Zabbix Template for PingCastle Reporting

What is PingCastle

Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework. It does not aim at a perfect evaluation but rather as an efficiency compromise.

What is Zabbix Template for PingCastle Reporting

This is a template for collecting high level overview of the status reported by PingCastle. It is intended as basis for C-level reporting dashboard. It includes the most important metrics (scores in PingCastle terminology).

Here you can find the template itself and a sample bash script process.sh for parsing reports and sending to Zabbix.

How is this template Designed

The template is designed with Zabbix Trapper items. This choice is dictated by the fact that AD scanning by pingcastle is performed on a machine separate from the Zabbix server/agent/proxy and then possibly processed on another machine.

It is possible to operate with regular items but this is not easily coordinated on a general basis and needs tuning.

What is monitored

Currently only key indicators are monitored

Available Triggers

For every score (Global, Privileged, Stale, Trust, Anomaly) there are 4 triggers according to PingCastle documentation

• 0 - no risk identified but some improvements detected
• between 1 and 10 - a few actions have been identified
• between 10 and 30 - rules should be looked with attention
• score higher than 30 - major risks identified

Macros have been provided to tune the thresholds per host

For Domain Administrators there is a single non recovering trigger that fires on change. The event must be manually acknoleged and closed.

There is also a trigger for stale data.

Available Macros

How to Use

• Import Template into Zabbix (will go in Templates/PingCastle group)
• Create a host with DomainSID as hostname. Use any custom nice looking name in the display name field
• Make sure you have zabbix_send and xmllint installed on the machine doing the processing
• Run process.sh

process.sh

A sample process.sh bash script is included for parsing the Pingcastle reports and submitting them to Zabbix.

Requirements

process.sh - requires as a minimum xmllint from libxml2-utils and zabbix_send

Questions / Issues / Others

Feel free to use the issues system for requests and others