archivo por lotes (BAT) llamado anonymizeData.bat que contenga el siguiente script y guárdelo en una ubicación apropiada, por ejemplo, C:\automate_scripts.

   @echo off
   set paramRequiredMessage=Syntax: anonymizeData.bat USERNAME PASSWORD/PASSWORD_FILE URL [EMAIL_TO_ADDRESS]
   
   if "%~1" == "" (
     echo User Name is missing.
     echo %paramRequiredMessage%
     exit /b 1
     )
   if "%~2" == "" (
     echo Password or Password_File is missing.
     echo %paramRequiredMessage%
     exit /b 1
     )
   if "%~3" == "" (
     echo URL is missing.
     echo %paramRequiredMessage%
     exit /b 1
     )
   
   PowerShell.exe -File anonymizeData.ps1 %*

2. Cree un script PowerShell (PS1) llamado anonymizeData.ps1 que contenga el siguiente script y guárdelo en una ubicación apropiada, por ejemplo, C:\automate_scripts.

   # Anonymize data script
   
   $username=$args[0]
   $password=$args[1]
   $url=$args[2]
   $emailtoaddress=$args[3]
   
   # Generic variables
   $date=$(get-date -f dd_MM_yy_HH_mm_ss)
   $datedefaultformat=$(get-date)
   $logdir="./logs/"
   $logfile="$logdir/anonymize-data-" + $date + ".log"
   $filelist="filelist.txt"
   
   function LogMessage
   {
     $message=$args[0]
   
     echo "$message" >> $logfile
   }
   
   function EchoAndLogMessage
   {
     $message=$args[0]
   
     echo "$message"
     echo "$message" >> $logfile
   }
   function Init
   {
      $logdirexists=Test-Path $logdir
      if (!($logdirexists)) {
          mkdir $logdir 2>&1 | out-null
       }
   
      $logfileexists=Test-Path $logfile
      if ($logfileexists) {
          rm $logfile 2>&1 | out-null
       }
   
      $filelistexists=Test-Path $filelist
      if ($filelistexists) {
          rm $filelist 2>&1 | out-null
       }
   }
   
   function ProcessCommand
   {
      $op=$args
      echo "EPM Automate operation: epmautomate.bat $op" >> $logfile
      if ($op -eq 'listfiles') {
         epmautomate.bat $op | where {$_ -like ' apr/*/access_log.zip'} | Tee-Object -FilePath $filelist | Out-File $logfile -Append 2>&1
       } else {
         epmautomate.bat $op >> $logfile 2>&1
           if ($LASTEXITCODE -ne 0) {
              echo "EPM Automate operation failed: epmautomate.bat $op. See $logfile for details."
              #exit
              }
       }
   }
   
   function RunEpmAutomateCommands
   {
       EchoAndLogMessage "Running EPM Automate commands to anonymize data in the access logs and activity reports."
       ProcessCommand login $username $password $url
       ProcessCommand listfiles
       ProcessFiles
       ProcessCommand logout
   }
   
   function ProcessActivityReport
   {
       $activityreport=$args[0]
       $user=$args[1]
   
       $activityreportexists=Test-Path "$activityreport"
       if ($activityreportexists) {
           LogMessage "Removing User ID: $user from activity report $activityreport"
           (Get-Content "$activityreport").replace("$user", 'XXXXX') | Set-Content "$activityreport"
           $txt = [io.file]::ReadAllText("$activityreport") -replace "`r`n","`n"
           [io.file]::WriteAllText("$activityreport", $txt)
           #Get-ChildItem -File -Recurse | % { $x = get-content -raw -path $activityreport; $x -replace "`r`n","`n" | set-content -path $activityreport }
       }
   }
   
   function AnonymizeData
   {
       $aprdir=$args[0]
       $datestampdir=$args[1]
       $path="$aprdir/$datestampdir"
       $accesslogzipped="access_log.zip"
       $accesslog="access_log.csv"
       $accesslogupdated=$accesslog + ".tmp"
       $activityreportfile="$datestampdir" + ".html"
       $userArray = @()
   
       expand-Archive -Path "$path/$accesslogzipped" -DestinationPath $path
       rm $path/$accesslogzipped 2>&1 | out-null
       $accesslogexists=Test-Path "$path/$accesslog"
       if ($accesslogexists) {
           EchoAndLogMessage "Processing access log: $path/$accesslog"
           Get-Content $path/$accesslog | ForEach-Object {
               $elements=[regex]::Split( $_ , ',(?=(?:[^"]|"[^"]*")*$)' )
               $date=$elements[0]
               $time=$elements[1]
               $uri=$elements[2]
               $duration=$elements[3]
               $bytes=$elements[4]
               $ip=$elements[5]
               $user=$elements[6]
               $screen=$elements[7]
               $action=$elements[8]
               $object=$elements[9]
               if ($date -like 'Date') {
                   echo "$_" >> $path/$accesslogupdated
               } else {
                   if ($user -notlike '-') {
                       LogMessage "Removing instance of User ID: $user from $path/$accesslog."
                       echo "$date,$time,$uri,$duration,$bytes,$ip,XXXXX,$screen,$action,$object" >> $path/$accesslogupdated
                       $userArray += $user
                   } else {
                       echo "$date,$time,$uri,$duration,$bytes,$ip,$user,$screen,$action,$object" >> $path/$accesslogupdated
                   }
               }
           }
           #Get-ChildItem -File -Recurse | % { $x = get-content -raw -path $path/$accesslogupdated; $x -replace "`r`n","`n" | set-content -path $path/$accesslogupdated }
           $txt = [io.file]::ReadAllText("$path/$accesslogupdated") -replace "`r`n","`n"
           [io.file]::WriteAllText("$path/$accesslogupdated", $txt)
           mv -Force $path/$accesslogupdated $path/$accesslog
           Compress-Archive -Path $path/$accesslog $path/$accesslogzipped
           rm $path/$accesslog 2>&1 | out-null
       }
   
       EchoAndLogMessage "Processing activity report: $path/$activityreportfile"
       $userArray = $userArray | Select-Object -Unique
       foreach ($element in $userArray) {
           ProcessActivityReport "$path/$activityreportfile" "$element"            
       }
   }
   
   function ProcessFiles
   {
       # Loop through iteration csv file and parse
       Get-Content $filelist | ForEach-Object {
           $fullpath=$_.trim()
           $elements=$fullpath.split('/')
           $aprdir=$elements[0]
           $datestampdir=$elements[1]
           $accesslogfile="access_log.zip"
           $activityreportfile="$datestampdir" + ".html"
           $datestampdirexists=Test-Path "$aprdir/$datestampdir"
           $accesslog="$aprdir/$datestampdir/$accesslogfile"
           $activityreport="$aprdir/$datestampdir/$activityreportfile"
   
           echo "fullpath: $fullpath" >> $logfile
           echo "aprdir: $aprdir, datestampdir: $datestampdir" >> $logfile
           if (!($datestampdirexists)) {
               mkdir "$aprdir/$datestampdir" -ea 0 2>&1 | out-null
               ProcessCommand downloadfile "$accesslog"
               ProcessCommand downloadfile "$activityreport"
               mv "$accesslogfile" "$aprdir/$datestampdir"
               mv "$activityreportfile" "$aprdir/$datestampdir"
               AnonymizeData "$aprdir" "$datestampdir"
               ProcessCommand deletefile "$accesslog"
               ProcessCommand deletefile "$activityreport"
               ProcessCommand uploadfile "$accesslog" "$aprdir/$datestampdir"
               ProcessCommand uploadfile "$activityreport" "$aprdir/$datestampdir"
           } else {
               EchoAndLogMessage "Files in directory $aprdir/$datestampdir were processed earlier. Skipping these files."
           }
       }
   }
   
   function callSendMail
   {
       $elements=$logfile.split('/')
       $logfilename=$elements[3]
   
       if (${emailtoaddress} -match "@") {
           epmautomate.bat login ${username} ${password} ${url}
           epmautomate.bat uploadFile "$logfile"
           epmautomate.bat sendMail $emailtoaddress "Mask Access Logs and Activity Reports results" Body="The results of running the Mask Access Logs and Activity Reports script are attached." Attachments=$logfilename
           epmautomate.bat deleteFile "$logfilename"
           epmautomate.bat logout
       }
   }
   
   Init
   EchoAndLogMessage "Starting the anonymize data script"
   RunEpmAutomateCommands
   EchoAndLogMessage "Anonymize data script completed"
   EchoAndLogMessage "Refer to logfile: $logfile for details."
   callSendMail
   

3. Con el programador de Windows, programe anonymizeData.bat. Consulte Automatización de la ejecución de scripts para obtener pasos detallados.
   Debe proporcionar los siguientes valores de parámetros para ejecutar anonymizeData.bat.

   • Nombre de usuario de un administrador del servicio.
   • Contraseña del administrador del servicio o la ubicación en la que está disponible el archivo de contraseña cifrado.
   • URL del entorno del servicio en el que se van a enmascarar los registros de acceso e informes de actividad.
   • Opcional: dirección de correo electrónico a la que se va a enviar el informe. El informe se envía por correo electrónico solo si se especifica este valor.