Raccogli i log di Google Cloud DNS
Questo documento descrive come raccogliere i log di Google Cloud DNS abilitando l'importazione della telemetria di Google Cloud in Google Security Operations e come i campi dei log dei log di Google Cloud DNS vengono mappati ai campi UDM (Unified Data Model) di Google Security Operations. Questo documento elenca anche la versione di Google Cloud DNS supportata.
Per ulteriori informazioni, consulta Importazione dei dati in Google Security Operations.
Un deployment tipico è costituito da log DNS di Google Cloud abilitati per l'importazione in Google Security Operations. Ogni implementazione del cliente potrebbe essere diversa da questa rappresentazione e potrebbe essere più complessa.
Il deployment contiene i seguenti componenti:
Google Cloud: i servizi e i prodotti Google Cloud da cui raccogli i log.
Log di Google Cloud DNS: i log di Google Cloud DNS attivati per l'importazione in Google Security Operations.
Google Security Operations: Google Security Operations conserva e analizza i log di Google Cloud DNS.
Un'etichetta di importazione identifica il parser che normalizza i dati di log non elaborati
in formato UDM strutturato. Le informazioni contenute in questo documento si applicano al parser con l'etichetta di importazione GCP_DNS.
Prima di iniziare
Assicurati di utilizzare la versione 1 di Google Cloud DNS.
Assicurati che tutti i sistemi nell'architettura di deployment siano configurati nel fuso orario UTC.
Configura Google Cloud per importare i log di Google Cloud DNS
Per importare i log di Google Cloud DNS in Google Security Operations, segui i passaggi descritti nella pagina Importare i log di Google Cloud in Google Security Operations.
Se riscontri problemi durante l'importazione dei log DNS di Google Cloud, contatta l'assistenza di Google Security Operations.
Riferimento alla mappatura dei campi
Questa sezione spiega in che modo l'analizzatore sintattico di Google Security Operations mappa i campi DNS di Google Cloud ai campi UDM (Google Security Operations Unified Data Model).
| Log field | UDM mapping | Logic |
|---|---|---|
alias_query_response_code |
about.labels[alias_query_response_code] (deprecated) |
|
alias_query_response_code |
additional.fields[alias_query_response_code] |
|
egressError |
about.labels[egress_error] (deprecated) |
|
egressError |
additional.fields[egress_error] |
|
healthyIps |
about.ip |
|
jsonPayload.serverLatency |
about.labels[server_latency] (deprecated) |
|
jsonPayload.serverLatency |
additional.fields[server_latency] |
|
unHealthyIps |
about.labels[un_healthy_ips] (deprecated) |
|
unHealthyIps |
additional.fields[un_healthy_ips] |
|
jsonPayload.responseCode |
additional.fields[response_code] |
|
jsonPayload.egressIP |
intermediary.ip |
|
receiveTimestamp |
metadata.collected_timestamp |
|
timestamp |
metadata.event_timestamp |
|
metadata.event_type |
If the jsonPayload.sourceIP log field value is not empty and the jsonPayload.queryName log field value is not empty or does not contain an end period (.), then the metadata.event_type UDM field is set to NETWORK_DNS.Else, if the jsonPayload.sourceIP log field value is not empty and the jsonPayload.queryName log field value is not empty or does not contain an end period (.), then the metadata.event_type UDM field is set to STATUS_UPDATE.Else, the metadata.event_type UDM field is set to GENERIC_EVENT. |
|
insertId |
metadata.product_log_id |
|
metadata.product_name |
The metadata.product_name UDM field is set to Google Cloud DNS. |
|
metadata.vendor_name |
The metadata.vendor_name UDM field is set to Google Cloud Platform. |
|
resource.type |
metadata.description |
|
network.application_protocol |
The network.application_protocol UDM field is set to DNS. |
|
jsonPayload.structuredRdata.class |
network.dns.answers.class |
If the jsonPayload.structuredRdata.class log field value is equal to IN, then the network.dns.answers.class UDM field is set to 1.Else, if the jsonPayload.structuredRdata.class log field value is equal to CH, then the network.dns.answers.class UDM field is set to 3.Else, if the jsonPayload.structuredRdata.class log field value is equal to HS, then the network.dns.answers.class UDM field is set to 4. |
jsonPayload.rdata.class |
network.dns.answers.class |
If the jsonPayload.rdata.class log field value is equal to IN, then the network.dns.answers.class UDM field is set to 1.Else, if the jsonPayload.rdata.class log field value is equal to CH, then the network.dns.answers.class UDM field is set to 3.Else, if the jsonPayload.rdata.class log field value is equal to HS, then the network.dns.answers.class UDM field is set to 4. |
jsonPayload.structuredRdata.rvalue |
network.dns.answers.data |
|
jsonPayload.rdata.data |
network.dns.answers.data |
|
jsonPayload.structuredRdata.domainName |
network.dns.answers.name |
Extracted domainName from the jsonPayload.structuredRdata.domainName log field using the Grok pattern and mapped to the network.dns.answers.name UDM field. |
jsonPayload.rdata.name |
network.dns.answers.name |
Extracted domainName from the jsonPayload.rdata.name log field using the Grok pattern and mapped to the network.dns.answers.name UDM field. |
jsonPayload.structuredRdata.ttl |
network.dns.answers.ttl |
|
jsonPayload.rdata.ttl |
network.dns.answers.ttl |
|
jsonPayload.structuredRdata.type |
network.dns.answers.type |
If the jsonPayload.structuredRdata.type log field value is equal to A, then the network.dns.answers.type UDM field is set to 1.Else, if the jsonPayload.structuredRdata.type log field value is equal to NS, then the network.dns.answers.type UDM field is set to 2.Else, if the jsonPayload.structuredRdata.type log field value is equal to MD, then the network.dns.answers.type UDM field is set to 3.Else, if the jsonPayload.structuredRdata.type log field value is equal to MF, then the network.dns.answers.type UDM field is set to 4.Else, if the jsonPayload.structuredRdata.type log field value is equal to CNAME, then the network.dns.answers.type UDM field is set to 5.Else, if the jsonPayload.structuredRdata.type log field value is equal to SOA, then the network.dns.answers.type UDM field is set to 6.Else, if the jsonPayload.structuredRdata.type log field value is equal to MB, then the network.dns.answers.type UDM field is set to 7.Else, if the jsonPayload.structuredRdata.type log field value is equal to MG, then the network.dns.answers.type UDM field is set to 8.Else, if the jsonPayload.structuredRdata.type log field value is equal to MR, then the network.dns.answers.type UDM field is set to 9.Else, if the jsonPayload.structuredRdata.type log field value is equal to NULL, then the network.dns.answers.type UDM field is set to 10.Else, if the jsonPayload.structuredRdata.type log field value is equal to WKS, then the network.dns.answers.type UDM field is set to 11.Else, if the jsonPayload.structuredRdata.type log field value is equal to PTR, then the network.dns.answers.type UDM field is set to 12.Else, if the jsonPayload.structuredRdata.type log field value is equal to HINFO, then the network.dns.answers.type UDM field is set to 13.Else, if the jsonPayload.structuredRdata.type log field value is equal to MINFO, then the network.dns.answers.type UDM field is set to 14.Else, if the jsonPayload.structuredRdata.type log field value is equal to MX, then the network.dns.answers.type UDM field is set to 15.Else, if the jsonPayload.structuredRdata.type log field value is equal to TXT, then the network.dns.answers.type UDM field is set to 16.Else, if the jsonPayload.structuredRdata.type log field value is equal to RP, then the network.dns.answers.type UDM field is set to 17.Else, if the jsonPayload.structuredRdata.type log field value is equal to AFSDB, then the network.dns.answers.type UDM field is set to 18.Else, if the jsonPayload.structuredRdata.type log field value is equal to X25, then the network.dns.answers.type UDM field is set to 19.Else, if the jsonPayload.structuredRdata.type log field value is equal to ISDN, then the network.dns.answers.type UDM field is set to 20.Else, if the jsonPayload.structuredRdata.type log field value is equal to RT, then the network.dns.answers.type UDM field is set to 21.Else, if the jsonPayload.structuredRdata.type log field value is equal to NSAP, then the network.dns.answers.type UDM field is set to 22.Else, if the jsonPayload.structuredRdata.type log field value is equal to NSAP-PTR, then the network.dns.answers.type UDM field is set to 23.Else, if the jsonPayload.structuredRdata.type log field value is equal to SIG, then the network.dns.answers.type UDM field is set to 24.Else, if the jsonPayload.structuredRdata.type log field value is equal to KEY, then the network.dns.answers.type UDM field is set to 25.Else, if the jsonPayload.structuredRdata.type log field value is equal to PX, then the network.dns.answers.type UDM field is set to 26.Else, if the jsonPayload.structuredRdata.type log field value is equal to GPOS, then the network.dns.answers.type UDM field is set to 27.Else, if the jsonPayload.structuredRdata.type log field value is equal to AAAA, then the network.dns.answers.type UDM field is set to 28.Else, if the jsonPayload.structuredRdata.type log field value is equal to LOC, then the network.dns.answers.type UDM field is set to 29.Else, if the jsonPayload.structuredRdata.type log field value is equal to NXT, then the network.dns.answers.type UDM field is set to 30.Else, if the jsonPayload.structuredRdata.type log field value is equal to EID, then the network.dns.answers.type UDM field is set to 31.Else, if the jsonPayload.structuredRdata.type log field value is equal to NIMLOC, then the network.dns.answers.type UDM field is set to 32.Else, if the jsonPayload.structuredRdata.type log field value is equal to SRV, then the network.dns.answers.type UDM field is set to 33.Else, if the jsonPayload.structuredRdata.type log field value is equal to ATMA, then the network.dns.answers.type UDM field is set to 34.Else, if the jsonPayload.structuredRdata.type log field value is equal to NAPTR, then the network.dns.answers.type UDM field is set to 35.Else, if the jsonPayload.structuredRdata.type log field value is equal to KX, then the network.dns.answers.type UDM field is set to 36.Else, if the jsonPayload.structuredRdata.type log field value is equal to CERT, then the network.dns.answers.type UDM field is set to 37.Else, if the jsonPayload.structuredRdata.type log field value is equal to A6, then the network.dns.answers.type UDM field is set to 38.Else, if the jsonPayload.structuredRdata.type log field value is equal to DNAME, then the network.dns.answers.type UDM field is set to 39.Else, if the jsonPayload.structuredRdata.type log field value is equal to SINK, then the network.dns.answers.type UDM field is set to 40.Else, if the jsonPayload.structuredRdata.type log field value is equal to OPT, then the network.dns.answers.type UDM field is set to 41.Else, if the jsonPayload.structuredRdata.type log field value is equal to APL, then the network.dns.answers.type UDM field is set to 42.Else, if the jsonPayload.structuredRdata.type log field value is equal to DS, then the network.dns.answers.type UDM field is set to 43.Else, if the jsonPayload.structuredRdata.type log field value is equal to SSHFP, then the network.dns.answers.type UDM field is set to 44.Else, if the jsonPayload.structuredRdata.type log field value is equal to IPSECKEY, then the network.dns.answers.type UDM field is set to 45.Else, if the jsonPayload.structuredRdata.type log field value is equal to RRSIG, then the network.dns.answers.type UDM field is set to 46.Else, if the jsonPayload.structuredRdata.type log field value is equal to NSEC, then the network.dns.answers.type UDM field is set to 47.Else, if the jsonPayload.structuredRdata.type log field value is equal to DNSKEY, then the network.dns.answers.type UDM field is set to 48.Else, if the jsonPayload.structuredRdata.type log field value is equal to DHCID, then the network.dns.answers.type UDM field is set to 49.Else, if the jsonPayload.structuredRdata.type log field value is equal to NSEC3, then the network.dns.answers.type UDM field is set to 50.Else, if the jsonPayload.structuredRdata.type log field value is equal to NSEC3PARAM, then the network.dns.answers.type UDM field is set to 51.Else, if the jsonPayload.structuredRdata.type log field value is equal to TLSA, then the network.dns.answers.type UDM field is set to 52.Else, if the jsonPayload.structuredRdata.type log field value is equal to SMIMEA, then the network.dns.answers.type UDM field is set to 53.Else, if the jsonPayload.structuredRdata.type log field value is equal to UNASSIGN, then the network.dns.answers.type UDM field is set to 54.Else, if the jsonPayload.structuredRdata.type log field value is equal to HIP, then the network.dns.answers.type UDM field is set to 55.Else, if the jsonPayload.structuredRdata.type log field value is equal to NINFO, then the network.dns.answers.type UDM field is set to 56.Else, if the jsonPayload.structuredRdata.type log field value is equal to RKEY, then the network.dns.answers.type UDM field is set to 57.Else, if the jsonPayload.structuredRdata.type log field value is equal to TALINK, then the network.dns.answers.type UDM field is set to 58.Else, if the jsonPayload.structuredRdata.type log field value is equal to CDS, then the network.dns.answers.type UDM field is set to 59.Else, if the jsonPayload.structuredRdata.type log field value is equal to CDNSKEY, then the network.dns.answers.type UDM field is set to 60.Else, if the jsonPayload.structuredRdata.type log field value is equal to OPENPGPK, then the network.dns.answers.type UDM field is set to 61.Else, if the jsonPayload.structuredRdata.type log field value is equal to CSYNC, then the network.dns.answers.type UDM field is set to 62.Else, if the jsonPayload.structuredRdata.type log field value is equal to ZONEMD, then the network.dns.answers.type UDM field is set to 63.Else, if the jsonPayload.structuredRdata.type log field value is equal to SVCB, then the network.dns.answers.type UDM field is set to 64.Else, if the jsonPayload.structuredRdata.type log field value is equal to HTTPS, then the network.dns.answers.type UDM field is set to 65.Else, if the jsonPayload.structuredRdata.type log field value is equal to SPF, then the network.dns.answers.type UDM field is set to 99.Else, if the jsonPayload.structuredRdata.type log field value is equal to UINFO, then the network.dns.answers.type UDM field is set to 100.Else, if the jsonPayload.structuredRdata.type log field value is equal to UID, then the network.dns.answers.type UDM field is set to 101.Else, if the jsonPayload.structuredRdata.type log field value is equal to GID, then the network.dns.answers.type UDM field is set to 102.Else, if the jsonPayload.structuredRdata.type log field value is equal to UNSPEC, then the network.dns.answers.type UDM field is set to 103.Else, if the jsonPayload.structuredRdata.type log field value is equal to NID, then the network.dns.answers.type UDM field is set to 104.Else, if the jsonPayload.structuredRdata.type log field value is equal to L32, then the network.dns.answers.type UDM field is set to 105.Else, if the jsonPayload.structuredRdata.type log field value is equal to L64, then the network.dns.answers.type UDM field is set to 106.Else, if the jsonPayload.structuredRdata.type log field value is equal to LP, then the network.dns.answers.type UDM field is set to 107.Else, if the jsonPayload.structuredRdata.type log field value is equal to EUI48, then the network.dns.answers.type UDM field is set to 108.Else, if the jsonPayload.structuredRdata.type log field value is equal to EUI64, then the network.dns.answers.type UDM field is set to 109.Else, if the jsonPayload.structuredRdata.type log field value is equal to TKEY, then the network.dns.answers.type UDM field is set to 249.Else, if the jsonPayload.structuredRdata.type log field value is equal to TSIG, then the network.dns.answers.type UDM field is set to 250.Else, if the jsonPayload.structuredRdata.type log field value is equal to IXFR, then the network.dns.answers.type UDM field is set to 251.Else, if the jsonPayload.structuredRdata.type log field value is equal to AXFR, then the network.dns.answers.type UDM field is set to 252.Else, if the jsonPayload.structuredRdata.type log field value is equal to MAILB, then the network.dns.answers.type UDM field is set to 253.Else, if the jsonPayload.structuredRdata.type log field value is equal to MAILA, then the network.dns.answers.type UDM field is set to 254.Else, if the jsonPayload.structuredRdata.type log field value is equal to ALL, then the network.dns.answers.type UDM field is set to 255.Else, if the jsonPayload.structuredRdata.type log field value is equal to URI, then the network.dns.answers.type UDM field is set to 256.Else, if the jsonPayload.structuredRdata.type log field value is equal to CAA, then the network.dns.answers.type UDM field is set to 257.Else, if the jsonPayload.structuredRdata.type log field value is equal to AVC, then the network.dns.answers.type UDM field is set to 258.Else, if the jsonPayload.structuredRdata.type log field value is equal to DOA, then the network.dns.answers.type UDM field is set to 259.Else, if the jsonPayload.structuredRdata.type log field value is equal to AMTRELAY, then the network.dns.answers.type UDM field is set to 260.Else, if the jsonPayload.structuredRdata.type log field value is equal to TA, then the network.dns.answers.type UDM field is set to 32768.Else, if the jsonPayload.structuredRdata.type log field value is equal to DLV, then the network.dns.answers.type UDM field is set to 32769. |
jsonPayload.rdata.type |
network.dns.answers.type |
If the jsonPayload.rdata.type log field value is equal to A, then the network.dns.answers.type UDM field is set to 1.Else, if the jsonPayload.rdata.type log field value is equal to NS, then the network.dns.answers.type UDM field is set to 2.Else, if the jsonPayload.rdata.type log field value is equal to MD, then the network.dns.answers.type UDM field is set to 3.Else, if the jsonPayload.rdata.type log field value is equal to MF, then the network.dns.answers.type UDM field is set to 4.Else, if the jsonPayload.rdata.type log field value is equal to CNAME, then the network.dns.answers.type UDM field is set to 5.Else, if the jsonPayload.rdata.type log field value is equal to SOA, then the network.dns.answers.type UDM field is set to 6.Else, if the jsonPayload.rdata.type log field value is equal to MB, then the network.dns.answers.type UDM field is set to 7.Else, if the jsonPayload.rdata.type log field value is equal to MG, then the network.dns.answers.type UDM field is set to 8.Else, if the jsonPayload.rdata.type log field value is equal to MR, then the network.dns.answers.type UDM field is set to 9.Else, if the jsonPayload.rdata.type log field value is equal to NULL, then the network.dns.answers.type UDM field is set to 10.Else, if the jsonPayload.rdata.type log field value is equal to WKS, then the network.dns.answers.type UDM field is set to 11.Else, if the jsonPayload.rdata.type log field value is equal to PTR, then the network.dns.answers.type UDM field is set to 12.Else, if the jsonPayload.rdata.type log field value is equal to HINFO, then the network.dns.answers.type UDM field is set to 13.Else, if the jsonPayload.rdata.type log field value is equal to MINFO, then the network.dns.answers.type UDM field is set to 14.Else, if the jsonPayload.rdata.type log field value is equal to MX, then the network.dns.answers.type UDM field is set to 15.Else, if the jsonPayload.rdata.type log field value is equal to TXT, then the network.dns.answers.type UDM field is set to 16.Else, if the jsonPayload.rdata.type log field value is equal to RP, then the network.dns.answers.type UDM field is set to 17.Else, if the jsonPayload.rdata.type log field value is equal to AFSDB, then the network.dns.answers.type UDM field is set to 18.Else, if the jsonPayload.rdata.type log field value is equal to X25, then the network.dns.answers.type UDM field is set to 19.Else, if the jsonPayload.rdata.type log field value is equal to ISDN, then the network.dns.answers.type UDM field is set to 20.Else, if the jsonPayload.rdata.type log field value is equal to RT, then the network.dns.answers.type UDM field is set to 21.Else, if the jsonPayload.rdata.type log field value is equal to NSAP, then the network.dns.answers.type UDM field is set to 22.Else, if the jsonPayload.rdata.type log field value is equal to NSAP-PTR, then the network.dns.answers.type UDM field is set to 23.Else, if the jsonPayload.rdata.type log field value is equal to SIG, then the network.dns.answers.type UDM field is set to 24.Else, if the jsonPayload.rdata.type log field value is equal to KEY, then the network.dns.answers.type UDM field is set to 25.Else, if the jsonPayload.rdata.type log field value is equal to PX, then the network.dns.answers.type UDM field is set to 26.Else, if the jsonPayload.rdata.type log field value is equal to GPOS, then the network.dns.answers.type UDM field is set to 27.Else, if the jsonPayload.rdata.type log field value is equal to AAAA, then the network.dns.answers.type UDM field is set to 28.Else, if the jsonPayload.rdata.type log field value is equal to LOC, then the network.dns.answers.type UDM field is set to 29.Else, if the jsonPayload.rdata.type log field value is equal to NXT, then the network.dns.answers.type UDM field is set to 30.Else, if the jsonPayload.rdata.type log field value is equal to EID, then the network.dns.answers.type UDM field is set to 31.Else, if the jsonPayload.rdata.type log field value is equal to NIMLOC, then the network.dns.answers.type UDM field is set to 32.Else, if the jsonPayload.rdata.type log field value is equal to SRV, then the network.dns.answers.type UDM field is set to 33.Else, if the jsonPayload.rdata.type log field value is equal to ATMA, then the network.dns.answers.type UDM field is set to 34.Else, if the jsonPayload.rdata.type log field value is equal to NAPTR, then the network.dns.answers.type UDM field is set to 35.Else, if the jsonPayload.rdata.type log field value is equal to KX, then the network.dns.answers.type UDM field is set to 36.Else, if the jsonPayload.rdata.type log field value is equal to CERT, then the network.dns.answers.type UDM field is set to 37.Else, if the jsonPayload.rdata.type log field value is equal to A6, then the network.dns.answers.type UDM field is set to 38.Else, if the jsonPayload.rdata.type log field value is equal to DNAME, then the network.dns.answers.type UDM field is set to 39.Else, if the jsonPayload.rdata.type log field value is equal to SINK, then the network.dns.answers.type UDM field is set to 40.Else, if the jsonPayload.rdata.type log field value is equal to OPT, then the network.dns.answers.type UDM field is set to 41.Else, if the jsonPayload.rdata.type log field value is equal to APL, then the network.dns.answers.type UDM field is set to 42.Else, if the jsonPayload.rdata.type log field value is equal to DS, then the network.dns.answers.type UDM field is set to 43.Else, if the jsonPayload.rdata.type log field value is equal to SSHFP, then the network.dns.answers.type UDM field is set to 44.Else, if the jsonPayload.rdata.type log field value is equal to IPSECKEY, then the network.dns.answers.type UDM field is set to 45.Else, if the jsonPayload.rdata.type log field value is equal to RRSIG, then the network.dns.answers.type UDM field is set to 46.Else, if the jsonPayload.rdata.type log field value is equal to NSEC, then the network.dns.answers.type UDM field is set to 47.Else, if the jsonPayload.rdata.type log field value is equal to DNSKEY, then the network.dns.answers.type UDM field is set to 48.Else, if the jsonPayload.rdata.type log field value is equal to DHCID, then the network.dns.answers.type UDM field is set to 49.Else, if the jsonPayload.rdata.type log field value is equal to NSEC3, then the network.dns.answers.type UDM field is set to 50.Else, if the jsonPayload.rdata.type log field value is equal to NSEC3PARAM, then the network.dns.answers.type UDM field is set to 51.Else, if the jsonPayload.rdata.type log field value is equal to TLSA, then the network.dns.answers.type UDM field is set to 52.Else, if the jsonPayload.rdata.type log field value is equal to SMIMEA, then the network.dns.answers.type UDM field is set to 53.Else, if the jsonPayload.rdata.type log field value is equal to UNASSIGN, then the network.dns.answers.type UDM field is set to 54.Else, if the jsonPayload.rdata.type log field value is equal to HIP, then the network.dns.answers.type UDM field is set to 55.Else, if the jsonPayload.rdata.type log field value is equal to NINFO, then the network.dns.answers.type UDM field is set to 56.Else, if the jsonPayload.rdata.type log field value is equal to RKEY, then the network.dns.answers.type UDM field is set to 57.Else, if the jsonPayload.rdata.type log field value is equal to TALINK, then the network.dns.answers.type UDM field is set to 58.Else, if the jsonPayload.rdata.type log field value is equal to CDS, then the network.dns.answers.type UDM field is set to 59.Else, if the jsonPayload.rdata.type log field value is equal to CDNSKEY, then the network.dns.answers.type UDM field is set to 60.Else, if the jsonPayload.rdata.type log field value is equal to OPENPGPK, then the network.dns.answers.type UDM field is set to 61.Else, if the jsonPayload.rdata.type log field value is equal to CSYNC, then the network.dns.answers.type UDM field is set to 62.Else, if the jsonPayload.rdata.type log field value is equal to ZONEMD, then the network.dns.answers.type UDM field is set to 63.Else, if the jsonPayload.rdata.type log field value is equal to SVCB, then the network.dns.answers.type UDM field is set to 64.Else, if the jsonPayload.rdata.type log field value is equal to HTTPS, then the network.dns.answers.type UDM field is set to 65.Else, if the jsonPayload.rdata.type log field value is equal to SPF, then the network.dns.answers.type UDM field is set to 99.Else, if the jsonPayload.rdata.type log field value is equal to UINFO, then the network.dns.answers.type UDM field is set to 100.Else, if the jsonPayload.rdata.type log field value is equal to UID, then the network.dns.answers.type UDM field is set to 101.Else, if the jsonPayload.rdata.type log field value is equal to GID, then the network.dns.answers.type UDM field is set to 102.Else, if the jsonPayload.rdata.type log field value is equal to UNSPEC, then the network.dns.answers.type UDM field is set to 103.Else, if the jsonPayload.rdata.type log field value is equal to NID, then the network.dns.answers.type UDM field is set to 104.Else, if the jsonPayload.rdata.type log field value is equal to L32, then the network.dns.answers.type UDM field is set to 105.Else, if the jsonPayload.rdata.type log field value is equal to L64, then the network.dns.answers.type UDM field is set to 106.Else, if the jsonPayload.rdata.type log field value is equal to LP, then the network.dns.answers.type UDM field is set to 107.Else, if the jsonPayload.rdata.type log field value is equal to EUI48, then the network.dns.answers.type UDM field is set to 108.Else, if the jsonPayload.rdata.type log field value is equal to EUI64, then the network.dns.answers.type UDM field is set to 109.Else, if the jsonPayload.rdata.type log field value is equal to TKEY, then the network.dns.answers.type UDM field is set to 249.Else, if the jsonPayload.rdata.type log field value is equal to TSIG, then the network.dns.answers.type UDM field is set to 250.Else, if the jsonPayload.rdata.type log field value is equal to IXFR, then the network.dns.answers.type UDM field is set to 251.Else, if the jsonPayload.rdata.type log field value is equal to AXFR, then the network.dns.answers.type UDM field is set to 252.Else, if the jsonPayload.rdata.type log field value is equal to MAILB, then the network.dns.answers.type UDM field is set to 253.Else, if the jsonPayload.rdata.type log field value is equal to MAILA, then the network.dns.answers.type UDM field is set to 254.Else, if the jsonPayload.rdata.type log field value is equal to ALL, then the network.dns.answers.type UDM field is set to 255.Else, if the jsonPayload.rdata.type log field value is equal to URI, then the network.dns.answers.type UDM field is set to 256.Else, if the jsonPayload.rdata.type log field value is equal to CAA, then the network.dns.answers.type UDM field is set to 257.Else, if the jsonPayload.rdata.type log field value is equal to AVC, then the network.dns.answers.type UDM field is set to 258.Else, if the jsonPayload.rdata.type log field value is equal to DOA, then the network.dns.answers.type UDM field is set to 259.Else, if the jsonPayload.rdata.type log field value is equal to AMTRELAY, then the network.dns.answers.type UDM field is set to 260.Else, if the jsonPayload.rdata.type log field value is equal to TA, then the network.dns.answers.type UDM field is set to 32768.Else, if the jsonPayload.rdata.type log field value is equal to DLV, then the network.dns.answers.type UDM field is set to 32769. |
jsonPayload.authAnswer |
network.dns.authoritative |
If the jsonPayload.authAnswer log field value is equal to true, then the network.dns.authoritative UDM field is set to test. |
jsonPayload.queryName |
network.dns.questions.name |
If the jsonPayload.queryName log field matches the regular expression pattern %{WORD:part1}%{GREEDYDATA}\\\\%{WORD}%{GREEDYDATA:part2}, then the extracted fields part1 and part2 are mapped to
the network.dns.questions.name UDM field.Else, if the jsonPayload.queryName log field matches the regular expression pattern (?P, then the extracted field domain is mapped to the network.dns.questions.name UDM field. |
jsonPayload.queryType |
network.dns.questions.type |
If the jsonPayload.queryType log field value is equal to A, then the network.dns.questions.type UDM field is set to 1.Else, if the jsonPayload.queryType log field value is equal to NS, then the network.dns.questions.type UDM field is set to 2.Else, if the jsonPayload.queryType log field value is equal to MD, then the network.dns.questions.type UDM field is set to 3.Else, if the jsonPayload.queryType log field value is equal to MF, then the network.dns.questions.type UDM field is set to 4.Else, if the jsonPayload.queryType log field value is equal to CNAME, then the network.dns.questions.type UDM field is set to 5.Else, if the jsonPayload.queryType log field value is equal to SOA, then the network.dns.questions.type UDM field is set to 6.Else, if the jsonPayload.queryType log field value is equal to MB, then the network.dns.questions.type UDM field is set to 7.Else, if the jsonPayload.queryType log field value is equal to MG, then the network.dns.questions.type UDM field is set to 8.Else, if the jsonPayload.queryType log field value is equal to MR, then the network.dns.questions.type UDM field is set to 9.Else, if the jsonPayload.queryType log field value is equal to NULL, then the network.dns.questions.type UDM field is set to 10.Else, if the jsonPayload.queryType log field value is equal to WKS, then the network.dns.questions.type UDM field is set to 11.Else, if the jsonPayload.queryType log field value is equal to PTR, then the network.dns.questions.type UDM field is set to 12.Else, if the jsonPayload.queryType log field value is equal to HINFO, then the network.dns.questions.type UDM field is set to 13.Else, if the jsonPayload.queryType log field value is equal to MINFO, then the network.dns.questions.type UDM field is set to 14.Else, if the jsonPayload.queryType log field value is equal to MX, then the network.dns.questions.type UDM field is set to 15.Else, if the jsonPayload.queryType log field value is equal to TXT, then the network.dns.questions.type UDM field is set to 16.Else, if the jsonPayload.queryType log field value is equal to RP, then the network.dns.questions.type UDM field is set to 17.Else, if the jsonPayload.queryType log field value is equal to AFSDB, then the network.dns.questions.type UDM field is set to 18.Else, if the jsonPayload.queryType log field value is equal to X25, then the network.dns.questions.type UDM field is set to 19.Else, if the jsonPayload.queryType log field value is equal to ISDN, then the network.dns.questions.type UDM field is set to 20.Else, if the jsonPayload.queryType log field value is equal to RT, then the network.dns.questions.type UDM field is set to 21.Else, if the jsonPayload.queryType log field value is equal to NSAP, then the network.dns.questions.type UDM field is set to 22.Else, if the jsonPayload.queryType log field value is equal to NSAP-PTR, then the network.dns.questions.type UDM field is set to 23.Else, if the jsonPayload.queryType log field value is equal to SIG, then the network.dns.questions.type UDM field is set to 24.Else, if the jsonPayload.queryType log field value is equal to KEY, then the network.dns.questions.type UDM field is set to 25.Else, if the jsonPayload.queryType log field value is equal to PX, then the network.dns.questions.type UDM field is set to 26.Else, if the jsonPayload.queryType log field value is equal to GPOS, then the network.dns.questions.type UDM field is set to 27.Else, if the jsonPayload.queryType log field value is equal to AAAA, then the network.dns.questions.type UDM field is set to 28.Else, if the jsonPayload.queryType log field value is equal to LOC, then the network.dns.questions.type UDM field is set to 29.Else, if the jsonPayload.queryType log field value is equal to NXT, then the network.dns.questions.type UDM field is set to 30.Else, if the jsonPayload.queryType log field value is equal to EID, then the network.dns.questions.type UDM field is set to 31.Else, if the jsonPayload.queryType log field value is equal to NIMLOC, then the network.dns.questions.type UDM field is set to 32.Else, if the jsonPayload.queryType log field value is equal to SRV, then the network.dns.questions.type UDM field is set to 33.Else, if the jsonPayload.queryType log field value is equal to ATMA, then the network.dns.questions.type UDM field is set to 34.Else, if the jsonPayload.queryType log field value is equal to NAPTR, then the network.dns.questions.type UDM field is set to 35.Else, if the jsonPayload.queryType log field value is equal to KX, then the network.dns.questions.type UDM field is set to 36.Else, if the jsonPayload.queryType log field value is equal to CERT, then the network.dns.questions.type UDM field is set to 37.Else, if the jsonPayload.queryType log field value is equal to A6, then the network.dns.questions.type UDM field is set to 38.Else, if the jsonPayload.queryType log field value is equal to DNAME, then the network.dns.questions.type UDM field is set to 39.Else, if the jsonPayload.queryType log field value is equal to SINK, then the network.dns.questions.type UDM field is set to 40.Else, if the jsonPayload.queryType log field value is equal to OPT, then the network.dns.questions.type UDM field is set to 41.Else, if the jsonPayload.queryType log field value is equal to APL, then the network.dns.questions.type UDM field is set to 42.Else, if the jsonPayload.queryType log field value is equal to DS, then the network.dns.questions.type UDM field is set to 43.Else, if the jsonPayload.queryType log field value is equal to SSHFP, then the network.dns.questions.type UDM field is set to 44.Else, if the jsonPayload.queryType log field value is equal to IPSECKEY, then the network.dns.questions.type UDM field is set to 45.Else, if the jsonPayload.queryType log field value is equal to RRSIG, then the network.dns.questions.type UDM field is set to 46.Else, if the jsonPayload.queryType log field value is equal to NSEC, then the network.dns.questions.type UDM field is set to 47.Else, if the jsonPayload.queryType log field value is equal to DNSKEY, then the network.dns.questions.type UDM field is set to 48.Else, if the jsonPayload.queryType log field value is equal to DHCID, then the network.dns.questions.type UDM field is set to 49.Else, if the jsonPayload.queryType log field value is equal to NSEC3, then the network.dns.questions.type UDM field is set to 50.Else, if the jsonPayload.queryType log field value is equal to NSEC3PARAM, then the network.dns.questions.type UDM field is set to 51.Else, if the jsonPayload.queryType log field value is equal to TLSA, then the network.dns.questions.type UDM field is set to 52.Else, if the jsonPayload.queryType log field value is equal to SMIMEA, then the network.dns.questions.type UDM field is set to 53.Else, if the jsonPayload.queryType log field value is equal to UNASSIGN, then the network.dns.questions.type UDM field is set to 54.Else, if the jsonPayload.queryType log field value is equal to HIP, then the network.dns.questions.type UDM field is set to 55.Else, if the jsonPayload.queryType log field value is equal to NINFO, then the network.dns.questions.type UDM field is set to 56.Else, if the jsonPayload.queryType log field value is equal to RKEY, then the network.dns.questions.type UDM field is set to 57.Else, if the jsonPayload.queryType log field value is equal to TALINK, then the network.dns.questions.type UDM field is set to 58.Else, if the jsonPayload.queryType log field value is equal to CDS, then the network.dns.questions.type UDM field is set to 59.Else, if the jsonPayload.queryType log field value is equal to CDNSKEY, then the network.dns.questions.type UDM field is set to 60.Else, if the jsonPayload.queryType log field value is equal to OPENPGPK, then the network.dns.questions.type UDM field is set to 61.Else, if the jsonPayload.queryType log field value is equal to CSYNC, then the network.dns.questions.type UDM field is set to 62.Else, if the jsonPayload.queryType log field value is equal to ZONEMD, then the network.dns.questions.type UDM field is set to 63.Else, if the jsonPayload.queryType log field value is equal to SVCB, then the network.dns.questions.type UDM field is set to 64.Else, if the jsonPayload.queryType log field value is equal to HTTPS, then the network.dns.questions.type UDM field is set to 65.Else, if the jsonPayload.queryType log field value is equal to SPF, then the network.dns.questions.type UDM field is set to 99.Else, if the jsonPayload.queryType log field value is equal to UINFO, then the network.dns.questions.type UDM field is set to 100.Else, if the jsonPayload.queryType log field value is equal to UID, then the network.dns.questions.type UDM field is set to 101.Else, if the jsonPayload.queryType log field value is equal to GID, then the network.dns.questions.type UDM field is set to 102.Else, if the jsonPayload.queryType log field value is equal to UNSPEC, then the network.dns.questions.type UDM field is set to 103.Else, if the jsonPayload.queryType log field value is equal to NID, then the network.dns.questions.type UDM field is set to 104.Else, if the jsonPayload.queryType log field value is equal to L32, then the network.dns.questions.type UDM field is set to 105.Else, if the jsonPayload.queryType log field value is equal to L64, then the network.dns.questions.type UDM field is set to 106.Else, if the jsonPayload.queryType log field value is equal to LP, then the network.dns.questions.type UDM field is set to 107.Else, if the jsonPayload.queryType log field value is equal to EUI48, then the network.dns.questions.type UDM field is set to 108.Else, if the jsonPayload.queryType log field value is equal to EUI64, then the network.dns.questions.type UDM field is set to 109.Else, if the jsonPayload.queryType log field value is equal to TKEY, then the network.dns.questions.type UDM field is set to 249.Else, if the jsonPayload.queryType log field value is equal to TSIG, then the network.dns.questions.type UDM field is set to 250.Else, if the jsonPayload.queryType log field value is equal to IXFR, then the network.dns.questions.type UDM field is set to 251.Else, if the jsonPayload.queryType log field value is equal to AXFR, then the network.dns.questions.type UDM field is set to 252.Else, if the jsonPayload.queryType log field value is equal to MAILB, then the network.dns.questions.type UDM field is set to 253.Else, if the jsonPayload.queryType log field value is equal to MAILA, then the network.dns.questions.type UDM field is set to 254.Else, if the jsonPayload.queryType log field value is equal to ALL, then the network.dns.questions.type UDM field is set to 255.Else, if the jsonPayload.queryType log field value is equal to URI, then the network.dns.questions.type UDM field is set to 256.Else, if the jsonPayload.queryType log field value is equal to CAA, then the network.dns.questions.type UDM field is set to 257.Else, if the jsonPayload.queryType log field value is equal to AVC, then the network.dns.questions.type UDM field is set to 258.Else, if the jsonPayload.queryType log field value is equal to DOA, then the network.dns.questions.type UDM field is set to 259.Else, if the jsonPayload.queryType log field value is equal to AMTRELAY, then the network.dns.questions.type UDM field is set to 260.Else, if the jsonPayload.queryType log field value is equal to TA, then the network.dns.questions.type UDM field is set to 32768.Else, if the jsonPayload.queryType log field value is equal to DLV, then the network.dns.questions.type UDM field is set to 32769. |
jsonPayload.responseCode |
network.dns.response_code |
If the jsonPayload.responseCode log field value is equal to FORMERR, then the network.dns.response_code UDM field is set to 1.Else, if the jsonPayload.responseCode log field value is equal to SERVFAIL, then the network.dns.response_code UDM field is set to 2.Else, if the jsonPayload.responseCode log field value is equal to NXDOMAIN, then the network.dns.response_code UDM field is set to 3.Else, if the jsonPayload.responseCode log field value is equal to NOTIMP, then the network.dns.response_code UDM field is set to 4.Else, if the jsonPayload.responseCode log field value is equal to REFUSED, then the network.dns.response_code UDM field is set to 5.Else, if the jsonPayload.responseCode log field value is equal to YXDOMAIN, then the network.dns.response_code UDM field is set to 6.Else, if the jsonPayload.responseCode log field value is equal to YXRRSET, then the network.dns.response_code UDM field is set to 7.Else, if the jsonPayload.responseCode log field value is equal to NXRRSET, then the network.dns.response_code UDM field is set to 8.Else, if the jsonPayload.responseCode log field value is equal to NOTAUTH, then the network.dns.response_code UDM field is set to 9.Else, if the jsonPayload.responseCode log field value is equal to NOTZONE, then the network.dns.response_code UDM field is set to 10.Else, if the jsonPayload.responseCode log field value is equal to DSOTYPENI, then the network.dns.response_code UDM field is set to 11.Else, if the jsonPayload.responseCode log field value is equal to BADVERS, then the network.dns.response_code UDM field is set to 16.Else, if the jsonPayload.responseCode log field value is equal to BADSIG, then the network.dns.response_code UDM field is set to 16.Else, if the jsonPayload.responseCode log field value is equal to BADKEY, then the network.dns.response_code UDM field is set to 17.Else, if the jsonPayload.responseCode log field value is equal to BADTIME, then the network.dns.response_code UDM field is set to 18.Else, if the jsonPayload.responseCode log field value is equal to BADMODE, then the network.dns.response_code UDM field is set to 19.Else, if the jsonPayload.responseCode log field value is equal to BADNAME, then the network.dns.response_code UDM field is set to 20.Else, if the jsonPayload.responseCode log field value is equal to BADALG, then the network.dns.response_code UDM field is set to 21.Else, if the jsonPayload.responseCode log field value is equal to BADTRUNC, then the network.dns.response_code UDM field is set to 22.Else, if the jsonPayload.responseCode log field value is equal to BADCOOKIE, then the network.dns.response_code UDM field is set to 23. |
network.dns.truncated |
If the jsonPayload.rdata log field value is not empty, then the network.dns.truncated UDM field is set to true. |
|
jsonPayload.protocol |
network.ip_protocol |
If the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ICMP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IGMP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to TCP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to UDP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IP6IN4.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to GRE.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ESP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to EIGRP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ETHERIP.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to PIM.
jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to VRRP.
|
jsonPayload.sourceIP |
principal.ip |
|
jsonPayload.sourceNetwork |
principal.namespace |
If the jsonPayload.vmProjectId log field value is not empty and the jsonPayload.sourceNetwork log field value is not empty, then the %{jsonPayload.vmProjectId}:%{jsonPayload.sourceNetwork} log field is mapped to the principal.namespace UDM field.Else, if the resource.labels.project_id log field value is not empty and the jsonPayload.sourceNetwork log field value is not empty, then the %{resource.labels.project_id}:%{jsonPayload.sourceNetwork} log field is mapped to the principal.namespace UDM field.Else, if the jsonPayload.sourceNetwork log field value is not empty, then the jsonPayload.sourceNetwork log field is mapped to the principal.namespace UDM field. |
resource.labels.location |
principal.location.name |
|
jsonPayload.vmZoneName |
principal.resource.attribute.cloud.availability_zone |
|
principal.resource.attribute.cloud.environment |
The principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM. |
|
principal.cloud.environment |
The principal.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM. |
|
resource.labels.source_type |
principal.resource.attribute.labels[source_type] |
|
resource.labels.target_name |
principal.resource.attribute.labels[target_name] |
|
resource.labels.target_type |
principal.resource.attribute.labels[target_type] |
|
jsonPayload.vmInstanceName |
principal.resource.name |
Extracted projectororg from the logName log field using the Grok pattern.If the jsonPayload.vmInstanceName log field value is not empty, then the //compute.googleapis.com/projects/%{projectororg}/zones/%{resource.labels.location}/instances/%{jsonPayload.vmInstanceName} field is mapped to the principal.resource.name UDM field. |
logName |
principal.resource.name |
Extracted projectororg from the logName log field using the Grok pattern. |
jsonPayload.vmInstanceIdString |
principal.resource.id |
If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.id UDM field.Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.id UDM field. |
jsonPayload.vmInstanceId |
principal.resource.id |
If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.id UDM field.Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.id UDM field. |
jsonPayload.vmInstanceIdString |
principal.resource.product_object_id |
If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.product_object_id UDM field.Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.product_object_id UDM field. |
jsonPayload.vmInstanceId |
principal.resource.product_object_id |
If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.product_object_id UDM field.Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.product_object_id UDM field. |
jsonPayload.vmProjectId |
principal.cloud.project.name |
If the jsonPayload.vmProjectId log field value is not empty, then the jsonPayload.vmProjectId log field is mapped to the principal.cloud.project.name UDM field. |
resource.labels.project_id |
principal.cloud.project.name |
If the jsonPayload.vmProjectId log field value is empty, then the resource.labels.project_id log field is mapped to the principal.cloud.project.name UDM field. |
jsonPayload.vmProjectId |
principal.resource_ancestors.name |
|
resource.labels.project_id |
principal.resource_ancestors.name |
|
principal.resource_ancestors.resource_subtype |
If the jsonPayload.vmProjectId log field value is not empty, then the principal.resource_ancestors.resource_subtype UDM field is set to Virtual Machine Project.If the resource.labels.project_id log field value is not empty, then the principal.resource_ancestors.resource_subtype UDM field is set to Project. |
|
principal.resource_ancestors.resource_type |
If the jsonPayload.vmProjectId log field value is not empty, then the principal.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.If the resource.labels.project_id log field value is not empty, then the principal.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT. |
|
resource.type |
principal.resource.resource_subtype |
|
principal.resource.resource_type |
The principal.resource.resource_type UDM field is set to VIRTUAL_MACHINE. |
|
security_result.severity |
If the severity log field value contains one of the following values, then the security_result.severity UDM field is set to INFORMATIONAL.
severity log field value is equal to NOTICE, then the security_result.severity UDM field is set to LOW.Else, if the severity log field value is equal to WARNING, then the security_result.severity UDM field is set to MEDIUM.Else, if the severity log field value is equal to ERROR, then the security_result.severity UDM field is set to ERROR.Else, if the severity log field value contains one of the following values, then the security_result.severity UDM field is set to CRITICAL and the is_alert UDM field is set to true and the is_significant UDM field is set to true.
severity log field value is equal to DEFAULT or the severity log field value is not empty, then the security_result.severity UDM field is set to UNKNOWN_SEVERITY. |
|
severity |
security_result.severity_details |
|
jsonPayload.destinationIP |
target.ip |
|
target.resource.attribute.cloud.environment |
The target.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM. |