Cloud SQL-Kontextlogs
In diesem Dokument wird beschrieben, wie Felder von Cloud SQL-Kontextlogs den Feldern von Google Security Operations Unified Data Model (UDM) zugeordnet werden.
Ein Aufnahmelabel gibt den Parser an, der Logrohdaten normalisiert
in das strukturierte UDM-Format. Die Informationen in diesem Dokument gelten für den Parser
mit dem Aufnahmelabel GCP_SQL_CONTEXT
.
Informationen zu anderen Kontextparsern, die von Google Security Operations unterstützt werden, finden Sie unter Google Security Operations-Kontextparser.
Feldzuordnungsreferenz
In diesem Abschnitt wird erläutert, wie der Google Security Operations-Parser Felder von Cloud SQL-Kontextlogs den Feldern im Google Security Operations Unified Data Model (UDM) zuordnet.
Log field | UDM mapping | Logic |
---|---|---|
ancestors |
relations.entity.resource_ancestors.name |
If the resource.parent log field value is not matched with the value of ancestors log field, then the ancestors log field is mapped to the relations.entity.resource_ancestors.name UDM field. |
assetType |
entity.resource.resource_subtype |
|
name |
entity.resource.name |
|
resource.data.availableMaintenanceVersions |
entity.resource.attribute.labels[available_maintenance_versions] |
|
resource.data.backendType |
entity.resource.attribute.labels[backend_type] |
|
resource.data.backupKind |
entity.resource.attribute.labels[backup_kind] |
|
resource.data.connectionName |
entity.resource.attribute.labels[connection_name] |
|
resource.data.createTime |
entity.resource.attribute.creation_time |
|
resource.data.currentDiskSize |
entity.resource.attribute.labels[current_disk_size] |
|
resource.data.databaseInstalledVersion |
entity.resource.attribute.labels[database_installed_version] |
|
resource.data.databaseVersion |
entity.resource.attribute.labels[database_version] |
|
resource.data.description |
metadata.description |
|
resource.data.diskEncryptionConfiguration.kind |
entity.resource.attribute.labels[disk_encryption_configuration_kind] |
|
resource.data.diskEncryptionConfiguration.kmsKeyName |
entity.resource.attribute.labels[disk_encryption_configuration_kms_key_name] |
|
resource.data.diskEncryptionStatus.kind |
entity.resource.attribute.labels[disk_encryption_status_kind] |
|
resource.data.diskEncryptionStatus.kmsKeyVersionName |
entity.resource.attribute.labels[disk_encryption_configuration_kms_key_version_name |
|
resource.data.endTime |
entity.resource.attribute.labels[end_time] |
|
resource.data.enqueuedTime |
metadata.creation_timestamp |
|
resource.data.error.code |
entity.resource.attribute.labels[error_code] |
|
resource.data.error.kind |
entity.resource.attribute.labels[error_kind] |
|
resource.data.error.message |
entity.resource.attribute.labels[error_message] |
|
resource.data.etag |
entity.resource.attribute.labels[etag] |
|
resource.data.failoverReplica.available |
entity.resource.attribute.labels[failover_replica_available] |
|
resource.data.failoverReplica.name |
entity.resource.attribute.labels[failover_replica_name] |
|
resource.data.gceZone |
entity.resource.attribute.cloud.availability_zone |
|
resource.data.id |
metadata.product_entity_id |
|
resource.data.instance |
entity.resource.attribute.labels[instance] |
|
resource.data.instanceType |
entity.resource.attribute.labels[instance_type] |
|
resource.data.ipAddresses.ipAddress |
entity.ip |
|
resource.data.ipAddresses.timeToRetire |
entity.labels[ip_addresses_time_to_retire] |
|
resource.data.ipAddresses.type |
entity.labels[ip_addresses_type] |
|
resource.data.ipv6Address |
entity.ip |
|
resource.data.kind |
entity.resource.attribute.labels[kind] |
|
resource.data.location |
entity.location.name |
|
resource.data.maintenanceVersion |
entity.resource.attribute.labels[maintenance_version] |
|
resource.data.masterInstanceName |
entity.resource.attribute.labels[master_instance_name] |
|
resource.data.maxDiskSize |
entity.resource.attribute.labels[max_disk_size] |
|
resource.data.name |
entity.resource.attribute.labels[resource_name] |
|
resource.data.onPremisesConfiguration.caCertificate |
entity.resource.attribute.labels[on_pem_conf_ca_certificate] |
|
resource.data.onPremisesConfiguration.clientCertificate |
entity.resource.attribute.labels[on_pem_conf_client_certificate] |
|
resource.data.onPremisesConfiguration.clientKey |
entity.resource.attribute.labels[on_pem_conf_client_key] |
|
resource.data.onPremisesConfiguration.dumpFilePath |
entity.resource.attribute.labels[on_pem_conf_dump_file_path] |
|
resource.data.onPremisesConfiguration.hostPort |
entity.resource.attribute.labels[on_pem_conf_host_port] |
|
resource.data.onPremisesConfiguration.kind |
entity.resource.attribute.labels[on_pem_conf_kind] |
|
resource.data.onPremisesConfiguration.password |
entity.resource.attribute.labels[on_pem_conf_password] |
|
resource.data.onPremisesConfiguration.sourceInstance.name |
relations.entity.resource.name |
|
resource.data.onPremisesConfiguration.sourceInstance.project |
relations.entity.resource.product_object_id |
|
resource.data.onPremisesConfiguration.sourceInstance.region |
relations.entity.location.country_or_region |
|
resource.data.onPremisesConfiguration.username |
entity.resource.attribute.labels[on_pem_conf_username] |
|
resource.data.outOfDiskReport.sqlMinRecommendedIncreaseSizeGb |
entity.resource.attribute.labels[out_of_disk_report_sql_min_recommended_increase_size_gb] |
|
resource.data.outOfDiskReport.sqlOutOfDiskState |
entity.resource.attribute.labels[out_of_disk_report_sql_out_of_disk_state] |
|
resource.data.project |
entity.resource.product_object_id |
|
resource.data.region |
entity.location.country_or_region |
|
resource.data.replicaConfiguration.failoverTarget |
entity.resource.attribute.labels[replica_conf_fail_over_target] |
|
resource.data.replicaConfiguration.kind |
entity.resource.attribute.labels[replica_conf_kind] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.caCertificate |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ca_certificate] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientCertificate |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_certificate] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientKey |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_key] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.connectRetryInterval |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_connect_retry_interval] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.dumpFilePath |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_dump_file_path] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.kind |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_kind] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.masterHeartbeatPeriod |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_master_heart_beat_period] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.password |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_password] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.sslCipher |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ssl_cipher] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.username |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_username] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.verifyServerCertificate |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_verify_server_certificate] |
|
resource.data.replicaNames |
entity.resource.attribute.labels[replica_names] |
|
resource.data.rootPassword |
entity.resource.attribute.labels[root_password] |
|
resource.data.satisfiesPzs |
entity.resource.attribute.labels[satisfies_pzs] |
|
resource.data.scheduledMaintenance.canDefer |
entity.resource.attribute.labels[schedule_maintenance_can_defer] |
|
resource.data.scheduledMaintenance.canReschedule |
entity.resource.attribute.labels[schedule_maintenance_can_reschedule] |
|
resource.data.scheduledMaintenance.scheduleDeadlineTime |
entity.resource.attribute.labels[schedule_maintenance_deadline_time] |
|
resource.data.scheduledMaintenance.startTime |
entity.resource.attribute.labels[schedule_maintenance_start_time] |
|
resource.data.secondaryGceZone |
entity.resource.attribute.labels[secondary_gce_zone] |
|
resource.data.selfLink |
entity.url |
|
resource.data.serverCaCert.cert |
entity.resource.attribute.labels[server_ca_cert_cert] |
|
resource.data.serverCaCert.certSerialNumber |
entity.network.tls.server.certificate.serial |
|
resource.data.serverCaCert.commonName |
entity.network.tls.server.certificate.subject |
|
resource.data.serverCaCert.createTime |
entity.network.tls.server.certificate.not_before |
|
resource.data.serverCaCert.expirationTime |
entity.network.tls.server.certificate.not_after |
|
resource.data.serverCaCert.instance |
entity.resource.attribute.labels[server_ca_cert_instance] |
|
resource.data.serverCaCert.kind |
entity.resource.attribute.labels[server_ca_cert_kind] |
|
resource.data.serverCaCert.selfLink |
entity.resource.attribute.labels[server_ca_cert_self_link] |
|
resource.data.serverCaCert.sha1Fingerprint |
entity.network.tls.server.certificate.sha1 |
|
resource.data.serviceAccountEmailAddress |
entity.user.email_addresses |
|
resource.data.settings.activationPolicy |
entity.resource.attribute.labels[settings_activation_policy] |
|
resource.data.settings.activeDirectoryConfig.domain |
entity.resource.attribute.labels[settings_active_directory_config_domain] |
|
resource.data.settings.activeDirectoryConfig.kind |
entity.resource.attribute.labels[settings_active_directory_config_kind] |
|
resource.data.settings.authorizedGaeApplications |
entity.resource.attribute.labels[settings_authorized_gae_applications] |
|
resource.data.settings.availabilityType |
entity.resource.attribute.labels[settings_availability_type] |
|
resource.data.settings.backupConfiguration.backupRetentionSettings.retainedBackups |
entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retained_backups] |
|
resource.data.settings.backupConfiguration.backupRetentionSettings.retentionUnit |
entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retention_unit] |
|
resource.data.settings.backupConfiguration.binaryLogEnabled |
entity.resource.attribute.labels[settings_backup_conf_binary_log_enabled] |
|
resource.data.settings.backupConfiguration.enabled |
entity.resource.attribute.labels[settings_backup_conf_enabled] |
|
resource.data.settings.backupConfiguration.kind |
entity.resource.attribute.labels[settings_backup_conf_kind] |
|
resource.data.settings.backupConfiguration.location |
entity.resource.attribute.labels[settings_backup_conf_location] |
|
resource.data.settings.backupConfiguration.pointInTimeRecoveryEnabled |
entity.resource.attribute.labels[settings_backup_conf_point_in_time_recovery_enabled] |
|
resource.data.settings.backupConfiguration.replicationLogArchivingEnabled |
entity.resource.attribute.labels[settings_backup_conf_replication_log_archiving_enabled] |
|
resource.data.settings.backupConfiguration.startTime |
entity.resource.attribute.labels[settings_backup_conf_start_time] |
|
resource.data.settings.backupConfiguration.transactionLogRetentionDays |
entity.resource.attribute.labels[settings_backup_conf_transaction_log_retention_days] |
|
resource.data.settings.collation |
entity.resource.attribute.labels[settings_collation] |
|
resource.data.settings.connectorEnforcement |
entity.resource.attribute.labels[settings_connector_enforcement] |
|
resource.data.settings.crashSafeReplicationEnabled |
entity.resource.attribute.labels[settings_crash_safe_replication_enabled] |
|
resource.data.settings.databaseFlags.name |
entity.resource.attribute.labels[settings_database_flags_name] |
|
resource.data.settings.databaseFlags.value |
entity.resource.attribute.labels[settings_database_flags_value] |
|
resource.data.settings.databaseReplicationEnabled |
entity.resource.attribute.labels[settings_database_replication_enabled] |
|
resource.data.settings.dataDiskSizeGb |
entity.resource.attribute.labels[settings_data_disk_size_gb] |
|
resource.data.settings.dataDiskType |
entity.resource.attribute.labels[settings_data_disk_type] |
|
resource.data.settings.deletionProtectionEnabled |
entity.resource.attribute.labels[settings_deletion_protection_enabled] |
|
resource.data.settings.denyMaintenancePeriods.endDate |
entity.resource.attribute.labels[settings_deny_maintenance_periods_end_date] |
|
resource.data.settings.denyMaintenancePeriods.startDate |
entity.resource.attribute.labels[settings_deny_maintenance_periods_start_date] |
|
resource.data.settings.denyMaintenancePeriods.time |
entity.resource.attribute.labels[settings_deny_maintenance_periods_time] |
|
resource.data.settings.insightsConfig.queryInsightsEnabled |
entity.resource.attribute.labels[settings_insights_config_query_insights_enabled] |
|
resource.data.settings.insightsConfig.queryPlansPerMinute |
entity.resource.attribute.labels[settings_insights_config_query_plans_per_minute] |
|
resource.data.settings.insightsConfig.queryStringLength |
entity.resource.attribute.labels[settings_insights_config_query_string_length] |
|
resource.data.settings.insightsConfig.recordApplicationTags |
entity.resource.attribute.labels[settings_insights_config_record_application_tags] |
|
resource.data.settings.insightsConfig.recordClientAddress |
entity.resource.attribute.labels[settings_insights_config_record_client_address] |
|
resource.data.settings.ipConfiguration.allocatedIpRange |
entity.resource.attribute.labels[settings_ip_configuration_allocated_ip_range] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.expirationTime |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_expiration_time] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.kind |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_kind] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.name |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_name] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.value |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_value] |
|
resource.data.settings.ipConfiguration.ipv4Enabled |
entity.resource.attribute.labels[settings_ip_configuration_ipv4_enabled] |
|
resource.data.settings.ipConfiguration.privateNetwork |
entity.resource.attribute.labels[settings_ip_configuration_private_network] |
|
resource.data.settings.ipConfiguration.requireSsl |
entity.resource.attribute.labels[settings_ip_configuration_require_ssl] |
|
resource.data.settings.kind |
entity.resource.attribute.labels[settings_kind] |
|
resource.data.settings.locationPreference.followGaeApplication |
entity.resource.attribute.labels[settings_location_preference_follow_gae_application] |
|
resource.data.settings.locationPreference.kind |
entity.resource.attribute.labels[settings_location_preference_kind] |
|
resource.data.settings.locationPreference.secondaryZone |
entity.resource.attribute.labels[settings_location_preference_secondary_zone] |
|
resource.data.settings.locationPreference.zone |
entity.resource.attribute.labels[settings_location_preference_zone] |
|
resource.data.settings.maintenanceWindow.day |
entity.resource.attribute.labels[settings_maintenance_window_day] |
|
resource.data.settings.maintenanceWindow.hour |
entity.resource.attribute.labels[settings_maintenance_window_hour] |
|
resource.data.settings.maintenanceWindow.kind |
entity.resource.attribute.labels[settings_maintenance_window_kind] |
|
resource.data.settings.maintenanceWindow.updateTrack |
entity.resource.attribute.labels[settings_maintenance_window_update_track] |
|
resource.data.settings.passwordValidationPolicy.complexity |
entity.resource.attribute.labels[settings_password_validation_policy_complexity] |
|
resource.data.settings.passwordValidationPolicy.disallowUsernameSubstring |
entity.resource.attribute.labels[settings_password_validation_policy_disallow_username_substring] |
|
resource.data.settings.passwordValidationPolicy.enablePasswordPolicy |
entity.resource.attribute.labels[settings_password_validation_policy_enable_password_policy] |
|
resource.data.settings.passwordValidationPolicy.minLength |
entity.resource.attribute.labels[settings_password_validation_policy_min_length] |
|
resource.data.settings.passwordValidationPolicy.passwordChangeInterval |
entity.resource.attribute.labels[settings_password_validation_policy_password_change_interval] |
|
resource.data.settings.passwordValidationPolicy.reuseInterval |
entity.resource.attribute.labels[settings_password_validation_policy_reuse_interval] |
|
resource.data.settings.pricingPlan |
entity.resource.attribute.labels[settings_pricing_plan] |
|
resource.data.settings.replicationType |
entity.resource.attribute.labels[settings_replication_type] |
|
resource.data.settings.settingsVersion |
entity.resource.attribute.labels[settings_version] |
|
resource.data.settings.sqlServerAuditConfig.bucket |
entity.resource.attribute.labels[settings_sql_server_audit_config_bucket] |
|
resource.data.settings.sqlServerAuditConfig.kind |
entity.resource.attribute.labels[settings_sql_server_audit_config_kind] |
|
resource.data.settings.sqlServerAuditConfig.retentionInterval |
entity.resource.attribute.labels[settings_sql_server_audit_config_retention_interval] |
|
resource.data.settings.sqlServerAuditConfig.uploadInterval |
entity.resource.attribute.labels[settings_sql_server_audit_config_upload_interval] |
|
resource.data.settings.storageAutoResize |
entity.resource.attribute.labels[storage_auto_resize] |
|
resource.data.settings.storageAutoResizeLimit |
entity.resource.attribute.labels[storage_auto_resize_limit] |
|
resource.data.settings.tier |
entity.resource.attribute.labels[tier] |
|
resource.data.settings.timeZone |
entity.resource.attribute.labels[time_zone] |
|
resource.data.settings.userLabels |
entity.resource.attribute.labels[user_labels] |
|
resource.data.startTime |
entity.resource.attribute.labels[start_time] |
|
resource.data.state |
entity.resource.attribute.labels[state] |
|
resource.data.status |
entity.resource.attribute.labels[status] |
|
resource.data.suspensionReason |
entity.resource.attribute.labels[suspension_reason] |
|
resource.data.timeZone |
entity.resource.attribute.labels[time_zone] |
|
resource.data.type |
entity.resource.attribute.labels[type] |
|
resource.data.windowStartTime |
entity.resource.attribute.labels[window_start_time] |
|
resource.discoveryDocumentUri |
entity.resource.attribute.labels[discovery_document] |
|
resource.discoveryName |
entity.resource.attribute.labels[discovery_name] |
|
resource.parent, ancestors[] |
relations.entity.resource.name |
If the resource.parent log field value is empty, then the ancestors.0 log field is mapped to the relations.entity.resource.name UDM field. |
resource.version |
metadata.product_version |
|
|
entity.resource.resource_type |
The entity.resource.resource_type UDM field is set to DATABASE . |
|
metadata.entity_type |
If the assetType log field value matches the regular expression pattern (BackupRun or instances) , then the metadata.entity_type UDM field is set to RESOURCE . |
|
metadata.product_name |
The metadata.product_name UDM field is set to GCP SQL . |
|
metadata.vendor_name |
The metadata.vendor_name UDM field is set to Google Cloud Platform . |
|
relations.entity_type |
If the resource.data.onPremisesConfiguration.sourceInstance.name log field value is not empty, then the relations.entity_type UDM field is set to RESOURCE . |
|
relations.relationship |
If the resource.data.onPremisesConfiguration.sourceInstance.name ,resource.data.onPremisesConfiguration.sourceInstance.region , or resource.data.onPremisesConfiguration.sourceInstance.project value is not empty, then the relations.entity.relationship UDM field is set to MEMBER .If the ancestor log field value matches the regular expression pattern organizations or the ancestor log field value matches the regular expression pattern folders , then the relations.relationship UDM field is set to MEMBER . |
|
relations.entity.resource_ancestors.resource_subtype |
If the ancestors log field value matches the regular expression pattern organizations , then the relations.entity.resource_ancestors.resource_subtype UDM field is set to organizations .Else, if the ancestors log field value matches the regular expression pattern folders , then the relations.entity.resource_ancestors.resource_subtype UDM field is set to folders . |
|
relations.entity.resource_ancestors.resource_type |
The relations.entity.resource_ancestors.resource_type UDM field is set to CLOUD_ORGANIZATION . |