Cloud SQL コンテキスト ログ

このドキュメントでは、Cloud SQL コンテキスト ログのフィールドが Google Security Operations の統合データモデル(UDM)フィールドにマッピングする方法について説明します。

取り込みラベルによって、未加工のログデータを構造化 UDM 形式に正規化するパーサーが識別されます。このドキュメントの情報は、取り込みラベル GCP_SQL_CONTEXT が付加されたパーサーに適用されます。

Google Security Operations がサポートするその他のコンテキスト パーサーについては、Google Security Operations のコンテキスト パーサーをご覧ください。

フィールド マッピング リファレンス

このセクションでは、Google Security Operations パーサーが Cloud SQL コンテキスト ログのフィールドを Google Security Operations の統合データモデル(UDM)フィールドにマッピングする方法について説明します。

Log field UDM mapping Logic
ancestors relations.entity.resource_ancestors.name If the resource.parent log field value is not matched with the value of ancestors log field, then the ancestors log field is mapped to the relations.entity.resource_ancestors.name UDM field.
assetType entity.resource.resource_subtype
name entity.resource.name
resource.data.availableMaintenanceVersions entity.resource.attribute.labels[available_maintenance_versions]
resource.data.backendType entity.resource.attribute.labels[backend_type]
resource.data.backupKind entity.resource.attribute.labels[backup_kind]
resource.data.connectionName entity.resource.attribute.labels[connection_name]
resource.data.createTime entity.resource.attribute.creation_time
resource.data.currentDiskSize entity.resource.attribute.labels[current_disk_size]
resource.data.databaseInstalledVersion entity.resource.attribute.labels[database_installed_version]
resource.data.databaseVersion entity.resource.attribute.labels[database_version]
resource.data.description metadata.description
resource.data.diskEncryptionConfiguration.kind entity.resource.attribute.labels[disk_encryption_configuration_kind]
resource.data.diskEncryptionConfiguration.kmsKeyName entity.resource.attribute.labels[disk_encryption_configuration_kms_key_name]
resource.data.diskEncryptionStatus.kind entity.resource.attribute.labels[disk_encryption_status_kind]
resource.data.diskEncryptionStatus.kmsKeyVersionName entity.resource.attribute.labels[disk_encryption_configuration_kms_key_version_name
resource.data.endTime entity.resource.attribute.labels[end_time]
resource.data.enqueuedTime metadata.creation_timestamp
resource.data.error.code entity.resource.attribute.labels[error_code]
resource.data.error.kind entity.resource.attribute.labels[error_kind]
resource.data.error.message entity.resource.attribute.labels[error_message]
resource.data.etag entity.resource.attribute.labels[etag]
resource.data.failoverReplica.available entity.resource.attribute.labels[failover_replica_available]
resource.data.failoverReplica.name entity.resource.attribute.labels[failover_replica_name]
resource.data.gceZone entity.resource.attribute.cloud.availability_zone
resource.data.id metadata.product_entity_id
resource.data.instance entity.resource.attribute.labels[instance]
resource.data.instanceType entity.resource.attribute.labels[instance_type]
resource.data.ipAddresses.ipAddress entity.ip
resource.data.ipAddresses.timeToRetire entity.labels[ip_addresses_time_to_retire]
resource.data.ipAddresses.type entity.labels[ip_addresses_type]
resource.data.ipv6Address entity.ip
resource.data.kind entity.resource.attribute.labels[kind]
resource.data.location entity.location.name
resource.data.maintenanceVersion entity.resource.attribute.labels[maintenance_version]
resource.data.masterInstanceName entity.resource.attribute.labels[master_instance_name]
resource.data.maxDiskSize entity.resource.attribute.labels[max_disk_size]
resource.data.name entity.resource.attribute.labels[resource_name]
resource.data.onPremisesConfiguration.caCertificate entity.resource.attribute.labels[on_pem_conf_ca_certificate]
resource.data.onPremisesConfiguration.clientCertificate entity.resource.attribute.labels[on_pem_conf_client_certificate]
resource.data.onPremisesConfiguration.clientKey entity.resource.attribute.labels[on_pem_conf_client_key]
resource.data.onPremisesConfiguration.dumpFilePath entity.resource.attribute.labels[on_pem_conf_dump_file_path]
resource.data.onPremisesConfiguration.hostPort entity.resource.attribute.labels[on_pem_conf_host_port]
resource.data.onPremisesConfiguration.kind entity.resource.attribute.labels[on_pem_conf_kind]
resource.data.onPremisesConfiguration.password entity.resource.attribute.labels[on_pem_conf_password]
resource.data.onPremisesConfiguration.sourceInstance.name relations.entity.resource.name
resource.data.onPremisesConfiguration.sourceInstance.project relations.entity.resource.product_object_id
resource.data.onPremisesConfiguration.sourceInstance.region relations.entity.location.country_or_region
resource.data.onPremisesConfiguration.username entity.resource.attribute.labels[on_pem_conf_username]
resource.data.outOfDiskReport.sqlMinRecommendedIncreaseSizeGb entity.resource.attribute.labels[out_of_disk_report_sql_min_recommended_increase_size_gb]
resource.data.outOfDiskReport.sqlOutOfDiskState entity.resource.attribute.labels[out_of_disk_report_sql_out_of_disk_state]
resource.data.project entity.resource.product_object_id
resource.data.region entity.location.country_or_region
resource.data.replicaConfiguration.failoverTarget entity.resource.attribute.labels[replica_conf_fail_over_target]
resource.data.replicaConfiguration.kind entity.resource.attribute.labels[replica_conf_kind]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.caCertificate entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ca_certificate]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientCertificate entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_certificate]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientKey entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_key]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.connectRetryInterval entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_connect_retry_interval]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.dumpFilePath entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_dump_file_path]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.kind entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_kind]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.masterHeartbeatPeriod entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_master_heart_beat_period]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.password entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_password]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.sslCipher entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ssl_cipher]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.username entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_username]
resource.data.replicaConfiguration.mysqlReplicaConfiguration.verifyServerCertificate entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_verify_server_certificate]
resource.data.replicaNames entity.resource.attribute.labels[replica_names]
resource.data.rootPassword entity.resource.attribute.labels[root_password]
resource.data.satisfiesPzs entity.resource.attribute.labels[satisfies_pzs]
resource.data.scheduledMaintenance.canDefer entity.resource.attribute.labels[schedule_maintenance_can_defer]
resource.data.scheduledMaintenance.canReschedule entity.resource.attribute.labels[schedule_maintenance_can_reschedule]
resource.data.scheduledMaintenance.scheduleDeadlineTime entity.resource.attribute.labels[schedule_maintenance_deadline_time]
resource.data.scheduledMaintenance.startTime entity.resource.attribute.labels[schedule_maintenance_start_time]
resource.data.secondaryGceZone entity.resource.attribute.labels[secondary_gce_zone]
resource.data.selfLink entity.url
resource.data.serverCaCert.cert entity.resource.attribute.labels[server_ca_cert_cert]
resource.data.serverCaCert.certSerialNumber entity.network.tls.server.certificate.serial
resource.data.serverCaCert.commonName entity.network.tls.server.certificate.subject
resource.data.serverCaCert.createTime entity.network.tls.server.certificate.not_before
resource.data.serverCaCert.expirationTime entity.network.tls.server.certificate.not_after
resource.data.serverCaCert.instance entity.resource.attribute.labels[server_ca_cert_instance]
resource.data.serverCaCert.kind entity.resource.attribute.labels[server_ca_cert_kind]
resource.data.serverCaCert.selfLink entity.resource.attribute.labels[server_ca_cert_self_link]
resource.data.serverCaCert.sha1Fingerprint entity.network.tls.server.certificate.sha1
resource.data.serviceAccountEmailAddress entity.user.email_addresses
resource.data.settings.activationPolicy entity.resource.attribute.labels[settings_activation_policy]
resource.data.settings.activeDirectoryConfig.domain entity.resource.attribute.labels[settings_active_directory_config_domain]
resource.data.settings.activeDirectoryConfig.kind entity.resource.attribute.labels[settings_active_directory_config_kind]
resource.data.settings.authorizedGaeApplications entity.resource.attribute.labels[settings_authorized_gae_applications]
resource.data.settings.availabilityType entity.resource.attribute.labels[settings_availability_type]
resource.data.settings.backupConfiguration.backupRetentionSettings.retainedBackups entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retained_backups]
resource.data.settings.backupConfiguration.backupRetentionSettings.retentionUnit entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retention_unit]
resource.data.settings.backupConfiguration.binaryLogEnabled entity.resource.attribute.labels[settings_backup_conf_binary_log_enabled]
resource.data.settings.backupConfiguration.enabled entity.resource.attribute.labels[settings_backup_conf_enabled]
resource.data.settings.backupConfiguration.kind entity.resource.attribute.labels[settings_backup_conf_kind]
resource.data.settings.backupConfiguration.location entity.resource.attribute.labels[settings_backup_conf_location]
resource.data.settings.backupConfiguration.pointInTimeRecoveryEnabled entity.resource.attribute.labels[settings_backup_conf_point_in_time_recovery_enabled]
resource.data.settings.backupConfiguration.replicationLogArchivingEnabled entity.resource.attribute.labels[settings_backup_conf_replication_log_archiving_enabled]
resource.data.settings.backupConfiguration.startTime entity.resource.attribute.labels[settings_backup_conf_start_time]
resource.data.settings.backupConfiguration.transactionLogRetentionDays entity.resource.attribute.labels[settings_backup_conf_transaction_log_retention_days]
resource.data.settings.collation entity.resource.attribute.labels[settings_collation]
resource.data.settings.connectorEnforcement entity.resource.attribute.labels[settings_connector_enforcement]
resource.data.settings.crashSafeReplicationEnabled entity.resource.attribute.labels[settings_crash_safe_replication_enabled]
resource.data.settings.databaseFlags.name entity.resource.attribute.labels[settings_database_flags_name]
resource.data.settings.databaseFlags.value entity.resource.attribute.labels[settings_database_flags_value]
resource.data.settings.databaseReplicationEnabled entity.resource.attribute.labels[settings_database_replication_enabled]
resource.data.settings.dataDiskSizeGb entity.resource.attribute.labels[settings_data_disk_size_gb]
resource.data.settings.dataDiskType entity.resource.attribute.labels[settings_data_disk_type]
resource.data.settings.deletionProtectionEnabled entity.resource.attribute.labels[settings_deletion_protection_enabled]
resource.data.settings.denyMaintenancePeriods.endDate entity.resource.attribute.labels[settings_deny_maintenance_periods_end_date]
resource.data.settings.denyMaintenancePeriods.startDate entity.resource.attribute.labels[settings_deny_maintenance_periods_start_date]
resource.data.settings.denyMaintenancePeriods.time entity.resource.attribute.labels[settings_deny_maintenance_periods_time]
resource.data.settings.insightsConfig.queryInsightsEnabled entity.resource.attribute.labels[settings_insights_config_query_insights_enabled]
resource.data.settings.insightsConfig.queryPlansPerMinute entity.resource.attribute.labels[settings_insights_config_query_plans_per_minute]
resource.data.settings.insightsConfig.queryStringLength entity.resource.attribute.labels[settings_insights_config_query_string_length]
resource.data.settings.insightsConfig.recordApplicationTags entity.resource.attribute.labels[settings_insights_config_record_application_tags]
resource.data.settings.insightsConfig.recordClientAddress entity.resource.attribute.labels[settings_insights_config_record_client_address]
resource.data.settings.ipConfiguration.allocatedIpRange entity.resource.attribute.labels[settings_ip_configuration_allocated_ip_range]
resource.data.settings.ipConfiguration.authorizedNetworks.expirationTime entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_expiration_time]
resource.data.settings.ipConfiguration.authorizedNetworks.kind entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_kind]
resource.data.settings.ipConfiguration.authorizedNetworks.name entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_name]
resource.data.settings.ipConfiguration.authorizedNetworks.value entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_value]
resource.data.settings.ipConfiguration.ipv4Enabled entity.resource.attribute.labels[settings_ip_configuration_ipv4_enabled]
resource.data.settings.ipConfiguration.privateNetwork entity.resource.attribute.labels[settings_ip_configuration_private_network]
resource.data.settings.ipConfiguration.requireSsl entity.resource.attribute.labels[settings_ip_configuration_require_ssl]
resource.data.settings.kind entity.resource.attribute.labels[settings_kind]
resource.data.settings.locationPreference.followGaeApplication entity.resource.attribute.labels[settings_location_preference_follow_gae_application]
resource.data.settings.locationPreference.kind entity.resource.attribute.labels[settings_location_preference_kind]
resource.data.settings.locationPreference.secondaryZone entity.resource.attribute.labels[settings_location_preference_secondary_zone]
resource.data.settings.locationPreference.zone entity.resource.attribute.labels[settings_location_preference_zone]
resource.data.settings.maintenanceWindow.day entity.resource.attribute.labels[settings_maintenance_window_day]
resource.data.settings.maintenanceWindow.hour entity.resource.attribute.labels[settings_maintenance_window_hour]
resource.data.settings.maintenanceWindow.kind entity.resource.attribute.labels[settings_maintenance_window_kind]
resource.data.settings.maintenanceWindow.updateTrack entity.resource.attribute.labels[settings_maintenance_window_update_track]
resource.data.settings.passwordValidationPolicy.complexity entity.resource.attribute.labels[settings_password_validation_policy_complexity]
resource.data.settings.passwordValidationPolicy.disallowUsernameSubstring entity.resource.attribute.labels[settings_password_validation_policy_disallow_username_substring]
resource.data.settings.passwordValidationPolicy.enablePasswordPolicy entity.resource.attribute.labels[settings_password_validation_policy_enable_password_policy]
resource.data.settings.passwordValidationPolicy.minLength entity.resource.attribute.labels[settings_password_validation_policy_min_length]
resource.data.settings.passwordValidationPolicy.passwordChangeInterval entity.resource.attribute.labels[settings_password_validation_policy_password_change_interval]
resource.data.settings.passwordValidationPolicy.reuseInterval entity.resource.attribute.labels[settings_password_validation_policy_reuse_interval]
resource.data.settings.pricingPlan entity.resource.attribute.labels[settings_pricing_plan]
resource.data.settings.replicationType entity.resource.attribute.labels[settings_replication_type]
resource.data.settings.settingsVersion entity.resource.attribute.labels[settings_version]
resource.data.settings.sqlServerAuditConfig.bucket entity.resource.attribute.labels[settings_sql_server_audit_config_bucket]
resource.data.settings.sqlServerAuditConfig.kind entity.resource.attribute.labels[settings_sql_server_audit_config_kind]
resource.data.settings.sqlServerAuditConfig.retentionInterval entity.resource.attribute.labels[settings_sql_server_audit_config_retention_interval]
resource.data.settings.sqlServerAuditConfig.uploadInterval entity.resource.attribute.labels[settings_sql_server_audit_config_upload_interval]
resource.data.settings.storageAutoResize entity.resource.attribute.labels[storage_auto_resize]
resource.data.settings.storageAutoResizeLimit entity.resource.attribute.labels[storage_auto_resize_limit]
resource.data.settings.tier entity.resource.attribute.labels[tier]
resource.data.settings.timeZone entity.resource.attribute.labels[time_zone]
resource.data.settings.userLabels entity.resource.attribute.labels[user_labels]
resource.data.startTime entity.resource.attribute.labels[start_time]
resource.data.state entity.resource.attribute.labels[state]
resource.data.status entity.resource.attribute.labels[status]
resource.data.suspensionReason entity.resource.attribute.labels[suspension_reason]
resource.data.timeZone entity.resource.attribute.labels[time_zone]
resource.data.type entity.resource.attribute.labels[type]
resource.data.windowStartTime entity.resource.attribute.labels[window_start_time]
resource.discoveryDocumentUri entity.resource.attribute.labels[discovery_document]
resource.discoveryName entity.resource.attribute.labels[discovery_name]
resource.parent, ancestors[] relations.entity.resource.name If the resource.parent log field value is empty, then the ancestors.0 log field is mapped to the relations.entity.resource.name UDM field.
resource.version metadata.product_version
entity.resource.resource_type The entity.resource.resource_type UDM field is set to DATABASE.
metadata.entity_type If the assetType log field value matches the regular expression pattern (BackupRun or instances), then the metadata.entity_type UDM field is set to RESOURCE.
metadata.product_name The metadata.product_name UDM field is set to GCP SQL.
metadata.vendor_name The metadata.vendor_name UDM field is set to Google Cloud Platform.
relations.entity_type If the resource.data.onPremisesConfiguration.sourceInstance.name log field value is not empty, then the relations.entity_type UDM field is set to RESOURCE.
relations.relationship If the resource.data.onPremisesConfiguration.sourceInstance.name,resource.data.onPremisesConfiguration.sourceInstance.region, or resource.data.onPremisesConfiguration.sourceInstance.project value is not empty, then the relations.entity.relationship UDM field is set to MEMBER.

If the ancestor log field value matches the regular expression pattern organizations or the ancestor log field value matches the regular expression pattern folders, then the relations.relationship UDM field is set to MEMBER.
relations.entity.resource_ancestors.resource_subtype If the ancestors log field value matches the regular expression pattern organizations, then the relations.entity.resource_ancestors.resource_subtype UDM field is set to organizations.

Else, if the ancestors log field value matches the regular expression pattern folders, then the relations.entity.resource_ancestors.resource_subtype UDM field is set to folders.
relations.entity.resource_ancestors.resource_type The relations.entity.resource_ancestors.resource_type UDM field is set to CLOUD_ORGANIZATION.