收集 Cloud NAT 日志

支持的平台：

本文档介绍了如何通过启用 Google Cloud 将遥测数据提取到 Google 安全运营中心来收集 Cloud NAT 日志，以及 Cloud NAT 日志的日志字段如何映射到 Google 安全运营中心的 Unified Data Model (UDM) 字段。

如需了解详情，请参阅将数据提取到 Google 安全运营中心。

典型的部署包含已启用以提取到 Google Security Operations 的 Cloud NAT 日志。每个客户部署都可能与此表示法不同，并且可能更复杂。

该部署包含以下组件：

  • Google Cloud：您要从中收集日志的 Google Cloud 服务和产品。

  • Cloud NAT 日志：已启用以注入 Google Security Operations 的 Cloud NAT 日志。

  • Google Security Operations：Google Security Operations 会保留和分析 Cloud NAT 的日志。

提取标签用于标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档中的信息适用于具有 GCP_CLOUD_NAT 注入标签的解析器。

准备工作

  • 确保部署架构中的所有系统都采用世界协调时间 (UTC) 时区进行配置。

配置 Google Cloud 以提取 Cloud NAT 日志

如需详细了解如何将日志注入 Google Security Operations，请参阅将日志注入 Google Cloud Google Security Operations。

如果您在提取 Cloud NAT 日志时遇到问题，请与 Google 安全运营支持团队联系。

字段映射参考文档

本部分介绍 Google 安全运营解析器如何将 Cloud NAT 字段映射到 Google 安全运营 Unified Data Model (UDM) 字段。

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to NETWORK_CONNECTION.
metadata.product_name The metadata.product_name UDM field is set to GCP Cloud NAT.
metadata.vendor_name The metadata.vendor_name UDM field is set to Google Cloud Platform.
receiveTimestamp metadata.collected_timestamp
timestamp metadata.event_timestamp
logName security_result.category_details
insertId metadata.product_log_id
network.direction The network.direction UDM field is set to OUTBOUND.
network.ip_protocol If the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ICMP.
  • 1
  • ICMP
  • ICMPV6
  • 58
  • 1.0
  • 58.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IGMP.
  • 2
  • IGMP
  • 2.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to TCP.
  • 6
  • TCP
  • 6.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to UDP.
  • 17
  • UDP
  • 17.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IP6IN4.
  • 41
  • IP6IN4
  • 41.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to GRE.
  • 47
  • GRE
  • 47.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ESP.
  • 50
  • ESP
  • 50.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to EIGRP.
  • 88
  • EIGRP
  • 88.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ETHERIP.
  • 97
  • ETHERIP
  • 97.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to PIM.
  • 103
  • PIM
  • 103.0
Else, if the jsonPayload.connection.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to VRRP.
  • 112
  • VRRP
  • 112.0
jsonPayload.connection.src_ip principal.ip
jsonPayload.connection.src_port principal.port
jsonPayload.connection.nat_ip principal.nat_ip
jsonPayload.connection.nat_port principal.nat_port
jsonPayload.vpc.project_id intermediary.resource_ancestors.name If the jsonPayload.vpc.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{jsonPayload.vpc.project_id} log field is mapped to the intermediary.resource_ancestors.name UDM field.
intermediary.resource_ancestors.resource_type If the jsonPayload.vpc.project_id log field value is not empty, then the intermediary.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
intermediary.resource_ancestors.attribute.cloud.environment If the jsonPayload.vpc.project_id log field value is not empty, then the intermediary.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.vpc.vpc_name intermediary.resource_ancestors.name
intermediary.resource_ancestors.resource_type If the jsonPayload.vpc.vpc_name log field value is not empty or the jsonPayload.vpc.subnetwork_name log field value is not empty, then the intermediary.resource_ancestors.resource_type UDM field is set to VPC_NETWORK.
intermediary.resource_ancestors.attribute.cloud.environment If the jsonPayload.vpc.vpc_name log field value is not empty or the jsonPayload.vpc.subnetwork_name log field value is not empty, then the intermediary.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.vpc.subnetwork_name intermediary.resource_ancestors.attribute.labels [vpc_subnetwork_name]
jsonPayload.gateway_identifiers.gateway_name intermediary.resource.name
intermediary.resource.resource_type If the jsonPayload.gateway_identifiers.gateway_name log field value is not empty or the resource.type log field value is not empty or the resource.labels.region log field value is not empty or the jsonPayload.gateway_identifiers.router_name log field value is not empty or the resource.labels.router_id log field value is not empty, then the intermediary.resource.resource_type UDM field is set to BACKEND_SERVICE.
resource.type intermediary.resource.resource_subtype
jsonPayload.gateway_identifiers.region intermediary.location.name
intermediary.resource.attribute.cloud.environment If the jsonPayload.gateway_identifiers.gateway_name log field value is not empty or the resource.type log field value is not empty or the resource.labels.region log field value is not empty or the jsonPayload.gateway_identifiers.router_name log field value is not empty or the resource.labels.router_id log field value is not empty, then the intermediary.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
resource.labels.region intermediary.resource.attribute.cloud.availability_zone
jsonPayload.gateway_identifiers.router_name intermediary.resource.attribute.labels [gateway_identifiers_router_name]
resource.labels.router_id intermediary.resource.attribute.labels [resource_labels_router_id]
jsonPayload.endpoint.project_id principal.resource_ancestors.name If the jsonPayload.endpoint.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{jsonPayload.endpoint.project_id} log field is mapped to the principal.resource_ancestors.name UDM field.
principal.resource_ancestors.resource_type If the jsonPayload.endpoint.project_id log field value is not empty, then the principal.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
principal.resource_ancestors.attribute.cloud.environment If the jsonPayload.endpoint.project_id log field value is not empty, then the principal.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.endpoint.vm_name principal.hostname
jsonPayload.endpoint.vm_name principal.asset.hostname
jsonPayload.endpoint.vm_name principal.resource.name
principal.resource.resource_type If the jsonPayload.endpoint.vm_name log field value is not empty or the jsonPayload.endpoint.zone log field value is not empty, then the principal.resource.resource_type UDM field is set to VIRTUAL_MACHINE.
principal.resource.attribute.cloud.environment If the jsonPayload.endpoint.vm_name log field value is not empty or the jsonPayload.endpoint.zone log field value is not empty, then the principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.endpoint.zone principal.resource.attribute.cloud.availability_zone
jsonPayload.endpoint.region principal.location.name
jsonPayload.connection.dest_ip target.ip
jsonPayload.connection.dest_port target.port
jsonPayload.destination.geo_location.city target.location.city
jsonPayload.destination.geo_location.country target.location.country_or_region
jsonPayload.destination.geo_location.region target.location.name
jsonPayload.destination.geo_location.continent target.labels [destination_geo_location_continent] (deprecated)
jsonPayload.destination.geo_location.continent additional.fields [destination_geo_location_continent]
jsonPayload.destination.geo_location.asn network.asn
jsonPayload.destination.instance.project_id target.resource_ancestors.name If the jsonPayload.destination.instance.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{jsonPayload.destination.instance.project_id} log field is mapped to the target.resource_ancestors.name UDM field.
target.resource_ancestors.resource_type If the jsonPayload.destination.instance.project_id log field value is not empty, then the target.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
target.resource_ancestors.attribute.cloud.environment If the jsonPayload.destination.instance.project_id log field value is not empty, then the target.resource_ancestors.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.destination.instance.vm_name target.hostname
jsonPayload.destination.instance.vm_name target.asset.hostname
jsonPayload.destination.instance.vm_name target.resource.name
target.resource.resource_type If the jsonPayload.destination.instance.vm_name log field value is not empty, then the target.resource_ancestors.resource_type UDM field is set to VIRTUAL_MACHINE.
target.resource.attribute.cloud.environment If the jsonPayload.destination.instance.vm_name log field value is not empty, then the target.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
jsonPayload.destination.instance.zone target.resource.attribute.cloud.availability_zone
jsonPayload.destination.instance.region target.location.name If the jsonPayload.destination.geo_location.region log field value is empty, then the jsonPayload.destination.instance.region log field is mapped to the target.location.name UDM field.
security_result.action If the jsonPayload.allocation_status log field value is equal to OK, then the security_result.action UDM field is set to ALLOW.

Else, if the jsonPayload.allocation_status log field value is equal to DROPPED, then the security_result.action UDM field is set to BLOCK.
jsonPayload.allocation_status security_result.action_details
labels about.resource.attribute.labels
resource.labels.project_id about.resource.attribute.labels [resource_project_id] If the resource.labels.project_id log field value is not empty, then the //cloudresourcemanager.googleapis.com/projects/%{resource.labels.project_id} log field is mapped to the about.resource.attribute.labels.resource_project_id UDM field.
resource.labels.gateway_name about.resource.attribute.labels [resource_gateway_name]

后续步骤

需要更多帮助？向社区成员和 Google SecOps 专业人士寻求解答。