Chronicle context parsers

This document lists the Chronicle context parsers that normalize context logs into Chronicle Unified Data Model (UDM) fields.

Context logs contain information about Google Cloud asset metadata of the resources that Chronicle supports. For more information about resource types, see Cloud Asset Inventory supported resource types. Examples of Resource Manager context log fields: assetType, resource.data.name, and resource.version.

Configure ingestion of context logs

To ingest the context logs to Chronicle, follow the instructions in Ingest Google Cloud data to Chronicle.

If you encounter issues when you ingest the context logs, contact Chronicle support.

Field mapping reference and supported resource types

The following table lists the context parsers that Chronicle supports, the corresponding ingestion label, and the supported resource types.

To view the mapping reference documentation of the context parser, click the corresponding context parser name from the table.

Service name	Ingestion label	Supported resource types
`Resource Manager`	`GCP_RESOURCE_MANAGER_CONTEXT`	`cloudresourcemanager.googleapis.com/Folder` `cloudresourcemanager.googleapis.com/Organization` `cloudresourcemanager.googleapis.com/Project` `cloudresourcemanager.googleapis.com/TagBinding` `cloudresourcemanager.googleapis.com/TagKey` `cloudresourcemanager.googleapis.com/TagValue`
`Cloud SQL`	`GCP_SQL_CONTEXT`	`sqladmin.googleapis.com/BackupRun` `sqladmin.googleapis.com/Instance`
`Cloud Functions`	`GCP_CLOUD_FUNCTIONS_CONTEXT`	`cloudfunctions.googleapis.com/CloudFunction` `cloudfunctions.googleapis.com/Function`
`Identity and Access Management`	`GCP_IAM_CONTEXT`	`iam.googleapis.com/ServiceAccount` `iam.googleapis.com/Role` `iam.googleapis.com/ServiceAccountKey`
`Network Connectivity Center`	`GCP_NETWORK_CONNECTIVITY_CONTEXT`	`networkconnectivity.googleapis.com/Hub` `networkconnectivity.googleapis.com/PolicyBasedRoutes` `networkconnectivity.googleapis.com/Spoke`
`Google Kubernetes Engine`	`GCP_KUBERNETES_CONTEXT`	`apps.k8s.io/Deployment` `apps.k8s.io/ReplicaSet` `batch.k8s.io/Job` `container.googleapis.com/Cluster` `container.googleapis.com/NodePool` `extensions.k8s.io/Ingress` `k8s.io/Namespace` `k8s.io/Node` `k8s.io/Pod` `k8s.io/Service` `networking.k8s.io/Ingress` `networking.k8s.io/NetworkPolicy` `rbac.authorization.k8s.io/ClusterRole` `rbac.authorization.k8s.io/ClusterRoleBinding` `rbac.authorization.k8s.io/Role` `rbac.authorization.k8s.io/RoleBinding`
`Compute Engine`	`GCP_COMPUTE_CONTEXT`	`compute.googleapis.com/Autoscaler` `compute.googleapis.com/Address` `compute.googleapis.com/BackendBucket` `compute.googleapis.com/BackendService` `compute.googleapis.com/Commitment` `compute.googleapis.com/Disk` `compute.googleapis.com/ExternalVpnGateway` `compute.googleapis.com/Firewall` `compute.googleapis.com/FirewallPolicy` `compute.googleapis.com/ForwardingRule` `compute.googleapis.com/GlobalAddress` `compute.googleapis.com/GlobalForwardingRule` `compute.googleapis.com/HealthCheck` `compute.googleapis.com/HttpHealthCheck` `compute.googleapis.com/HttpsHealthCheck` `compute.googleapis.com/Image` `compute.googleapis.com/Instance` `compute.googleapis.com/InstanceGroup` `compute.googleapis.com/InstanceGroupManager` `compute.googleapis.com/InstanceTemplate` `compute.googleapis.com/Interconnect` `compute.googleapis.com/InterconnectAttachment` `compute.googleapis.com/License` `compute.googleapis.com/MachineImage` `compute.googleapis.com/Network` `compute.googleapis.com/NetworkEndpointGroup` `compute.googleapis.com/NodeGroup` `compute.googleapis.com/NodeTemplate` `compute.googleapis.com/PacketMirroring` `compute.googleapis.com/Project` `compute.googleapis.com/PublicDelegatedPrefix` `compute.googleapis.com/RegionBackendService` `compute.googleapis.com/RegionDisk` `compute.googleapis.com/Reservation` `compute.googleapis.com/ResourcePolicy` `compute.googleapis.com/Route` `compute.googleapis.com/Router` `compute.googleapis.com/SecurityPolicy` `compute.googleapis.com/Snapshot` `compute.googleapis.com/SslCertificate` `compute.googleapis.com/SslPolicy` `compute.googleapis.com/Subnetwork` `compute.googleapis.com/ServiceAttachment` `compute.googleapis.com/TargetHttpProxy` `compute.googleapis.com/TargetHttpsProxy` `compute.googleapis.com/TargetInstance` `compute.googleapis.com/TargetPool` `compute.googleapis.com/TargetTcpProxy` `compute.googleapis.com/TargetSslProxy` `compute.googleapis.com/TargetVpnGateway` `compute.googleapis.com/UrlMap` `compute.googleapis.com/VpnGateway` `compute.googleapis.com/VpnTunnel`