이 파서는 CSV 및 JSON 형식의 CircleCI 감사 로그에서 필드를 추출하여 통합 데이터 모델 (UDM)로 변환합니다. 두 형식을 모두 처리하고, 데이터 변환 및 보강을 실행하고, 추출된 필드를 event 객체 내의 해당 UDM 필드에 매핑합니다. 사용자 작업, 리소스 액세스, 업데이트 이벤트에 중점을 두어 이를 분류하고 principal, target, network, metadata와 같은 관련 UDM 필드를 채웁니다.
원시 로그의 account.id 값이 해당 key가 account_id인 UDM 필드 read_only_udm.about.resource.attribute.labels.value에 할당됩니다.
작업
read_only_udm.metadata.product_event_type
원시 로그의 action 값이 UDM 필드 read_only_udm.metadata.product_event_type에 할당됩니다.
actor.id
read_only_udm.principal.user.product_object_id
원시 로그의 actor.id 값이 UDM 필드 read_only_udm.principal.user.product_object_id에 할당됩니다.
actor.name
read_only_udm.principal.user.userid
원시 로그의 actor.name 필드에서 'github: ' 접두사가 삭제됩니다. 나머지 값은 UDM 필드 read_only_udm.principal.user.userid에 할당됩니다. actor.name이 원시 로그에 있으면 USER_RESOURCE_UPDATE_CONTENT 값이 read_only_udm.metadata.event_type에 할당됩니다. 그렇지 않으면 USER_RESOURCE_ACCESS가 할당됩니다.
id
read_only_udm.metadata.product_log_id
원시 로그의 id 값이 UDM 필드 read_only_udm.metadata.product_log_id에 할당됩니다. 파서는 read_only_udm.metadata.log_type을 CIRCLECI로 설정합니다. 파서는 read_only_udm.metadata.product_name을 CIRCLECI로 설정합니다. 파서는 read_only_udm.metadata.vendor_name을 CIRCLECI로 설정합니다.
occurred_at
read_only_udm.metadata.event_timestamp
원시 로그의 occurred_at 값이 타임스탬프로 파싱되어 UDM 필드 read_only_udm.metadata.event_timestamp에 할당됩니다.
organization.name
read_only_udm.target.administrative_domain
원시 로그의 organization.name 필드에서 'github: ' 접두사가 삭제됩니다. 나머지 값은 UDM 필드 read_only_udm.target.administrative_domain에 할당됩니다.
원시 로그의 scope.id 값이 해당 key가 scope_id인 UDM 필드 read_only_udm.about.resource.attribute.labels.value에 할당됩니다. 파서는 처음에 sec_action을 BLOCK으로 설정합니다. 원시 로그의 success 필드가 true이면 sec_action이 ALLOW로 변경됩니다. 그러면 sec_action 값이 UDM 필드 read_only_udm.security_result.action에 할당됩니다.
target.id
read_only_udm.target.resource.product_object_id
원시 로그의 target.id 값이 UDM 필드 read_only_udm.target.resource.product_object_id에 할당됩니다.
target.name
read_only_udm.target.resource.name
원시 로그의 target.name 필드에서 'github: ' 접두사가 삭제됩니다. 나머지 값은 UDM 필드 read_only_udm.target.resource.name에 할당됩니다. 파서는 read_only_udm.target.resource.resource_type을 STORAGE_OBJECT로 설정합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[[["\u003cp\u003eThis document provides instructions for collecting CircleCI audit logs and ingesting them into Google SecOps, where they will be parsed and transformed into the Unified Data Model (UDM).\u003c/p\u003e\n"],["\u003cp\u003eThe parser supports both CSV and JSON formats of CircleCI audit logs, extracting key fields related to user actions, resource access, and updates.\u003c/p\u003e\n"],["\u003cp\u003eTo begin, users must have a Google SecOps instance, privileged access to CircleCI, and will need to configure a new webhook feed in Google SecOps to receive the CircleCI logs.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring a webhook in CircleCI requires setting up an endpoint URL within CircleCI's settings, including the Google SecOps API key and secret for authentication.\u003c/p\u003e\n"],["\u003cp\u003eThe UDM Mapping table specifies how the various fields from CircleCI audit logs are mapped into the corresponding UDM fields in Google SecOps, enabling standardized analysis and reporting.\u003c/p\u003e\n"]]],[],null,["# Collect CircleCI audit logs\n===========================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis parser extracts fields from CircleCI audit logs in CSV and JSON formats, transforming them into the Unified Data Model (UDM). It handles both formats, performs data transformations and enrichments, and maps the extracted fields to their corresponding UDM fields within the **event** object. It focuses on user actions, resource access, and update events, categorizing them and populating relevant UDM fields like **principal** , **target** , **network** , and **metadata**.\n\nBefore you begin\n----------------\n\nEnsure that you have the following prerequisites:\n\n- Google SecOps instance.\n- Privileged access to CircleCI.\n\nSet up feeds\n------------\n\nTo configure a feed, follow these steps:\n\n1. Go to **SIEM Settings** \\\u003e **Feeds**.\n2. Click **Add New Feed**.\n3. On the next page, click **Configure a single feed**.\n4. In the **Feed name** field, enter a name for the feed (for example, **CircleCI Logs**).\n5. Select **Webhook** as the **Source type**.\n6. Select **CircleCI** as the **Log type**.\n7. Click **Next**.\n8. Optional: Specify values for the following input parameters:\n - **Split delimiter** : the delimiter that is used to separate log lines, such as `\\n`.\n - **Asset namespace** : the [asset namespace](/chronicle/docs/investigation/asset-namespaces).\n - **Ingestion labels**: the label applied to the events from this feed.\n9. Click **Next**.\n10. Review the feed configuration in the **Finalize** screen, and then click **Submit**.\n11. Click **Generate Secret Key** to generate a secret key to authenticate this feed.\n12. Copy and store the secret key. You cannot view this secret key again. If needed, you can regenerate a new secret key, but this action makes the previous secret key obsolete.\n13. From the **Details** tab, copy the feed endpoint URL from the **Endpoint Information** field. You need to specify this endpoint URL in your client application.\n14. Click **Done**.\n\nCreate an API key for the webhook feed\n--------------------------------------\n\n1. Go to **Google Cloud console** \\\u003e **Credentials**.\n\n [Go to Credentials](https://console.cloud.google.com/apis/credentials)\n2. Click **Create credentials** , and then select **API key**.\n\n3. Restrict the API key access to the **Google Security Operations API**.\n\nSpecify the endpoint URL\n------------------------\n\n1. In your client application, specify the HTTPS endpoint URL provided in the webhook feed.\n2. Enable authentication by specifying the API key and secret key as part of the custom header in the following format:\n\n X-goog-api-key = \u003cvar class=\"readonly\" translate=\"no\"\u003eAPI_KEY\u003c/var\u003e\n X-Webhook-Access-Key = \u003cvar class=\"readonly\" translate=\"no\"\u003eSECRET\u003c/var\u003e\n\n **Recommendation**: Specify the API key as a header instead of specifying it in the URL.\n3. If your webhook client doesn't support custom headers, you can specify the API key and secret key using query parameters in the following format:\n\n \u003cvar translate=\"no\"\u003eENDPOINT_URL\u003c/var\u003e?key=\u003cvar translate=\"no\"\u003eAPI_KEY\u003c/var\u003e&secret=\u003cvar translate=\"no\"\u003eSECRET\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eENDPOINT_URL\u003c/var\u003e: the feed endpoint URL.\n - \u003cvar translate=\"no\"\u003eAPI_KEY\u003c/var\u003e: the API key to authenticate to Google SecOps.\n - \u003cvar translate=\"no\"\u003eSECRET\u003c/var\u003e: the secret key that you generated to authenticate the feed.\n\nConfiguring a webhook in CircleCI\n---------------------------------\n\n1. Sign in to the CircleCI web interface.\n2. Select the project you want to ingest the logs from.\n3. Click **Project Settings**.\n4. Select **Webhooks**.\n5. Click **Add Webhook**.\n6. Specify values for the following input parameters:\n\n - **Webhook Name** : provide a descriptive name (for example, **Google SecOps**).\n - **Endpoint URL** : enter the `\u003cENDPOINT_URL\u003e` of the Google SecOps API endpoint.\n\n | **Important:** Append the `\u003cAPI_KEY\u003e` and `\u003cSECRET\u003e` to the endpoint URL `\u003cENDPOINT_URL\u003e?key=\u003cAPI_KEY\u003e&secret=\u003cSECRET\u003e`.\n - **Events:** Select the CircleCI events that should trigger the webhook (for example, select **workflow-completed** to send data after a workflow finishes).\n7. Click **Save** to create the webhook.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
