Mascheramento dei log di accesso e del report attività per conformità con le leggi sulla privacy

Utilizzare gli script descritti in questa sezione per automatizzare il processo di mascheramento delle informazioni nel report attività o nei log degli accessi in modo conforme alle normative sulla privacy in vigore e, facoltativamente, inviare via e-mail il report a un destinatario.

1. Creare un file batch (BAT) denominato anonymizeData.bat e contenente lo script riportato di seguito, quindi salvarlo in una posizione significativa, ad esempio C:\automate_scripts.

   @echo off
   set paramRequiredMessage=Syntax: anonymizeData.bat USERNAME PASSWORD/PASSWORD_FILE URL [EMAIL_TO_ADDRESS]
   
   if "%~1" == "" (
     echo User Name is missing.
     echo %paramRequiredMessage%
     exit /b 1
     )
   if "%~2" == "" (
     echo Password or Password_File is missing.
     echo %paramRequiredMessage%
     exit /b 1
     )
   if "%~3" == "" (
     echo URL is missing.
     echo %paramRequiredMessage%
     exit /b 1
     )
   
   PowerShell.exe -File anonymizeData.ps1 %*

2. Creare uno script PowerShell (PS1) denominato anonymizeData.ps1 e contenente lo script riportato di seguito, quindi salvarlo in una posizione significativa, ad esempio C:\automate_scripts.

   # Anonymize data script
   
   $username=$args[0]
   $password=$args[1]
   $url=$args[2]
   $emailtoaddress=$args[3]
   
   # Generic variables
   $date=$(get-date -f dd_MM_yy_HH_mm_ss)
   $datedefaultformat=$(get-date)
   $logdir="./logs/"
   $logfile="$logdir/anonymize-data-" + $date + ".log"
   $filelist="filelist.txt"
   
   function LogMessage
   {
     $message=$args[0]
   
     echo "$message" >> $logfile
   }
   
   function EchoAndLogMessage
   {
     $message=$args[0]
   
     echo "$message"
     echo "$message" >> $logfile
   }
   function Init
   {
      $logdirexists=Test-Path $logdir
      if (!($logdirexists)) {
          mkdir $logdir 2>&1 | out-null
       }
   
      $logfileexists=Test-Path $logfile
      if ($logfileexists) {
          rm $logfile 2>&1 | out-null
       }
   
      $filelistexists=Test-Path $filelist
      if ($filelistexists) {
          rm $filelist 2>&1 | out-null
       }
   }
   
   function ProcessCommand
   {
      $op=$args
      echo "EPM Automate operation: epmautomate.bat $op" >> $logfile
      if ($op -eq 'listfiles') {
         epmautomate.bat $op | where {$_ -like ' apr/*/access_log.zip'} | Tee-Object -FilePath $filelist | Out-File $logfile -Append 2>&1
       } else {
         epmautomate.bat $op >> $logfile 2>&1
           if ($LASTEXITCODE -ne 0) {
              echo "EPM Automate operation failed: epmautomate.bat $op. See $logfile for details."
              #exit
              }
       }
   }
   
   function RunEpmAutomateCommands
   {
       EchoAndLogMessage "Running EPM Automate commands to anonymize data in the access logs and activity reports."
       ProcessCommand login $username $password $url
       ProcessCommand listfiles
       ProcessFiles
       ProcessCommand logout
   }
   
   function ProcessActivityReport
   {
       $activityreport=$args[0]
       $user=$args[1]
   
       $activityreportexists=Test-Path "$activityreport"
       if ($activityreportexists) {
           LogMessage "Removing User ID: $user from activity report $activityreport"
           (Get-Content "$activityreport").replace("$user", 'XXXXX') | Set-Content "$activityreport"
           $txt = [io.file]::ReadAllText("$activityreport") -replace "`r`n","`n"
           [io.file]::WriteAllText("$activityreport", $txt)
           #Get-ChildItem -File -Recurse | % { $x = get-content -raw -path $activityreport; $x -replace "`r`n","`n" | set-content -path $activityreport }
       }
   }
   
   function AnonymizeData
   {
       $aprdir=$args[0]
       $datestampdir=$args[1]
       $path="$aprdir/$datestampdir"
       $accesslogzipped="access_log.zip"
       $accesslog="access_log.csv"
       $accesslogupdated=$accesslog + ".tmp"
       $activityreportfile="$datestampdir" + ".html"
       $userArray = @()
   
       expand-Archive -Path "$path/$accesslogzipped" -DestinationPath $path
       rm $path/$accesslogzipped 2>&1 | out-null
       $accesslogexists=Test-Path "$path/$accesslog"
       if ($accesslogexists) {
           EchoAndLogMessage "Processing access log: $path/$accesslog"
           Get-Content $path/$accesslog | ForEach-Object {
               $elements=[regex]::Split( $_ , ',(?=(?:[^"]|"[^"]*")*$)' )
               $date=$elements[0]
               $time=$elements[1]
               $uri=$elements[2]
               $duration=$elements[3]
               $bytes=$elements[4]
               $ip=$elements[5]
               $user=$elements[6]
               $screen=$elements[7]
               $action=$elements[8]
               $object=$elements[9]
               if ($date -like 'Date') {
                   echo "$_" >> $path/$accesslogupdated
               } else {
                   if ($user -notlike '-') {
                       LogMessage "Removing instance of User ID: $user from $path/$accesslog."
                       echo "$date,$time,$uri,$duration,$bytes,$ip,XXXXX,$screen,$action,$object" >> $path/$accesslogupdated
                       $userArray += $user
                   } else {
                       echo "$date,$time,$uri,$duration,$bytes,$ip,$user,$screen,$action,$object" >> $path/$accesslogupdated
                   }
               }
           }
           #Get-ChildItem -File -Recurse | % { $x = get-content -raw -path $path/$accesslogupdated; $x -replace "`r`n","`n" | set-content -path $path/$accesslogupdated }
           $txt = [io.file]::ReadAllText("$path/$accesslogupdated") -replace "`r`n","`n"
           [io.file]::WriteAllText("$path/$accesslogupdated", $txt)
           mv -Force $path/$accesslogupdated $path/$accesslog
           Compress-Archive -Path $path/$accesslog $path/$accesslogzipped
           rm $path/$accesslog 2>&1 | out-null
       }
   
       EchoAndLogMessage "Processing activity report: $path/$activityreportfile"
       $userArray = $userArray | Select-Object -Unique
       foreach ($element in $userArray) {
           ProcessActivityReport "$path/$activityreportfile" "$element"            
       }
   }
   
   function ProcessFiles
   {
       # Loop through iteration csv file and parse
       Get-Content $filelist | ForEach-Object {
           $fullpath=$_.trim()
           $elements=$fullpath.split('/')
           $aprdir=$elements[0]
           $datestampdir=$elements[1]
           $accesslogfile="access_log.zip"
           $activityreportfile="$datestampdir" + ".html"
           $datestampdirexists=Test-Path "$aprdir/$datestampdir"
           $accesslog="$aprdir/$datestampdir/$accesslogfile"
           $activityreport="$aprdir/$datestampdir/$activityreportfile"
   
           echo "fullpath: $fullpath" >> $logfile
           echo "aprdir: $aprdir, datestampdir: $datestampdir" >> $logfile
           if (!($datestampdirexists)) {
               mkdir "$aprdir/$datestampdir" -ea 0 2>&1 | out-null
               ProcessCommand downloadfile "$accesslog"
               ProcessCommand downloadfile "$activityreport"
               mv "$accesslogfile" "$aprdir/$datestampdir"
               mv "$activityreportfile" "$aprdir/$datestampdir"
               AnonymizeData "$aprdir" "$datestampdir"
               ProcessCommand deletefile "$accesslog"
               ProcessCommand deletefile "$activityreport"
               ProcessCommand uploadfile "$accesslog" "$aprdir/$datestampdir"
               ProcessCommand uploadfile "$activityreport" "$aprdir/$datestampdir"
           } else {
               EchoAndLogMessage "Files in directory $aprdir/$datestampdir were processed earlier. Skipping these files."
           }
       }
   }
   
   function callSendMail
   {
       $elements=$logfile.split('/')
       $logfilename=$elements[3]
   
       if (${emailtoaddress} -match "@") {
           epmautomate.bat login ${username} ${password} ${url}
           epmautomate.bat uploadFile "$logfile"
           epmautomate.bat sendMail $emailtoaddress "Mask Access Logs and Activity Reports results" Body="The results of running the Mask Access Logs and Activity Reports script are attached." Attachments=$logfilename
           epmautomate.bat deleteFile "$logfilename"
           epmautomate.bat logout
       }
   }
   
   Init
   EchoAndLogMessage "Starting the anonymize data script"
   RunEpmAutomateCommands
   EchoAndLogMessage "Anonymize data script completed"
   EchoAndLogMessage "Refer to logfile: $logfile for details."
   callSendMail
   

3. Mediante la utility di pianificazione di Windows, programmare anonymizeData.bat. Vedere Automazione dell'esecuzione degli script per informazioni sulla procedura dettagliata.
   È necessario specificare i seguenti valori di parametro per eseguire anonymizeData.bat

   • Nome utente di un amministratore del servizio
   • Password dell'amministratore del servizio o la posizione in cui è disponibile il password file cifrato
   • URL dell'ambiente del servizio in cui devono essere mascherati i log di accesso e i report attività
   • Facoltativo: indirizzo e-mail a cui deve essere inviato il report. Il report viene inviato via e-mail solo se viene specificato questo valore.