Kontextlogs von Network Connectivity Center
In diesem Dokument wird beschrieben, wie Felder von Network Connectivity Center-Kontextlogs den Feldern von Google Security Operations Unified Data Model (UDM) zugeordnet werden.
Ein Aufnahmelabel gibt den Parser an, der Logrohdaten in das strukturierte UDM-Format normalisiert. Die Informationen in diesem Dokument gelten für den Parser mit dem Aufnahmelabel GCP_NETWORK_CONNECTIVITY_CONTEXT
.
Informationen zu anderen Kontextparsern, die von Google Security Operations unterstützt werden, finden Sie unter Google Security Operations-Kontextparser.
Feldzuordnungsreferenz
In der folgenden Tabelle wird erläutert, wie der Google Security Operations-Parser die Felder der Kontextprotokolle von Network Connectivity Center den Feldern des Google Security Operations Unified Data Model (UDM) zuordnet.
Log field | UDM mapping | Logic |
---|---|---|
|
entity.resource.attribute.cloud.environment |
The entity.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM . |
|
entity.resource_ancestors.attribute.cloud.environment |
If the resource.data.network log field value is not empty, then the entity.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM . |
|
entity.resource_ancestors.resource_type |
If the resource.data.network log field value is not empty, then the entity.resource_ancestors.resource_type UDM field is set to VPC_NETWORK . |
resource.data.createTime |
entity.resource.attribute.creation_time |
|
resource.discoveryDocumentUri |
entity.resource.attribute.labels [discovery_document] |
|
resource.discoveryName |
entity.resource.attribute.labels [discovery_name] |
|
resource.data.ipCidrRange |
entity.resource.attribute.labels [ipcidrrange] |
|
resource.data.overlaps |
entity.resource.attribute.labels [overlaps] |
If the resource.data.overlaps log field value is not empty, then the resource.data.overlaps log field is mapped to the entity.resource.attribute.labels.overlaps%{index} UDM field. |
resource.data.peering |
entity.resource.attribute.labels [peering] |
|
resource.data.prefixLength |
entity.resource.attribute.labels [prefix_length] |
|
resource.data.description |
metadata.description |
|
|
metadata.product_entity_id |
The obj_id is extracted from the Resource.data.name log field using Grok pattern, and the the obj_id log field value is not empty and the resource.data.uniqueId log field value is empty, then the obj_id log field is mapped to the entity.resource.product_object_id UDM field. |
|
metadata.entity_type |
The metadata.entity_type UDM field is set to RESOURCE . |
resource.data.locationId |
entity.location.name |
|
resource.data.name |
entity.resource.attribute.labels [resource_name] |
|
resource.data.state |
entity.resource.attribute.labels [resource_state] |
|
resource.data.targetCidrRange |
entity.resource.attribute.labels [target_cidr_range] |
If the resource.data.targetCidrRange log field value is not empty, then the resource.data.targetCidrRange log field is mapped to the entity.resource.attribute.labels.target_cidrrange%{index} UDM field. |
resource.data.usage |
entity.resource.attribute.labels [usage] |
|
resource.data.updateTime |
entity.resource.attribute.last_update_time |
|
name |
entity.resource.name |
|
resource.data.network |
entity.resource_ancestors.name |
|
resource.data.uniqueId |
entity.resource.product_object_id |
|
assetType |
entity.resource.resource_subtype |
|
|
entity.resource.resource_type |
The entity.resource.resource_type UDM field is set to DEVICE . |
resource.version |
metadata.product_version |
|
|
relations.direction |
If the ancestors log field value is not empty or the resource.data.hub log field value is not empty or the resource.data.users log field value is not empty or the resource.data.routingVpcs.uri log field value is not empty or the resource.data.linkedVpnTunnels.uris log field value is not empty or the resource.data.linkedInterconnectAttachments.uris log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.virtualMachine log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.ipAddress log field value is not empty, then the relations.direction UDM field is set to UNIDIRECTIONAL . |
|
relations.entity_type |
If the ancestors log field value is not empty or the resource.data.hub log field value is not empty or the resource.data.users log field value is not empty or the resource.data.routingVpcs.uri log field value is not empty or the resource.data.linkedVpnTunnels.uris log field value is not empty or the resource.data.linkedInterconnectAttachments.uris log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.virtualMachine log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.ipAddress log field value is not empty, then the relations.entity_type UDM field is set to RESOURCE . |
resource.data.linkedRouterApplianceInstances.instances.ipAddress |
relations.entity.ip |
|
|
relations.entity.resource_ancestors.attribute.cloud.environment |
If the resource.parent log field value not contains the ancestors log field value or the resource.data.linkedVpnTunnels.vpcNetwork log field value is not empty or the resource.data.linkedInterconnectAttachments.vpcNetwork log field value is not empty or the resource.data.linkedRouterApplianceInstances.vpcNetwork log field value is not empty, then the relations.entity.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM . |
ancestors |
relations.entity.resource_ancestors.name |
If the resource.parent log field value not contains the ancestors log field value or the resource.data.linkedVpnTunnels.vpcNetwork log field value is not empty or the resource.data.linkedInterconnectAttachments.vpcNetwork log field value is not empty or the resource.data.linkedRouterApplianceInstances.vpcNetwork log field value is not empty, then the ancestors log field is mapped to the relations.entity.resource_ancestors.name UDM field. |
resource.data.linkedVpnTunnels.vpcNetwork |
relations.entity.resource_ancestors.name |
|
resource.data.linkedInterconnectAttachments.vpcNetwork |
relations.entity.resource_ancestors.name |
|
resource.data.linkedRouterApplianceInstances.vpcNetwork |
relations.entity.resource_ancestors.name |
|
|
relations.entity.resource_ancestors.resource_type |
If the resource.parent log field value not contains the ancestors log field value or the resource.data.linkedVpnTunnels.vpcNetwork log field value is not empty or the resource.data.linkedInterconnectAttachments.vpcNetwork log field value is not empty or the resource.data.linkedRouterApplianceInstances.vpcNetwork log field value is not empty, then the relations.entity.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT . |
|
relations.entity.resource_ancestors.resource_subtype |
The res_type |
|
relations.entity.resource.resource_subtype |
The res_type |
|
relations.entity.resource.attribute.cloud.environment |
If the resource.parent log field value contains the ancestors log field value or the resource.data.hub log field value is not empty or the resource.data.users log field value is not empty or the resource.data.routingVpcs.uri log field value is not empty or the resource.data.linkedVpnTunnels.uris log field value is not empty or the resource.data.linkedVpnTunnels.uris log field value is not empty or the resource.data.linkedInterconnectAttachments.uris log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.virtualMachine log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.ipAddress log field value is not empty, then the relations.entity.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM . |
resource.data.linkedVpnTunnels.siteToSiteDataTransfer |
relations.entity.resource.attribute.labels [vpntunnel_sitetosite_data_transfer] |
If the resource.data.linkedVpnTunnels.siteToSiteDataTransfer log field value is not empty, then the resource.data.linkedVpnTunnels.siteToSiteDataTransfer log field is mapped to the relations.entity.resource.attribute.labels.value UDM field. |
resource.data.linkedInterconnectAttachments.siteToSiteDataTransfer |
relations.entity.resource.attribute.labels [attachments_sitetosite_data_transfer] |
If the resource.data.linkedInterconnectAttachments.siteToSiteDataTransfer log field value is not empty, then the resource.data.linkedInterconnectAttachments.siteToSiteDataTransfer log field is mapped to the relations.entity.resource.attribute.labels.value UDM field. |
resource.data.linkedRouterApplianceInstances.siteToSiteDataTransfer |
relations.entity.resource.attribute.labels [routerapplliances_sitetosite_data_transfer] |
If the resource.data.linkedRouterApplianceInstances.siteToSiteDataTransfer log field value is not empty, then the resource.data.linkedRouterApplianceInstances.siteToSiteDataTransfer log field is mapped to the relations.entity.resource.attribute.labels.value UDM field. |
resource.data.hub |
relations.entity.resource.name |
If the resource.parent log field value contains the ancestors log field value, then the resource.parent log field is mapped to the relations.entity.resource.name UDM field. |
resource.data.routingVpcs.uri |
relations.entity.resource.name |
|
resource.data.linkedVpnTunnels.uris |
relations.entity.resource.name |
|
resource.data.linkedInterconnectAttachments.uris |
relations.entity.resource.name |
|
resource.data.linkedRouterApplianceInstances.instances.virtualMachine |
relations.entity.resource.name |
|
resource.data.users |
relations.entity.resource.name |
|
resource.parent |
relations.entity.resource.name |
|
|
relations.entity.resource.resource_type |
If the resource.data.hub log field value is not empty or the resource.data.users log field value is not empty or the resource.data.linkedVpnTunnels.uris log field value is not empty or the resource.data.linkedInterconnectAttachments.uris log field value is not empty, then the relations.entity.resource.resource_type UDM field is set to DEVICE .If the resource.parent log field value contains the ancestors log field value, then the relations.entity.resource.resource_type UDM field is set to CLOUD_PROJECT .If the resource.data.routingVpcs.uri log field value is not empty, then the relations.entity.resource.resource_type UDM field is set to VPC_NETWORK .If the resource.data.linkedRouterApplianceInstances.instances.virtualMachine log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.ipAddress log field value is not empty, then the relations.entity.resource.resource_type UDM field is set to VIRTUAL_MACHINE . |
|
relations.relationship |
If the ancestors log field value is not empty or the resource.data.hub log field value is not empty or the resource.data.users log field value is not empty or the resource.data.routingVpcs.uri log field value is not empty or the resource.data.linkedVpnTunnels.uris log field value is not empty or the resource.data.linkedInterconnectAttachments.uris log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.virtualMachine log field value is not empty or the resource.data.linkedRouterApplianceInstances.instances.ipAddress log field value is not empty, then the relations.relationship UDM field is set to MEMBER . |
resource.data.routingVpcs.requiredForNewSiteToSiteDataTransferSpokes |
relations.entity.resource.attribute.labels [required_for_new_site_to_site_data_transfer_spokes] |