Recopila registros de Cloud NAT

Compatible con:

SecOps de Google SIEM

En este documento, se describe cómo puedes recopilar registros de Cloud NAT habilitando la transferencia de telemetría de Google Cloud a Google Security Operations y cómo los campos de registro de los registros de Cloud NAT se asignan a los campos del Modelo de datos unificados (UDM) de Google Security Operations.

Para obtener más información, consulta Transferencia de datos a Google Security Operations.

Una implementación típica consiste en registros de Cloud NAT habilitados para la transferencia a Google Security Operations. Cada implementación de cliente puede diferir de esta representación y podría ser más compleja.

La implementación contiene los siguientes componentes:

• Google Cloud: Son los servicios y productos de Google Cloud de los que recopilas registros.

• Registros de Cloud NAT: Los registros de Cloud NAT que se habilitar para la transferencia a Google Security Operations.

• Google Security Operations: Google Security Operations retiene y analiza los registros de Cloud NAT.

Una etiqueta de transferencia identifica el analizador que normaliza los datos de registro sin procesar al formato de UDM estructurado. La información de este documento se aplica al analizador con la etiqueta de transferencia GCP_CLOUD_NAT.

Antes de comenzar

• Asegúrate de que todos los sistemas de la arquitectura de implementación estén configurados en la zona horaria UTC.

Configura Google Cloud para transferir registros de Cloud NAT

Para obtener más información sobre cómo transferir registros a Google Security Operations, consulta Transfiere registros de Google Cloud a Google Security Operations.

Si tienes problemas cuando transfieres registros de Cloud NAT, comunícate con el equipo de asistencia de Operaciones de seguridad de Google.

Referencia de la asignación de campos

En esta sección, se explica cómo el analizador de Google Security Operations asigna campos de Cloud NAT a campos del modelo de datos unificado (UDM) de Google Security Operations.

Obsoleto:

Los siguientes campos labels para sustantivos del UDM dejaron de estar disponibles: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels y target.labels. Para los analizadores existentes, además de estos campos de UDM, los campos de registro también se asignan a los campos de UDM additional.fields de clave-valor. Para los analizadores nuevos, se usa la configuración de clave-valor en los campos de UDM additional.fields en lugar de los campos UDM labels obsoletos. Te recomendamos que actualices las reglas existentes para usar la configuración de clave-valor en los campos de la UDM additional.fields en lugar de los campos de la UDM labels obsoletos.

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to NETWORK_CONNECTION.
	metadata.product_name	The metadata.product_name UDM field is set to GCP Cloud NAT.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Google Cloud Platform.
receiveTimestamp	metadata.collected_timestamp
timestamp	metadata.event_timestamp
logName	security_result.category_details
insertId	metadata.product_log_id
	network.direction	The network.direction UDM field is set to OUTBOUND.
	network.ip_protocol	If the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ICMP. 1 ICMP ICMPV6 58 1.0 58.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IGMP. 2 IGMP 2.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to TCP. 6 TCP 6.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to UDP. 17 UDP 17.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IP6IN4. 41 IP6IN4 41.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to GRE. 47 GRE 47.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ESP. 50 ESP 50.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to EIGRP. 88 EIGRP 88.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ETHERIP. 97 ETHERIP 97.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to PIM. 103 PIM 103.0 Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to VRRP. 112 VRRP 112.0
jsonPayload.connection.src_ip	principal.ip
jsonPayload.connection.src_port	principal.port
jsonPayload.connection.nat_ip	principal.nat_ip
jsonPayload.connection.nat_port	principal.nat_port
jsonPayload.vpc.project_id	intermediary.resource_ancestors.name	If the jsonPayload.vpc.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{jsonPayload.vpc.project_id} log field is mapped to the intermediary.resource_ancestors.name UDM field.
	intermediary.resource_ancestors.resource_type	If the jsonPayload.vpc.project_id log field value is not empty, then the intermediary.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
	intermediary.resource_ancestors.attribute.cloud.environment	If the jsonPayload.vpc.project_id log field value is not empty, then the intermediary.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.vpc.vpc_name	intermediary.resource_ancestors.name
	intermediary.resource_ancestors.resource_type	If the jsonPayload.vpc.vpc_name log field value is not empty or the jsonPayload.vpc.subnetwork_name log field value is not empty, then the intermediary.resource_ancestors.resource_type UDM field is set to VPC_NETWORK.
	intermediary.resource_ancestors.attribute.cloud.environment	If the jsonPayload.vpc.vpc_name log field value is not empty or the jsonPayload.vpc.subnetwork_name log field value is not empty, then the intermediary.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.vpc.subnetwork_name	intermediary.resource_ancestors.attribute.labels [vpc_subnetwork_name]
jsonPayload.gateway_identifiers.gateway_name	intermediary.resource.name
	intermediary.resource.resource_type	If the jsonPayload.gateway_identifiers.gateway_name log field value is not empty or the resource.type log field value is not empty or the resource.labels.region log field value is not empty or the jsonPayload.gateway_identifiers.router_name log field value is not empty or the resource.labels.router_id log field value is not empty, then the intermediary.resource.resource_type UDM field is set to BACKEND_SERVICE.
resource.type	intermediary.resource.resource_subtype
jsonPayload.gateway_identifiers.region	intermediary.location.name
	intermediary.resource.attribute.cloud.environment	If the jsonPayload.gateway_identifiers.gateway_name log field value is not empty or the resource.type log field value is not empty or the resource.labels.region log field value is not empty or the jsonPayload.gateway_identifiers.router_name log field value is not empty or the resource.labels.router_id log field value is not empty, then the intermediary.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
resource.labels.region	intermediary.resource.attribute.cloud.availability_zone
jsonPayload.gateway_identifiers.router_name	intermediary.resource.attribute.labels [gateway_identifiers_router_name]
resource.labels.router_id	intermediary.resource.attribute.labels [resource_labels_router_id]
jsonPayload.endpoint.project_id	principal.resource_ancestors.name	If the jsonPayload.endpoint.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{jsonPayload.endpoint.project_id} log field is mapped to the principal.resource_ancestors.name UDM field.
	principal.resource_ancestors.resource_type	If the jsonPayload.endpoint.project_id log field value is not empty, then the principal.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
	principal.resource_ancestors.attribute.cloud.environment	If the jsonPayload.endpoint.project_id log field value is not empty, then the principal.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.endpoint.vm_name	principal.hostname
jsonPayload.endpoint.vm_name	principal.asset.hostname
jsonPayload.endpoint.vm_name	principal.resource.name
	principal.resource.resource_type	If the jsonPayload.endpoint.vm_name log field value is not empty or the jsonPayload.endpoint.zone log field value is not empty, then the principal.resource.resource_type UDM field is set to VIRTUAL_MACHINE.
	principal.resource.attribute.cloud.environment	If the jsonPayload.endpoint.vm_name log field value is not empty or the jsonPayload.endpoint.zone log field value is not empty, then the principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.endpoint.zone	principal.resource.attribute.cloud.availability_zone
jsonPayload.endpoint.region	principal.location.name
jsonPayload.connection.dest_ip	target.ip
jsonPayload.connection.dest_port	target.port
jsonPayload.destination.geo_location.city	target.location.city
jsonPayload.destination.geo_location.country	target.location.country_or_region
jsonPayload.destination.geo_location.region	target.location.name
jsonPayload.destination.geo_location.continent	target.labels [destination_geo_location_continent] (deprecated)
jsonPayload.destination.geo_location.continent	additional.fields [destination_geo_location_continent]
jsonPayload.destination.geo_location.asn	network.asn
jsonPayload.destination.instance.project_id	target.resource_ancestors.name	If the jsonPayload.destination.instance.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{jsonPayload.destination.instance.project_id} log field is mapped to the target.resource_ancestors.name UDM field.
	target.resource_ancestors.resource_type	If the jsonPayload.destination.instance.project_id log field value is not empty, then the target.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
	target.resource_ancestors.attribute.cloud.environment	If the jsonPayload.destination.instance.project_id log field value is not empty, then the target.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.destination.instance.vm_name	target.hostname
jsonPayload.destination.instance.vm_name	target.asset.hostname
jsonPayload.destination.instance.vm_name	target.resource.name
	target.resource.resource_type	If the jsonPayload.destination.instance.vm_name log field value is not empty, then the target.resource_ancestors.resource_type UDM field is set to VIRTUAL_MACHINE.
	target.resource.attribute.cloud.environment	If the jsonPayload.destination.instance.vm_name log field value is not empty, then the target.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.destination.instance.zone	target.resource.attribute.cloud.availability_zone
jsonPayload.destination.instance.region	target.location.name	If the jsonPayload.destination.geo_location.region log field value is empty, then the jsonPayload.destination.instance.region log field is mapped to the target.location.name UDM field.
	security_result.action	If the jsonPayload.allocation_status log field value is equal to OK, then the security_result.action UDM field is set to ALLOW. Else, if the jsonPayload.allocation_status log field value is equal to DROPPED, then the security_result.action UDM field is set to BLOCK.
jsonPayload.allocation_status	security_result.action_details
labels	about.resource.attribute.labels
resource.labels.project_id	about.resource.attribute.labels [resource_project_id]	If the resource.labels.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{resource.labels.project_id} log field is mapped to the about.resource.attribute.labels.resource_project_id UDM field.
resource.labels.gateway_name	about.resource.attribute.labels [resource_gateway_name]

¿Qué sigue?

• Transferencia de datos a Google Security Operations