Log di contesto di Cloud SQL
Questo documento descrive come i campi dei log di contesto di Cloud SQL vengono mappati ai campi del modello Unified Data Model (UDM) di Google Security Operations.
Un'etichetta di importazione identifica l'analizzatore sintattico che normalizza i dati dei log non elaborati
in formato UDM strutturato. Le informazioni contenute in questo documento si applicano al parser con l'etichetta di importazione GCP_SQL_CONTEXT
.
Per informazioni sugli altri parser di contesto supportati da Google Security Operations, vedi Analizzatori di contesto di Google Security Operations.
Riferimento alla mappatura dei campi
Questa sezione spiega in che modo il parser di Google Security Operations mappa i campi dei log di contesto Cloud SQL ai campi del modello di dati unificato (UDM) di Google Security Operations.
Log field | UDM mapping | Logic |
---|---|---|
ancestors |
relations.entity.resource_ancestors.name |
If the resource.parent log field value is not matched with the value of ancestors log field, then the ancestors log field is mapped to the relations.entity.resource_ancestors.name UDM field. |
assetType |
entity.resource.resource_subtype |
|
name |
entity.resource.name |
|
resource.data.availableMaintenanceVersions |
entity.resource.attribute.labels[available_maintenance_versions] |
|
resource.data.backendType |
entity.resource.attribute.labels[backend_type] |
|
resource.data.backupKind |
entity.resource.attribute.labels[backup_kind] |
|
resource.data.connectionName |
entity.resource.attribute.labels[connection_name] |
|
resource.data.createTime |
entity.resource.attribute.creation_time |
|
resource.data.currentDiskSize |
entity.resource.attribute.labels[current_disk_size] |
|
resource.data.databaseInstalledVersion |
entity.resource.attribute.labels[database_installed_version] |
|
resource.data.databaseVersion |
entity.resource.attribute.labels[database_version] |
|
resource.data.description |
metadata.description |
|
resource.data.diskEncryptionConfiguration.kind |
entity.resource.attribute.labels[disk_encryption_configuration_kind] |
|
resource.data.diskEncryptionConfiguration.kmsKeyName |
entity.resource.attribute.labels[disk_encryption_configuration_kms_key_name] |
|
resource.data.diskEncryptionStatus.kind |
entity.resource.attribute.labels[disk_encryption_status_kind] |
|
resource.data.diskEncryptionStatus.kmsKeyVersionName |
entity.resource.attribute.labels[disk_encryption_configuration_kms_key_version_name |
|
resource.data.endTime |
entity.resource.attribute.labels[end_time] |
|
resource.data.enqueuedTime |
metadata.creation_timestamp |
|
resource.data.error.code |
entity.resource.attribute.labels[error_code] |
|
resource.data.error.kind |
entity.resource.attribute.labels[error_kind] |
|
resource.data.error.message |
entity.resource.attribute.labels[error_message] |
|
resource.data.etag |
entity.resource.attribute.labels[etag] |
|
resource.data.failoverReplica.available |
entity.resource.attribute.labels[failover_replica_available] |
|
resource.data.failoverReplica.name |
entity.resource.attribute.labels[failover_replica_name] |
|
resource.data.gceZone |
entity.resource.attribute.cloud.availability_zone |
|
resource.data.id |
metadata.product_entity_id |
|
resource.data.instance |
entity.resource.attribute.labels[instance] |
|
resource.data.instanceType |
entity.resource.attribute.labels[instance_type] |
|
resource.data.ipAddresses.ipAddress |
entity.ip |
|
resource.data.ipAddresses.timeToRetire |
entity.labels[ip_addresses_time_to_retire] |
|
resource.data.ipAddresses.type |
entity.labels[ip_addresses_type] |
|
resource.data.ipv6Address |
entity.ip |
|
resource.data.kind |
entity.resource.attribute.labels[kind] |
|
resource.data.location |
entity.location.name |
|
resource.data.maintenanceVersion |
entity.resource.attribute.labels[maintenance_version] |
|
resource.data.masterInstanceName |
entity.resource.attribute.labels[master_instance_name] |
|
resource.data.maxDiskSize |
entity.resource.attribute.labels[max_disk_size] |
|
resource.data.name |
entity.resource.attribute.labels[resource_name] |
|
resource.data.onPremisesConfiguration.caCertificate |
entity.resource.attribute.labels[on_pem_conf_ca_certificate] |
|
resource.data.onPremisesConfiguration.clientCertificate |
entity.resource.attribute.labels[on_pem_conf_client_certificate] |
|
resource.data.onPremisesConfiguration.clientKey |
entity.resource.attribute.labels[on_pem_conf_client_key] |
|
resource.data.onPremisesConfiguration.dumpFilePath |
entity.resource.attribute.labels[on_pem_conf_dump_file_path] |
|
resource.data.onPremisesConfiguration.hostPort |
entity.resource.attribute.labels[on_pem_conf_host_port] |
|
resource.data.onPremisesConfiguration.kind |
entity.resource.attribute.labels[on_pem_conf_kind] |
|
resource.data.onPremisesConfiguration.password |
entity.resource.attribute.labels[on_pem_conf_password] |
|
resource.data.onPremisesConfiguration.sourceInstance.name |
relations.entity.resource.name |
|
resource.data.onPremisesConfiguration.sourceInstance.project |
relations.entity.resource.product_object_id |
|
resource.data.onPremisesConfiguration.sourceInstance.region |
relations.entity.location.country_or_region |
|
resource.data.onPremisesConfiguration.username |
entity.resource.attribute.labels[on_pem_conf_username] |
|
resource.data.outOfDiskReport.sqlMinRecommendedIncreaseSizeGb |
entity.resource.attribute.labels[out_of_disk_report_sql_min_recommended_increase_size_gb] |
|
resource.data.outOfDiskReport.sqlOutOfDiskState |
entity.resource.attribute.labels[out_of_disk_report_sql_out_of_disk_state] |
|
resource.data.project |
entity.resource.product_object_id |
|
resource.data.region |
entity.location.country_or_region |
|
resource.data.replicaConfiguration.failoverTarget |
entity.resource.attribute.labels[replica_conf_fail_over_target] |
|
resource.data.replicaConfiguration.kind |
entity.resource.attribute.labels[replica_conf_kind] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.caCertificate |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ca_certificate] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientCertificate |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_certificate] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.clientKey |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_client_key] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.connectRetryInterval |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_connect_retry_interval] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.dumpFilePath |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_dump_file_path] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.kind |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_kind] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.masterHeartbeatPeriod |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_master_heart_beat_period] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.password |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_password] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.sslCipher |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_ssl_cipher] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.username |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_username] |
|
resource.data.replicaConfiguration.mysqlReplicaConfiguration.verifyServerCertificate |
entity.resource.attribute.labels[replica_conf_my_sql_replica_conf_verify_server_certificate] |
|
resource.data.replicaNames |
entity.resource.attribute.labels[replica_names] |
|
resource.data.rootPassword |
entity.resource.attribute.labels[root_password] |
|
resource.data.satisfiesPzs |
entity.resource.attribute.labels[satisfies_pzs] |
|
resource.data.scheduledMaintenance.canDefer |
entity.resource.attribute.labels[schedule_maintenance_can_defer] |
|
resource.data.scheduledMaintenance.canReschedule |
entity.resource.attribute.labels[schedule_maintenance_can_reschedule] |
|
resource.data.scheduledMaintenance.scheduleDeadlineTime |
entity.resource.attribute.labels[schedule_maintenance_deadline_time] |
|
resource.data.scheduledMaintenance.startTime |
entity.resource.attribute.labels[schedule_maintenance_start_time] |
|
resource.data.secondaryGceZone |
entity.resource.attribute.labels[secondary_gce_zone] |
|
resource.data.selfLink |
entity.url |
|
resource.data.serverCaCert.cert |
entity.resource.attribute.labels[server_ca_cert_cert] |
|
resource.data.serverCaCert.certSerialNumber |
entity.network.tls.server.certificate.serial |
|
resource.data.serverCaCert.commonName |
entity.network.tls.server.certificate.subject |
|
resource.data.serverCaCert.createTime |
entity.network.tls.server.certificate.not_before |
|
resource.data.serverCaCert.expirationTime |
entity.network.tls.server.certificate.not_after |
|
resource.data.serverCaCert.instance |
entity.resource.attribute.labels[server_ca_cert_instance] |
|
resource.data.serverCaCert.kind |
entity.resource.attribute.labels[server_ca_cert_kind] |
|
resource.data.serverCaCert.selfLink |
entity.resource.attribute.labels[server_ca_cert_self_link] |
|
resource.data.serverCaCert.sha1Fingerprint |
entity.network.tls.server.certificate.sha1 |
|
resource.data.serviceAccountEmailAddress |
entity.user.email_addresses |
|
resource.data.settings.activationPolicy |
entity.resource.attribute.labels[settings_activation_policy] |
|
resource.data.settings.activeDirectoryConfig.domain |
entity.resource.attribute.labels[settings_active_directory_config_domain] |
|
resource.data.settings.activeDirectoryConfig.kind |
entity.resource.attribute.labels[settings_active_directory_config_kind] |
|
resource.data.settings.authorizedGaeApplications |
entity.resource.attribute.labels[settings_authorized_gae_applications] |
|
resource.data.settings.availabilityType |
entity.resource.attribute.labels[settings_availability_type] |
|
resource.data.settings.backupConfiguration.backupRetentionSettings.retainedBackups |
entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retained_backups] |
|
resource.data.settings.backupConfiguration.backupRetentionSettings.retentionUnit |
entity.resource.attribute.labels[settings_backup_conf_backup_retention_settings_retention_unit] |
|
resource.data.settings.backupConfiguration.binaryLogEnabled |
entity.resource.attribute.labels[settings_backup_conf_binary_log_enabled] |
|
resource.data.settings.backupConfiguration.enabled |
entity.resource.attribute.labels[settings_backup_conf_enabled] |
|
resource.data.settings.backupConfiguration.kind |
entity.resource.attribute.labels[settings_backup_conf_kind] |
|
resource.data.settings.backupConfiguration.location |
entity.resource.attribute.labels[settings_backup_conf_location] |
|
resource.data.settings.backupConfiguration.pointInTimeRecoveryEnabled |
entity.resource.attribute.labels[settings_backup_conf_point_in_time_recovery_enabled] |
|
resource.data.settings.backupConfiguration.replicationLogArchivingEnabled |
entity.resource.attribute.labels[settings_backup_conf_replication_log_archiving_enabled] |
|
resource.data.settings.backupConfiguration.startTime |
entity.resource.attribute.labels[settings_backup_conf_start_time] |
|
resource.data.settings.backupConfiguration.transactionLogRetentionDays |
entity.resource.attribute.labels[settings_backup_conf_transaction_log_retention_days] |
|
resource.data.settings.collation |
entity.resource.attribute.labels[settings_collation] |
|
resource.data.settings.connectorEnforcement |
entity.resource.attribute.labels[settings_connector_enforcement] |
|
resource.data.settings.crashSafeReplicationEnabled |
entity.resource.attribute.labels[settings_crash_safe_replication_enabled] |
|
resource.data.settings.databaseFlags.name |
entity.resource.attribute.labels[settings_database_flags_name] |
|
resource.data.settings.databaseFlags.value |
entity.resource.attribute.labels[settings_database_flags_value] |
|
resource.data.settings.databaseReplicationEnabled |
entity.resource.attribute.labels[settings_database_replication_enabled] |
|
resource.data.settings.dataDiskSizeGb |
entity.resource.attribute.labels[settings_data_disk_size_gb] |
|
resource.data.settings.dataDiskType |
entity.resource.attribute.labels[settings_data_disk_type] |
|
resource.data.settings.deletionProtectionEnabled |
entity.resource.attribute.labels[settings_deletion_protection_enabled] |
|
resource.data.settings.denyMaintenancePeriods.endDate |
entity.resource.attribute.labels[settings_deny_maintenance_periods_end_date] |
|
resource.data.settings.denyMaintenancePeriods.startDate |
entity.resource.attribute.labels[settings_deny_maintenance_periods_start_date] |
|
resource.data.settings.denyMaintenancePeriods.time |
entity.resource.attribute.labels[settings_deny_maintenance_periods_time] |
|
resource.data.settings.insightsConfig.queryInsightsEnabled |
entity.resource.attribute.labels[settings_insights_config_query_insights_enabled] |
|
resource.data.settings.insightsConfig.queryPlansPerMinute |
entity.resource.attribute.labels[settings_insights_config_query_plans_per_minute] |
|
resource.data.settings.insightsConfig.queryStringLength |
entity.resource.attribute.labels[settings_insights_config_query_string_length] |
|
resource.data.settings.insightsConfig.recordApplicationTags |
entity.resource.attribute.labels[settings_insights_config_record_application_tags] |
|
resource.data.settings.insightsConfig.recordClientAddress |
entity.resource.attribute.labels[settings_insights_config_record_client_address] |
|
resource.data.settings.ipConfiguration.allocatedIpRange |
entity.resource.attribute.labels[settings_ip_configuration_allocated_ip_range] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.expirationTime |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_expiration_time] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.kind |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_kind] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.name |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_name] |
|
resource.data.settings.ipConfiguration.authorizedNetworks.value |
entity.resource.attribute.labels[settings_ip_configuration_authorized_networks_value] |
|
resource.data.settings.ipConfiguration.ipv4Enabled |
entity.resource.attribute.labels[settings_ip_configuration_ipv4_enabled] |
|
resource.data.settings.ipConfiguration.privateNetwork |
entity.resource.attribute.labels[settings_ip_configuration_private_network] |
|
resource.data.settings.ipConfiguration.requireSsl |
entity.resource.attribute.labels[settings_ip_configuration_require_ssl] |
|
resource.data.settings.kind |
entity.resource.attribute.labels[settings_kind] |
|
resource.data.settings.locationPreference.followGaeApplication |
entity.resource.attribute.labels[settings_location_preference_follow_gae_application] |
|
resource.data.settings.locationPreference.kind |
entity.resource.attribute.labels[settings_location_preference_kind] |
|
resource.data.settings.locationPreference.secondaryZone |
entity.resource.attribute.labels[settings_location_preference_secondary_zone] |
|
resource.data.settings.locationPreference.zone |
entity.resource.attribute.labels[settings_location_preference_zone] |
|
resource.data.settings.maintenanceWindow.day |
entity.resource.attribute.labels[settings_maintenance_window_day] |
|
resource.data.settings.maintenanceWindow.hour |
entity.resource.attribute.labels[settings_maintenance_window_hour] |
|
resource.data.settings.maintenanceWindow.kind |
entity.resource.attribute.labels[settings_maintenance_window_kind] |
|
resource.data.settings.maintenanceWindow.updateTrack |
entity.resource.attribute.labels[settings_maintenance_window_update_track] |
|
resource.data.settings.passwordValidationPolicy.complexity |
entity.resource.attribute.labels[settings_password_validation_policy_complexity] |
|
resource.data.settings.passwordValidationPolicy.disallowUsernameSubstring |
entity.resource.attribute.labels[settings_password_validation_policy_disallow_username_substring] |
|
resource.data.settings.passwordValidationPolicy.enablePasswordPolicy |
entity.resource.attribute.labels[settings_password_validation_policy_enable_password_policy] |
|
resource.data.settings.passwordValidationPolicy.minLength |
entity.resource.attribute.labels[settings_password_validation_policy_min_length] |
|
resource.data.settings.passwordValidationPolicy.passwordChangeInterval |
entity.resource.attribute.labels[settings_password_validation_policy_password_change_interval] |
|
resource.data.settings.passwordValidationPolicy.reuseInterval |
entity.resource.attribute.labels[settings_password_validation_policy_reuse_interval] |
|
resource.data.settings.pricingPlan |
entity.resource.attribute.labels[settings_pricing_plan] |
|
resource.data.settings.replicationType |
entity.resource.attribute.labels[settings_replication_type] |
|
resource.data.settings.settingsVersion |
entity.resource.attribute.labels[settings_version] |
|
resource.data.settings.sqlServerAuditConfig.bucket |
entity.resource.attribute.labels[settings_sql_server_audit_config_bucket] |
|
resource.data.settings.sqlServerAuditConfig.kind |
entity.resource.attribute.labels[settings_sql_server_audit_config_kind] |
|
resource.data.settings.sqlServerAuditConfig.retentionInterval |
entity.resource.attribute.labels[settings_sql_server_audit_config_retention_interval] |
|
resource.data.settings.sqlServerAuditConfig.uploadInterval |
entity.resource.attribute.labels[settings_sql_server_audit_config_upload_interval] |
|
resource.data.settings.storageAutoResize |
entity.resource.attribute.labels[storage_auto_resize] |
|
resource.data.settings.storageAutoResizeLimit |
entity.resource.attribute.labels[storage_auto_resize_limit] |
|
resource.data.settings.tier |
entity.resource.attribute.labels[tier] |
|
resource.data.settings.timeZone |
entity.resource.attribute.labels[time_zone] |
|
resource.data.settings.userLabels |
entity.resource.attribute.labels[user_labels] |
|
resource.data.startTime |
entity.resource.attribute.labels[start_time] |
|
resource.data.state |
entity.resource.attribute.labels[state] |
|
resource.data.status |
entity.resource.attribute.labels[status] |
|
resource.data.suspensionReason |
entity.resource.attribute.labels[suspension_reason] |
|
resource.data.timeZone |
entity.resource.attribute.labels[time_zone] |
|
resource.data.type |
entity.resource.attribute.labels[type] |
|
resource.data.windowStartTime |
entity.resource.attribute.labels[window_start_time] |
|
resource.discoveryDocumentUri |
entity.resource.attribute.labels[discovery_document] |
|
resource.discoveryName |
entity.resource.attribute.labels[discovery_name] |
|
resource.parent, ancestors[] |
relations.entity.resource.name |
If the resource.parent log field value is empty, then the ancestors.0 log field is mapped to the relations.entity.resource.name UDM field. |
resource.version |
metadata.product_version |
|
|
entity.resource.resource_type |
The entity.resource.resource_type UDM field is set to DATABASE . |
|
metadata.entity_type |
If the assetType log field value matches the regular expression pattern (BackupRun or instances) , then the metadata.entity_type UDM field is set to RESOURCE . |
|
metadata.product_name |
The metadata.product_name UDM field is set to GCP SQL . |
|
metadata.vendor_name |
The metadata.vendor_name UDM field is set to Google Cloud Platform . |
|
relations.entity_type |
If the resource.data.onPremisesConfiguration.sourceInstance.name log field value is not empty, then the relations.entity_type UDM field is set to RESOURCE . |
|
relations.relationship |
If the resource.data.onPremisesConfiguration.sourceInstance.name ,resource.data.onPremisesConfiguration.sourceInstance.region , or resource.data.onPremisesConfiguration.sourceInstance.project value is not empty, then the relations.entity.relationship UDM field is set to MEMBER .If the ancestor log field value matches the regular expression pattern organizations or the ancestor log field value matches the regular expression pattern folders , then the relations.relationship UDM field is set to MEMBER . |
|
relations.entity.resource_ancestors.resource_subtype |
If the ancestors log field value matches the regular expression pattern organizations , then the relations.entity.resource_ancestors.resource_subtype UDM field is set to organizations .Else, if the ancestors log field value matches the regular expression pattern folders , then the relations.entity.resource_ancestors.resource_subtype UDM field is set to folders . |
|
relations.entity.resource_ancestors.resource_type |
The relations.entity.resource_ancestors.resource_type UDM field is set to CLOUD_ORGANIZATION . |