Cloud SQL 컨텍스트 로그

이 문서에서는 Cloud SQL 컨텍스트 로그 필드를 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑하는 방법을 설명합니다.

수집 라벨은 원시 로그 데이터를 구조화된 UDM 형식으로 정규화하는 파서를 식별합니다. 이 문서의 정보는 GCP_SQL_CONTEXT 수집 라벨이 있는 파서에 적용됩니다.

Google Security Operations에서 지원하는 다른 컨텍스트 파서에 대한 자세한 내용은 Google Security Operations 컨텍스트 파서를 참조하세요.

필드 매핑 참조

이 섹션에서는 Google Security Operations 파서가 Cloud SQL 컨텍스트 로그 필드를 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑하는 방법을 설명합니다.

Log field UDM mapping Logic
ancestors relations.entity.resource_ancestors.name If the resource.parent log field value is not matched with the value of ancestors log field, then the ancestors log field is mapped to the relations.entity.resource_ancestors.name UDM field.
assetType entity.resource.resource_subtype
name entity.resource.name
resource.data.availableMaintenanceVersions entity.resource.attribute.labels[available_maintenance_versions]
resource.data.backendType entity.resource.attribute.labels[backend_type]
resource.data.backupKind entity.resource.attribute.labels[backup_kind]
resource.data.connectionName entity.resource.attribute.labels[connection_name]
resource.data.createTime entity.resource.attribute.creation_time
resource.data.currentDiskSize entity.resource.attribute.labels[current_disk_size]
resource.data.databaseInstalledVersion entity.resource.attribute.labels[database_installed_version]
resource.data.databaseVersion entity.resource.attribute.labels[database_version]
resource.data.description metadata.description
resource.data.diskEncryptionConfiguration.kind entity.resource.attribute.labels[disk_encryption_configuration_kind]
resource.data.diskEncryptionConfiguration.kmsKeyName entity.resource.attribute.labels[disk_encryption_configuration_kms_key_name]
resource.data.diskEncryptionStatus.kind entity.resource.attribute.labels[disk_encryption_status_kind]
resource.data.diskEncryptionStatus.kmsKeyVersionName entity.resource.attribute.labels[disk_encryption_configuration_kms_key_version_name
resource.data.endTime entity.resource.attribute.labels[end_time]
resource.data.enqueuedTime metadata.creation_timestamp
resource.data.error.code entity.resource.attribute.labels[error_code]
resource.data.error.kind entity.resource.attribute.labels[error_kind]
resource.data.error.message entity.resource.attribute.labels[error_message]
resource.data.etag entity.resource.attribute.labels[etag]
resource.data.failoverReplica.available entity.resource.attribute.labels[failover_replica_available]
resource.data.failoverReplica.name entity.resource.attribute.labels[failover_replica_name]
resource.data.gceZone entity.resource.attribute.cloud.availability_zone
resource.data.id metadata.product_entity_id
resource.data.instance entity.resource.attribute.labels[instance]
resource.data.instanceType entity.resource.attribute.labels[instance_type]
resource.data.ipAddresses.ipAddress entity.ip
resource.data.ipAddresses.timeToRetire entity.labels[ip_addresses_time_to_retire]
resource.data.ipAddresses.type entity.labels[ip_addresses_type]
resource.data.ipv6Address entity.ip
resource.data.kind entity.resource.attribute.labels[kind]
resource.data.location entity.location.name
resource.data.maintenanceVersion entity.resource.attribute.labels[maintenance_version]
resource.data.masterInstanceName entity.resource.attribute.labels[master_instance_name]
resource.data.maxDiskSize entity.resource.attribute.labels[max_disk_size]
resource.data.name entity.resource.attribute.labels[resource_name]
resource.data.onPremisesConfiguration.caCertificate entity.resource.attribute.labels[on_pem_conf_ca_certificate]
resource.data.onPremisesConfiguration.clientCertificate entity.resource.attribute.labels[on_pem_conf_client_certificate]
resource.data.onPremisesConfiguration.clientKey entity.resource.attribute.labels[on_pem_conf_client_key]
resource.data.onPremisesConfiguration.dumpFilePath entity.resource.attribute.labels[on_pem_conf_dump_file_path]
resource.data.onPremisesConfiguration.hostPort entity.resource.attribute.labels[on_pem_conf_host_port]
resource.data.onPremisesConfiguration.kind entity.resource.attribute.labels[on_pem_conf_kind]
resource.data.onPremisesConfiguration.password entity.resource.attribute.labels[on_pem_conf_password]
resource.data.onPremisesConfiguration.sourceInstance.name relations.entity.resource.name
resource.data.onPremisesConfiguration.sourceInstance.project relations.entity.resource.product_object_id
resource.data.onPremisesConfiguration.sourceInstance.region relations.entity.location.country_or_region
resource.data.onPremisesConfiguration.username entity.resource.attribute.labels[on_pem_conf_username]
resource.data.outOfDiskReport.sqlMinRecommendedIncreaseSizeGb entity.resource.attribute.labels[out_of_disk_report_sql_min_recommended_increase_size_gb]
resource.data.outOfDiskReport.sqlOutOfDiskState entity.resource.attribute.labels[out_of_disk_report_sql_out_of_disk_state]
resource.data.project entity.resource.product_object_id
resource.data.region entity.location.country_or_region
resource.data.replicaConfiguration.failoverTarget entity.resource.attribute.labels[replica_conf_fail_over_target]
resource.data.replicaConfiguration.kind entity.resource.attribute.labels[replica_conf_kind]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.caCertificate entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ca_certificate]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientCertificate entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_certificate]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientKey entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_key]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.connectRetryInterval entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_connect_retry_interval]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.dumpFilePath entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_dump_file_path]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.kind entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_kind]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.masterHeartbeatPeriod entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_master_heart_beat_period]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.password entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_password]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.sslCipher entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ssl_cipher]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.username entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_username]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.verifyServerCertificate entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_verify_server_certificate]
resource.data.replicaNames entity.resource.attribute.labels[replica_names]
resource.data.rootPassword entity.resource.attribute.labels[root_password]
resource.data.satisfiesPzs entity.resource.attribute.labels[satisfies_pzs]
resource.data.scheduledMaintenance.canDefer entity.resource.attribute.labels[schedule_maintenance_can_defer]
resource.data.scheduledMaintenance.canReschedule entity.resource.attribute.labels[schedule_maintenance_can_reschedule]
resource.data.scheduledMaintenance.scheduleDeadlineTime entity.resource.attribute.labels[schedule_maintenance_deadline_time]
resource.data.scheduledMaintenance.startTime entity.resource.attribute.labels[schedule_maintenance_start_time]
resource.data.secondaryGceZone entity.resource.attribute.labels[secondary_gce_zone]
resource.data.selfLink entity.url
resource.data.serverCaCert.cert entity.resource.attribute.labels[server_ca_cert_cert]
resource.data.serverCaCert.certSerialNumber entity.network.tls.server.certificate.serial
resource.data.serverCaCert.commonName entity.network.tls.server.certificate.subject
resource.data.serverCaCert.createTime entity.network.tls.server.certificate.not_before
resource.data.serverCaCert.expirationTime entity.network.tls.server.certificate.not_after
resource.data.serverCaCert.instance entity.resource.attribute.labels[server_ca_cert_instance]
resource.data.serverCaCert.kind entity.resource.attribute.labels[server_ca_cert_kind]
resource.data.serverCaCert.selfLink entity.resource.attribute.labels[server_ca_cert_self_link]
resource.data.serverCaCert.sha1Fingerprint entity.network.tls.server.certificate.sha1
resource.data.serviceAccountEmailAddress entity.user.email_addresses
resource.data.settings.activationPolicy entity.resource.attribute.labels[settings_activation_policy]
resource.data.settings.activeDirectoryConfig.domain entity.resource.attribute.labels[settings_active_directory_config_domain]
resource.data.settings.activeDirectoryConfig.kind entity.resource.attribute.labels[settings_active_directory_config_kind]
resource.data.settings.authorizedGaeApplications entity.resource.attribute.labels[settings_authorized_gae_applications]
resource.data.settings.availabilityType entity.resource.attribute.labels[settings_availability_type]
resource.data.settings.backupConfiguration.backupRetentionSettings.retainedBackups entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retained_backups]
resource.data.settings.backupConfiguration.backupRetentionSettings.retentionUnit entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retention_unit]
resource.data.settings.backupConfiguration.binaryLogEnabled entity.resource.attribute.labels[settings_backup_conf_binary_log_enabled]
resource.data.settings.backupConfiguration.enabled entity.resource.attribute.labels[settings_backup_conf_enabled]
resource.data.settings.backupConfiguration.kind entity.resource.attribute.labels[settings_backup_conf_kind]
resource.data.settings.backupConfiguration.location entity.resource.attribute.labels[settings_backup_conf_location]
resource.data.settings.backupConfiguration.pointInTimeRecoveryEnabled entity.resource.attribute.labels[settings_backup_conf_point_in_time_recovery_enabled]
resource.data.settings.backupConfiguration.replicationLogArchivingEnabled entity.resource.attribute.labels[settings_backup_conf_replication_log_archiving_enabled]
resource.data.settings.backupConfiguration.startTime entity.resource.attribute.labels[settings_backup_conf_start_time]
resource.data.settings.backupConfiguration.transactionLogRetentionDays entity.resource.attribute.labels[settings_backup_conf_transaction_log_retention_days]
resource.data.settings.collation entity.resource.attribute.labels[settings_collation]
resource.data.settings.connectorEnforcement entity.resource.attribute.labels[settings_connector_enforcement]
resource.data.settings.crashSafeReplicationEnabled entity.resource.attribute.labels[settings_crash_safe_replication_enabled]
resource.data.settings.databaseFlags.name entity.resource.attribute.labels[settings_database_flags_name]
resource.data.settings.databaseFlags.value entity.resource.attribute.labels[settings_database_flags_value]
resource.data.settings.databaseReplicationEnabled entity.resource.attribute.labels[settings_database_replication_enabled]
resource.data.settings.dataDiskSizeGb entity.resource.attribute.labels[settings_data_disk_size_gb]
resource.data.settings.dataDiskType entity.resource.attribute.labels[settings_data_disk_type]
resource.data.settings.deletionProtectionEnabled entity.resource.attribute.labels[settings_deletion_protection_enabled]
resource.data.settings.denyMaintenancePeriods.endDate entity.resource.attribute.labels[settings_deny_maintenance_periods_end_date]
resource.data.settings.denyMaintenancePeriods.startDate entity.resource.attribute.labels[settings_deny_maintenance_periods_start_date]
resource.data.settings.denyMaintenancePeriods.time entity.resource.attribute.labels[settings_deny_maintenance_periods_time]
resource.data.settings.insightsConfig.queryInsightsEnabled entity.resource.attribute.labels[settings_insights_config_query_insights_enabled]
resource.data.settings.insightsConfig.queryPlansPerMinute entity.resource.attribute.labels[settings_insights_config_query_plans_per_minute]
resource.data.settings.insightsConfig.queryStringLength entity.resource.attribute.labels[settings_insights_config_query_string_length]
resource.data.settings.insightsConfig.recordApplicationTags entity.resource.attribute.labels[settings_insights_config_record_application_tags]
resource.data.settings.insightsConfig.recordClientAddress entity.resource.attribute.labels[settings_insights_config_record_client_address]
resource.data.settings.ipConfiguration.allocatedIpRange entity.resource.attribute.labels[settings_ip_configuration_allocated_ip_range]
resource.data.settings.ipConfiguration.authorizedNetworks.expirationTime entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_expiration_time]
resource.data.settings.ipConfiguration.authorizedNetworks.kind entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_kind]
resource.data.settings.ipConfiguration.authorizedNetworks.name entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_name]
resource.data.settings.ipConfiguration.authorizedNetworks.value entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_value]
resource.data.settings.ipConfiguration.ipv4Enabled entity.resource.attribute.labels[settings_ip_configuration_ipv4_enabled]
resource.data.settings.ipConfiguration.privateNetwork entity.resource.attribute.labels[settings_ip_configuration_private_network]
resource.data.settings.ipConfiguration.requireSsl entity.resource.attribute.labels[settings_ip_configuration_require_ssl]
resource.data.settings.kind entity.resource.attribute.labels[settings_kind]
resource.data.settings.locationPreference.followGaeApplication entity.resource.attribute.labels[settings_location_preference_follow_gae_application]
resource.data.settings.locationPreference.kind entity.resource.attribute.labels[settings_location_preference_kind]
resource.data.settings.locationPreference.secondaryZone entity.resource.attribute.labels[settings_location_preference_secondary_zone]
resource.data.settings.locationPreference.zone entity.resource.attribute.labels[settings_location_preference_zone]
resource.data.settings.maintenanceWindow.day entity.resource.attribute.labels[settings_maintenance_window_day]
resource.data.settings.maintenanceWindow.hour entity.resource.attribute.labels[settings_maintenance_window_hour]
resource.data.settings.maintenanceWindow.kind entity.resource.attribute.labels[settings_maintenance_window_kind]
resource.data.settings.maintenanceWindow.updateTrack entity.resource.attribute.labels[settings_maintenance_window_update_track]
resource.data.settings.passwordValidationPolicy.complexity entity.resource.attribute.labels[settings_password_validation_policy_complexity]
resource.data.settings.passwordValidationPolicy.disallowUsernameSubstring entity.resource.attribute.labels[settings_password_validation_policy_disallow_username_substring]
resource.data.settings.passwordValidationPolicy.enablePasswordPolicy entity.resource.attribute.labels[settings_password_validation_policy_enable_password_policy]
resource.data.settings.passwordValidationPolicy.minLength entity.resource.attribute.labels[settings_password_validation_policy_min_length]
resource.data.settings.passwordValidationPolicy.passwordChangeInterval entity.resource.attribute.labels[settings_password_validation_policy_password_change_interval]
resource.data.settings.passwordValidationPolicy.reuseInterval entity.resource.attribute.labels[settings_password_validation_policy_reuse_interval]
resource.data.settings.pricingPlan entity.resource.attribute.labels[settings_pricing_plan]
resource.data.settings.replicationType entity.resource.attribute.labels[settings_replication_type]
resource.data.settings.settingsVersion entity.resource.attribute.labels[settings_version]
resource.data.settings.sqlServerAuditConfig.bucket entity.resource.attribute.labels[settings_sql_server_audit_config_bucket]
resource.data.settings.sqlServerAuditConfig.kind entity.resource.attribute.labels[settings_sql_server_audit_config_kind]
resource.data.settings.sqlServerAuditConfig.retentionInterval entity.resource.attribute.labels[settings_sql_server_audit_config_retention_interval]
resource.data.settings.sqlServerAuditConfig.uploadInterval entity.resource.attribute.labels[settings_sql_server_audit_config_upload_interval]
resource.data.settings.storageAutoResize entity.resource.attribute.labels[storage_auto_resize]
resource.data.settings.storageAutoResizeLimit entity.resource.attribute.labels[storage_auto_resize_limit]
resource.data.settings.tier entity.resource.attribute.labels[tier]
resource.data.settings.timeZone entity.resource.attribute.labels[time_zone]
resource.data.settings.userLabels entity.resource.attribute.labels[user_labels]
resource.data.startTime entity.resource.attribute.labels[start_time]
resource.data.state entity.resource.attribute.labels[state]
resource.data.status entity.resource.attribute.labels[status]
resource.data.suspensionReason entity.resource.attribute.labels[suspension_reason]
resource.data.timeZone entity.resource.attribute.labels[time_zone]
resource.data.type entity.resource.attribute.labels[type]
resource.data.windowStartTime entity.resource.attribute.labels[window_start_time]
resource.discoveryDocumentUri entity.resource.attribute.labels[discovery_document]
resource.discoveryName entity.resource.attribute.labels[discovery_name]
resource.parent, ancestors[] relations.entity.resource.name If the resource.parent log field value is empty, then the ancestors.0 log field is mapped to the relations.entity.resource.name UDM field.
resource.version metadata.product_version
entity.resource.resource_type The entity.resource.resource_type UDM field is set to DATABASE.
metadata.entity_type If the assetType log field value matches the regular expression pattern (BackupRun or instances), then the metadata.entity_type UDM field is set to RESOURCE.
metadata.product_name The metadata.product_name UDM field is set to GCP SQL.
metadata.vendor_name The metadata.vendor_name UDM field is set to Google Cloud Platform.
relations.entity_type If the resource.data.onPremisesConfiguration.sourceInstance.name log field value is not empty, then the relations.entity_type UDM field is set to RESOURCE.
relations.relationship If the resource.data.onPremisesConfiguration.sourceInstance.name,resource.data.onPremisesConfiguration.sourceInstance.region, or resource.data.onPremisesConfiguration.sourceInstance.project value is not empty, then the relations.entity.relationship UDM field is set to MEMBER.

If the ancestor log field value matches the regular expression pattern organizations or the ancestor log field value matches the regular expression pattern folders, then the relations.relationship UDM field is set to MEMBER.
relations.entity.resource_ancestors.resource_subtype If the ancestors log field value matches the regular expression pattern organizations, then the relations.entity.resource_ancestors.resource_subtype UDM field is set to organizations.

Else, if the ancestors log field value matches the regular expression pattern folders, then the relations.entity.resource_ancestors.resource_subtype UDM field is set to folders.
relations.entity.resource_ancestors.resource_type The relations.entity.resource_ancestors.resource_type UDM field is set to CLOUD_ORGANIZATION.