Chrome 로그 수집

이 문서에서는 Chronicle 피드를 설정하여 Chrome 로그를 수집하는 방법과 로그 필드가 Chrome 통합 데이터 모델(UDM) 필드에 매핑되는 방식을 설명합니다.

자세한 내용은 Chronicle 데이터 수집을 참조하세요.

개요

일반적인 배포는 Chronicle로 로그를 전송하도록 구성된 ChromeOS 및 Chrome 브라우저로 구성됩니다. 고객 배포마다 다를 수 있으며 더 복잡할 수도 있습니다. 배포는 다음과 같은 구성요소로 구성됩니다.

  • Chrome: 수집하려는 ChromeOS 기기 로그입니다.

  • Google Workspace: 로그를 수집하는 Google Workspace 플랫폼입니다.

  • Chronicle 피드: Google Workspace에서 로그를 가져와 Chronicle에 로그를 쓰는 Chronicle 피드입니다.

  • Chronicle: Chrome 로그를 보관하고 분석합니다.

수집 라벨은 원시 로그 데이터를 구조화된 UDM 형식으로 정규화하는 파서를 식별합니다. 이 문서의 정보는 CHROME_MANAGEMENT 수집 라벨이 있는 파서에 적용됩니다.

시작하기 전에

  • Google Workspace Business Standard 버전을 사용해야 합니다.

  • Google Workspace 관리자 계정이 있는지 확인합니다.

  • 배포 아키텍처의 모든 시스템이 UTC 시간대로 구성되었는지 확인합니다.

  • 서비스 계정을 가장하는 사용자를 만드는 경우 관리 콘솔을 사용하여 사용자에게 다음 권한을 부여합니다.

    • 권한 > 보고서
    • 권한 > 서비스 > 알림 센터 > 전체 액세스 > 보기 액세스
    • 권한 > 서비스 > 휴대기기 관리 > 기기 및 설정 관리
    • 권한 > 서비스 > Chrome 관리 > 설정
    • Admin API > 권한 > 사용자 > 읽기
    • Admin API > 권한 > 그룹 > 읽기

Chrome 브라우저 클라우드 관리 설정

다음은 Chrome 브라우저 클라우드 관리를 설정하는 대략적인 단계입니다.

Chrome 브라우저 클라우드 관리를 설정하려면 다음 단계를 따르세요.

  1. 관리 콘솔에서 메뉴 > 기기 > Chrome > 관리 브라우저를 클릭합니다.

  2. 선택사항: 최상위 조직을 선택하거나 특정 조직 단위에 직접 브라우저를 등록하는 토큰을 생성하려는 조직 단위를 선택합니다. 자세한 내용은 조직 단위 추가를 참고하세요.

  3. 등록을 클릭합니다. 첫 브라우저 등록인 경우 Chrome 브라우저 클라우드 관리(CBCM) 서비스 약관에 동의하라는 메시지가 표시됩니다.

  4. 등록 토큰을 클립보드에 복사를 클릭합니다.

  5. 클라우드 관리 Chrome 브라우저를 등록하려면 완료를 클릭합니다.

  6. 관리 콘솔에서 메뉴 > 기기 > Chrome > 설정 > 사용자 및 브라우저로 이동합니다. 모든 하위 조직에 정책이 상속되도록 최상위 조직 단위를 선택합니다. 브라우저 보고까지 아래로 스크롤합니다.

  7. 관리 브라우저 보고를 관리 브라우저 클라우드 보고 사용으로 설정합니다.

  8. Chrome 브라우저 보고를 사용 설정하려면 저장을 클릭합니다.

  9. 관리 콘솔에서 메뉴 > 기기 > Chrome > 커넥터로 이동합니다.

  10. 선택사항: Chrome Enterprise 커넥터 설정을 처음 구성하는 경우 표시되는 안내에 따라 Chrome Enterprise 커넥터를 사용 설정합니다.

  11. 상단에서 + 새 제공업체 구성 추가를 클릭합니다.

  12. 오른쪽에 표시되는 패널에서 Chronicle 설정을 찾고 설정을 클릭합니다.

  13. 구성 ID와 API 키를 입력합니다.

    • 구성 ID: 사용자 및 브라우저 설정 페이지와 커넥터 페이지에 표시되는 ID입니다.

    • API 키: 고객을 식별하기 위해 Chronicle 삽입 API를 호출할 때 지정하는 API 키입니다.

  14. 새 공급업체 구성을 추가하려면 구성 추가를 클릭합니다.

ChromeOS 로그를 Chronicle로 수집하도록 Chronicle에서 피드 구성

  1. Chronicle 메뉴에서 설정을 선택한 다음 피드를 클릭합니다.
  2. 'Add New(새 항목 추가)'를 클릭합니다.
  3. 소스 유형으로 타사 API를 선택합니다.
  4. Workspace 활동에 대한 피드를 만들려면 로그 유형으로 Workspace 활동을 선택합니다.
  5. 다음을 클릭합니다.

  6. 자신이 만든 Google Workspace 구성에 따라 다음 필드의 값을 지정합니다.

    • OAuth JWT 엔드포인트. OAuth JSON 웹 토큰이 포함된 엔드포인트입니다. 서비스 계정 JSON 키에서 token_uri 값을 지정합니다.
    • JWT 클레임 발급자. 클라이언트 ID입니다. 서비스 계정 JSON 키에서 client_email 값을 지정합니다. 예를 들면 InsertServiceAccount@project.iam.gserviceaccount.com입니다.
    • JWT 클레임 제목. 서비스 계정 JSON 키에서 token_uri 값을 지정합니다.
    • RSA 비공개 키. PEM 형식의 RSA 비공개 키입니다. PEM 키는 서비스 계정 키 파일에서 사용할 수 있습니다. 비공개 키를 지정할 때 BEGIN PRIVATE KEY 헤더와 END PRIVATE KEY 바닥글을 포함하고 (\n) 토큰의 발생을 삭제합니다.
    • 고객 ID. 고객 ID 필드에 선행 'C' 문자가 포함되지 않은 경우 값 앞에 'C' 문자를 추가합니다.
    • 애플리케이션. ChromeOS 로그의 경우 애플리케이션 필드를 chrome으로 채웁니다.

  7. 다음을 클릭한 다음 제출을 클릭합니다.

피드를 만들 때 문제가 발생하면 Chronicle 지원팀에 문의하세요.

지원되는 로그 유형 및 데이터 모델

다음은 Chrome 관리에 지원되는 로그 유형 및 이벤트입니다. 지원되는 모든 로그 유형 및 이벤트는 JSON 형식입니다.

로그 유형 이벤트 유형
악의적인 활동

badNavigationEvent

dangerousDownloadEvent

Malware transfer

Extension install

Password changed

Password reuse

Unsafe site visit

Login events

Password breach

urlFilteringInterstitialEvent

browserCrashEvent
감사 활동

CHROME_OS_ADD_USER

CHROME_OS_REMOVE_USER

DEVICE_BOOT_STATE_CHANGE

CHROME_OS_LOGIN_FAILURE_EVENT

CHROME_OS_LOGIN_LOGOUT_EVENT

CHROME_OS_LOGIN_EVENT

CHROME_OS_LOGOUT_EVENT

CHROME_OS_REPORTING_DATA_LOST

PASSWORD_CHANGED

PASSWORD_REUSE

DLP_EVENT

CONTENT_TRANSFER

CONTENT_UNSCANNED

EXTENSION_REQUEST

LOGIN_EVENT

MALWARE_TRANSFER

PASSWORD_BREACH

SENSITIVE_DATA_TRANSFER

UNSAFE_SITE_VISIT
데이터 보호

Content transfer

Content unscanned

Sensitive data transfer
Chrome OS

ChromeOS login failure

ChromeOS login success

ChromeOS logout

ChromeOS user added

ChromeOS user removed

ChromeOS lock success

ChromeOS unlock success

ChromeOS unlock failure

ChromeOS device boot state change

ChromeOS USB device added

ChromeOS USB device removed

ChromeOS USB status change

ChromeOS CRD host started

ChromeOS CRD client connected

ChromeOS CRD client disconnected

ChromeOS CRD host stopped

필드 매핑 참조

이 섹션에서는 Chronicle 파서가 Chrome 로그 필드를 데이터 세트의 Chronicle 통합 데이터 모델(UDM) 필드에 매핑하는 방법을 설명합니다.

필드 매핑 참조: 이벤트 식별자에서 이벤트 유형으로

다음 표에는 CHROME_MANAGEMENT 로그 유형과 해당 UDM 이벤트 유형이 나와 있습니다.

Event Identifier Event Type Security Category
badNavigationEvent - SOCIAL_ENGINEERING USER_RESOURCE_ACCESS SOCIAL_ENGINEERING
badNavigationEvent - SSL_ERROR USER_RESOURCE_ACCESS NETWORK_SUSPICIOUS
badNavigationEvent - MALWARE USER_RESOURCE_ACCESS SOFTWARE_MALICIOUS
badNavigationEvent - UNWANTED_SOFTWARE USER_RESOURCE_ACCESS SOFTWARE_PUA
badNavigationEvent - THREAT_TYPE_UNSPECIFIED USER_RESOURCE_ACCESS SOFTWARE_MALICIOUS
browserCrashEvent STATUS_UPDATE
browserExtensionInstallEvent USER_RESOURCE_UPDATE_CONTENT
Extension install - BROWSER_EXTENSION_INSTALL USER_RESOURCE_UPDATE_CONTENT
EXTENSION_REQUEST USER_UNCATEGORIZED
CHROME_OS_ADD_USER - CHROMEOS_AFFILIATED_USER_ADDED USER_CREATION
CHROME_OS_ADD_USER - CHROMEOS_UNAFFILIATED_USER_ADDED USER_CREATION
ChromeOS user added - CHROMEOS_UNAFFILIATED_USER_ADDED USER_CREATION
ChromeOS user removed - CHROMEOS_UNAFFILIATED_USER_REMOVED USER_DELETION
CHROME_OS_REMOVE_USER - CHROMEOS_AFFILIATED_USER_REMOVED USER_DELETION
CHROME_OS_REMOVE_USER - CHROMEOS_UNAFFILIATED_USER_REMOVED USER_DELETION
Login events USER_LOGIN
LOGIN_EVENT - CHROMEOS_UNAFFILIATED_LOGIN USER_LOGIN
loginEvent USER_LOGIN
ChromeOS login success USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_AFFILIATED_LOGIN USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_UNAFFILIATED_LOGIN USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_GUEST_LOGIN USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_KIOSK_SESSION_LOGIN USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_GUEST_SESSION_LOGIN USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_MANAGED_GUEST_SESSION_LOGIN USER_LOGIN
ChromeOS login failure - CHROMEOS_AFFILIATED_LOGIN USER_LOGIN
CHROME_OS_LOGIN_FAILURE_EVENT - CHROMEOS_AFFILIATED_LOGIN USER_LOGIN
CHROME_OS_LOGIN_FAILURE_EVENT - CHROMEOS_UNAFFILIATED_LOGIN USER_LOGIN
CHROME_OS_LOGIN_LOGOUT_EVENT - CHROMEOS_AFFILIATED_LOGIN USER_LOGIN
CHROME_OS_LOGOUT_EVENT - CHROMEOS_AFFILIATED_LOGOUT USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_GUEST_LOGOUT USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_MANAGED_GUEST_SESSION_LOGOUT USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_UNAFFILIATED_LOGOUT USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_KIOSK_SESSION_LOGOUT USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_GUEST_SESSION_LOGOUT USER_LOGOUT
ChromeOS logout - CHROMEOS_AFFILIATED_LOGOUT USER_LOGOUT
CHROME_OS_REPORTING_DATA_LOST STATUS_UPDATE
ChromeOS CRD client connected - CHROMEOS_CRD_CLIENT_CONNECTED USER_LOGIN
ChromeOS CRD client disconnected USER_LOGOUT
CHROME_OS_CRD_HOST_STARTED - CHROMEOS_CRD_HOST_STARTED STATUS_STARTUP
ChromeOS CRD host started - CHROMEOS_CRD_HOST_STARTED STATUS_STARTUP
ChromeOS CRD host stopped - CHROMEOS_CRD_HOST_ENDED STATUS_STARTUP
ChromeOS device boot state change - CHROME_OS_VERIFIED_MODE SETTING_MODIFICATION
ChromeOS device boot state change - CHROME_OS_DEV_MODE SETTING_MODIFICATION
DEVICE_BOOT_STATE_CHANGE - CHROME_OS_VERIFIED_MODE SETTING_MODIFICATION
ChromeOS lock success - CHROMEOS_AFFILIATED_LOCK_SUCCESS USER_LOGOUT
ChromeOS unlock success - CHROMEOS_AFFILIATED_UNLOCK_SUCCESS USER_LOGIN
ChromeOS unlock failure - CHROMEOS_AFFILIATED_LOGIN USER_LOGIN
ChromeOS USB device added - CHROMEOS_PERIPHERAL_ADDED USER_RESOURCE_ACCESS
ChromeOS USB device removed - CHROMEOS_PERIPHERAL_REMOVED USER_RESOURCE_DELETION
ChromeOS USB status change - CHROMEOS_PERIPHERAL_STATUS_UPDATED USER_RESOURCE_UPDATE_CONTENT
CHROMEOS_PERIPHERAL_STATUS_UPDATED - CHROMEOS_PERIPHERAL_STATUS_UPDATED USER_RESOURCE_UPDATE_CONTENT
Client Side Detection USER_UNCATEGORIZED
Content transfer SCAN_FILE
CONTENT_TRANSFER SCAN_FILE
contentTransferEvent SCAN_FILE
Content unscanned SCAN_UNCATEGORIZED
CONTENT_UNSCANNED SCAN_UNCATEGORIZED
dataAccessControlEvent USER_RESOURCE_ACCESS
dangerousDownloadEvent - Dangerous SCAN_FILE SOFTWARE_PUA
dangerousDownloadEvent - DANGEROUS_HOST SCAN_HOST
dangerousDownloadEvent - UNCOMMON SCAN_UNCATEGORIZED
dangerousDownloadEvent - POTENTIALLY_UNWANTED SCAN_UNCATEGORIZED SOFTWARE_PUA
dangerousDownloadEvent - UNKNOWN SCAN_UNCATEGORIZED
dangerousDownloadEvent - DANGEROUS_URL SCAN_UNCATEGORIZED
dangerousDownloadEvent - UNWANTED_SOFTWARE SCAN_FILE SOFTWARE_PUA
dangerousDownloadEvent - DANGEROUS_FILE_TYPE SCAN_FILE SOFTWARE_MALICIOUS
Desktop DLP Warnings USER_UNCATEGORIZED
DLP_EVENT USER_UNCATEGORIZED
interstitialEvent - Malware NETWORK_HTTP NETWORK_SUSPICIOUS
IOS/OSX Warnings SCAN_UNCATEGORIZED
Malware transfer - MALWARE_TRANSFER_DANGEROUS SCAN_FILE SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_UNCOMMON SCAN_FILE SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_DANGEROUS SCAN_FILE SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_UNWANTED_SOFTWARE SCAN_FILE SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_UNKNOWN SCAN_FILE SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_DANGEROUS_HOST SCAN_FILE SOFTWARE_MALICIOUS
malwareTransferEvent - DANGEROUS SCAN_FILE SOFTWARE_MALICIOUS
malwareTransferEvent - UNSPECIFIED SCAN_FILE SOFTWARE_MALICIOUS
Password breach USER_RESOURCE_ACCESS
PASSWORD_BREACH USER_RESOURCE_ACCESS
passwordBreachEvent - PASSWORD_ENTRY USER_RESOURCE_ACCESS
Password changed USER_CHANGE_PASSWORD
PASSWORD_CHANGED USER_CHANGE_PASSWORD
passwordChangedEvent USER_CHANGE_PASSWORD
Password reuse - PASSWORD_REUSED_UNAUTHORIZED_SITE USER_RESOURCE_ACCESS POLICY_VIOLATION, AUTH_VIOLATION
Password reuse - PASSWORD_REUSED_PHISHING_URL USER_UNCATEGORIZED PHISHING
PASSWORD_REUSE - PASSWORD_REUSED_UNAUTHORIZED_SITE USER_RESOURCE_ACCESS POLICY_VIOLATION, AUTH_VIOLATION
passwordReuseEvent - Unauthorized site USER_RESOURCE_ACCESS POLICY_VIOLATION, AUTH_VIOLATION
passwordReuseEvent - PASSWORD_REUSED_PHISHING_URL USER_UNCATEGORIZED PHISHING
passwordReuseEvent - PASSWORD_REUSED_UNAUTHORIZED_SITE USER_RESOURCE_ACCESS POLICY_VIOLATION, AUTH_VIOLATION
Permissions Blacklisting RESOURCE_PERMISSIONS_CHANGE
Sensitive data transfer SCAN_FILE DATA_EXFILTRATION
SENSITIVE_DATA_TRANSFER SCAN_FILE DATA_EXFILTRATION
sensitiveDataEvent - [test_user_5] warn SCAN_FILE DATA_EXFILTRATION
sensitiveDataTransferEvent SCAN_FILE DATA_EXFILTRATION
Unsafe site visit - UNSAFE_SITE_VISIT_SSL_ERROR USER_RESOURCE_ACCESS NETWORK_SUSPICIOUS
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_MALWARE USER_RESOURCE_ACCESS SOFTWARE_MALICIOUS
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE USER_RESOURCE_ACCESS SOFTWARE_SUSPICIOUS
UNSAFE_SITE_VISIT - EVENT_REASON_UNSPECIFIED USER_RESOURCE_ACCESS
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING USER_RESOURCE_ACCESS SOCIAL_ENGINEERING
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_SSL_ERROR USER_RESOURCE_ACCESS NETWORK_SUSPICIOUS
unscannedFileEvent - FILE_PASSWORD_PROTECTED SCAN_FILE
unscannedFileEvent - FILE_TOO_LARGE SCAN_FILE
urlFilteringInterstitialEvent USER_RESOURCE_ACCESS POLICY_VIOLATION

필드 매핑 참조: CHROME_MANAGEMENT

다음 표에는 CHROME_MANAGEMENT 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
id.customerId about.resource.product_object_id
event_detail metadata.description
time metadata.event_timestamp
events.parameters.name [TIMESTAMP] metadata.event_timestamp
event metadata.product_event_type
events.name metadata.product_event_type
id.uniqueQualifier metadata.product_log_id
metadata.product_name The metadata.product_name UDM field is set to Chrome Management.
id.applicationName
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
user_agent network.http.user_agent
userAgent network.http.user_agent
events.parameters.name [USER_AGENT] network.http.user_agent
events.parameters.name [SESSION_ID] network.session_id
client_type principal.application
clientType principal.application
events.parameters.name [CLIENT_TYPE] principal.application
device_id principal.asset.product_object_id
deviceId principal.asset.product_object_id
events.parameters.name [DEVICE_ID] principal.asset.product_object_id
device_name principal.hostname
deviceName principal.hostname
events.parameters.name [DEVICE_NAME] principal.hostname
os_plarform principal.platform The principal.platform UDM field is set to one of the following values:
  • LINUX if the os_plarform log field value is matched with regular expression pattern linux.
  • MAC if the os_plarform log field value is matched with regular expression pattern mac.
  • WINDOWS if the os_plarform log field value is matched with regular expression pattern windows.
  • CHROME_OS if the os_plarform log field value is matched with regular expression pattern chromeos.

Else, if the os_plarform log field value is not empty and osVersion log field value is not empty, then the os_plarform osVersion log field is mapped to the principal.platform_version UDM field.
os_platform principal.platform The principal.platform UDM field is set to one of the following values:
  • LINUX if the os_platform log field value is matched with regular expression pattern linux.
  • MAC if the os_platform log field value is matched with regular expression pattern mac.
  • WINDOWS if the os_platform log field value is matched with regular expression pattern windows.
  • CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos.

Else, if the os_platform log field value is not empty and osVersion log field value is not empty, then the os_platform osVersion log field is mapped to the principal.platform_version UDM field.
osPlatform principal.platform The principal.platform UDM field is set to one of the following values:
  • LINUX if the osPlatform log field value is matched with regular expression pattern linux.
  • MAC if the osPlatform log field value is matched with regular expression pattern mac.
  • WINDOWS if the osPlatform log field value is matched with regular expression pattern windows.
  • CHROME_OS if the osPlatform log field value is matched with regular expression pattern chromeos.

Else, if the osPlatform log field value is not empty and osVersion log field value is not empty, then the osPlatform osVersion log field is mapped to the principal.platform_version UDM field.
events.parameters.name [DEVICE_PLATFORM] principal.platform The os_platform and os_version is extracted from the events.parameters.name [DEVICE_PLATFORM] log field using Grok pattern.
The principal.platform UDM field is set to one of the following values:
  • LINUX if the os_platform log field value is matched with regular expression pattern linux.
  • MAC if the os_platform log field value is matched with regular expression pattern mac.
  • WINDOWS if the os_platform log field value is matched with regular expression pattern windows.
  • CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos.

Else, if the os_platform log field value is not empty and osVersion log field value is not empty, then the os_platform osVersion log field is mapped to the principal.platform_version UDM field.
os_version principal.platform_version
osVersion principal.platform_version
events.parameters.name [DEVICE_PLATFORM] principal.platform_version The Version is extracted from the events.parameters.name [DEVICE_PLATFORM] log field using Grok pattern.
device_id principal.resource.id
deviceId principal.resource.id
events.parameters.name [DEVICE_ID] principal.resource.id
directory_device_id principal.resource.product_object_id
events.parameters.name [DIRECTORY_DEVICE_ID] principal.resource.product_object_id
principal.resource.resource_subtype If the event log field value is equal to CHROMEOS_PERIPHERAL_STATUS_UPDATED, then the principal.resource.resource_subtype UDM field is set to USB.

Else, if the events.name log field value is equal to CHROMEOS_PERIPHERAL_STATUS_UPDATED, then the principal.resource.resource_subtype UDM field is set to USB.
principal.resource.resource_type If the device_id log field value is not empty, then the principal.resource.resource_type UDM field is set to DEVICE.
actor.email principal.user.email_addresses
actor.profileId principal.user.userid
result security_result.action_details
events.parameters.name [EVENT_RESULT] security_result.action_details
event_result security_result.action_details
security_result.action The security_result.action UDM field is set to one of the following values:
  • ALLOW if the result or events.parameters.name [EVENT_RESULT] log field value is matched with regular expression pattern ALLOWED.
  • BLOCK if the result or events.parameters.name [EVENT_RESULT] log field value is matched with regular expression pattern BLOCKED.
reason security_result.category_details
events.parameters.name [EVENT_REASON] security_result.category_details
events.parameters.name [LOGIN_FAILURE_REASON] security_result.description
events.parameters.name [REMOVE_USER_REASON] security_result.description If the events.name log field value is equal to CHROME_OS_REMOVE_USER, then the events.parameters.namethe REMOVE_USER_REASON log field value log field is mapped to the security_result.description UDM field.
triggered_rules security_result.rule_name
events.type security_result.summary
events.parameters.name [PRODUCT_NAME] target.application If the events.name log field value contains one of the following values, then the events.parameters.name [PRODUCT_NAME] log field is mapped to the target.resource.name UDM field:
  • ChromeOS USB device added
  • ChromeOS USB device removed
  • ChromeOS USB status change
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
content_name target.file.full_path
contentName target.file.full_path
events.parameters.name [CONTENT_NAME] target.file.full_path
content_type target.file.mime_type
contentType target.file.mime_type
events.parameters.name [CONTENT_TYPE] target.file.mime_type
content_hash target.file.sha256
events.parameters.name [CONTENT_HASH] target.file.sha256
content_size target.file.size
contentSize target.file.size
events.parameters.name [CONTENT_SIZE] target.file.size
target.file.file_type The fileType is extracted from the content_name log field usign Grok pattern, Then target.file.file_type UDM field is set to one of the following values:
  • FILE_TYPE_ZIP if the fileType value is equal to zip.
  • FILE_TYPE_DOS_EXE if the fileType value is equal to exe.
  • FILE_TYPE_PDF if the fileType value is equal to pdf.
  • FILE_TYPE_XLSX if the fileType value is equal to xlsx.
extension_id target.resource.product_object_id
events.parameters.name [APP_ID] target.resource.product_object_id
extension_name target.resource.name If the event log field value is equal to badNavigationEvent or the events.name log field value is equal to badNavigationEvent, then the url log field is mapped to the target.resource.name UDM field.

Else, the extension_id log field is mapped to the target.resource.name UDM field.
events.parameters.name [APP_NAME] target.resource.name
url target.url
events.parameters.name [URL] target.url
device_user target.user.userid
deviceUser target.user.userid
events.parameters.name [DEVICE_USER] target.user.userid
scan_id about.labels [scan_id]
events.parameters.name [CONNECTION_TYPE] about.labels [connection_type]
etag about.labels [etag]
kind about.labels [kind]
actor.key principal.user.attribute.labels [actor_key]
actor.callerType principal.user.attribute.labels [actor_callerType]
events.parameters.name [EVIDENCE_LOCKER_FILEPATH] security_result.about.labels [evidence_locker_filepath]
federated_origin security_result.about.labels [federated_origin]
is_federated security_result.about.labels [is_federated]
destination security_result.about.labels [trigger_destination]
events.parameters.name [TRIGGER_DESTINATION] security_result.about.labels [trigger_destination]
source security_result.about.labels [trigger_source]
events.parameters.name [TRIGGER_SOURCE] security_result.about.labels [trigger_source]
trigger_type security_result.about.labels [trigger_type]
triggerType security_result.about.labels [trigger_type]
events.parameters.name [TRIGGER_TYPE] security_result.about.labels [trigger_type]
trigger_user security_result.about.labels [trigger_user]
events.parameters.name [TRIGGER_USER] security_result.about.labels [trigger_user]
events.parameters.name [MALWARE_CATEGORY] security_result.threat_name
events.parameters.name [MALWARE_FAMILY] security_result.detection_fields [malware_family]
events.parameters.name [VENDOR_ID] src.labels [vendor_id]
events.parameters.name [VENDOR_NAME] src.labels [vendor_name]
events.parameters.name [VIRTUAL_DEVICE_ID] src.labels [virtual_device_id]
events.parameters.name [NEW_BOOT_MODE] target.asset.attribute.labels [new_boot_mode]
events.parameters.name [PREVIOUS_BOOT_MODE] target.asset.attribute.labels [previous_boot_mode]
id.time target.asset.attribute.labels [timestamp]
events.parameters.name [PRODUCT_ID] target.labels [product_id] If the events.name log field value contains one of the following values, then the events.parameters.name [PRODUCT_ID] log field is mapped to the target.resource.product_object_id UDM field:
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the events.parameters.name [PRODUCT_ID] log field is mapped to the target.labels UDM field.
extensions.auth.mechanism If the events.name log field value contains one of the following values, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD:
  • CHROME_OS_LOGIN_EVENT
  • loginEvent
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_LOGOUT_EVENT
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
events.parameters.name [UNLOCK_TYPE] target.labels [unlock_type]
extension_description target.resource.attribute.labels [extension_description]
extension_action target.resource.attribute.labels [extension_action]
extension_version target.resource.attribute.labels [extension_version]
extension_source target.resource.attribute.labels [extension_source]
browser_version target.resource.attributes.labels [browser_version]
browserVersion target.resource.attributes.labels [browser_version]
events.parameters.name [BROWSER_VERSION] target.resource.attributes.labels [browser_version]
profile_user principal.user.email_addresses If the profile_user log field value is matched with regular expression pattern ^.+@.+$, then the profile_user log field is mapped to the principal.user.email_addresses UDM field.

Else, the profile_user log field is mapped to the principal.user.user_display_name UDM field.
events.parameters.name [PROFILE_USER_NAME] target.user.user_display_name
target.resource.resource_type If the events.name log field value is equal to DEVICE_BOOT_STATE_CHANGE, then the target.resource.resource_type UDM field is set to SETTING.
url_category target.labels [url_category]
browser_channel target.resource.attribute.labels [browser_channel]
report_id target.labels [report_id]
clickedThrough target.labels [clickedThrough]
threat_type security_result.detection_fields [threatType]
triggered_rule_info.action security_result.action If the triggered_rule_info.action log field value contains one of the following values, then the triggered_rule_info.action log field is mapped to the security_result.action UDM field:
  • ALLOW
  • ALLOW_WITH_MODIFICATION
  • BLOCK
  • CHALLENGE
  • FAIL
  • QUARANTINE
  • UNKNOWN_ACTION

Else, the triggered_rule_info.action log field is mapped to the security_result.rule_labels [triggeredRuleInfo_action] UDM field.
triggered_rule_info.rule_id security_result.rule_id
triggered_rule_info.rule_name security_result.rule_name
triggered_rule_info.url_category security_result.category_details
transfer_method additional.fields [transfer_method]

다음 단계