Google Cloud DNS 로그 수집

이 문서에서는 Google Security Operations에 Google Cloud 원격 분석 수집을 사용 설정하여 Google Cloud DNS 로그를 수집하는 방법과 Google Cloud DNS 로그의 로그 필드가 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑되는 방식을 설명합니다. 이 문서에서는 지원되는 Google Cloud DNS 버전도 보여줍니다.

자세한 내용은 Google Security Operations에 데이터 수집을 참조하세요.

일반적인 배포는 Google Security Operations에 수집을 위해 사용 설정된 Google Cloud DNS 로그로 구성됩니다. 각 고객 배포는 이 표현과 다를 수 있고 더 복잡할 수 있습니다.

배포에는 다음 구성요소가 포함됩니다.

• Google Cloud: 로그를 수집하는 Google Cloud 서비스 및 제품입니다.

• Google Cloud DNS 로그: Google Security Operations에 수집을 위해 사용 설정된 Google Cloud DNS 로그입니다.

• Google Security Operations: Google Security Operations는 Google Cloud DNS의 로그를 보관하고 분석합니다.

수집 라벨은 원시 로그 데이터를 구조화된 UDM 형식으로 정규화하는 파서를 식별합니다. 이 문서의 정보는 GCP_DNS 수집 라벨이 있는 파서에 적용됩니다.

시작하기 전에

• Google Cloud DNS 버전 1을 사용 중인지 확인합니다.

• 배포 아키텍처의 모든 시스템이 UTC 시간대로 구성되었는지 확인합니다.

Google Cloud DNS 로그를 수집하도록 Google Cloud 구성

Google Cloud DNS 로그를 Google Security Operations에 수집하려면 Google Security Operations에 Google Cloud 로그 수집 페이지의 단계를 수행합니다.

Google Cloud DNS 로그를 수집할 때 문제가 발생하면 Google Security Operations 지원팀에 문의하세요.

필드 매핑 참조

이 섹션에서는 Google Security Operations 파서가 Google Cloud DNS 필드를 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑하는 방법을 설명합니다.

지원 중단됨:

UDM 명사의 labels 필드인 about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels, target.labels가 지원 중단되었습니다. 기존 파서의 경우 이러한 UDM 필드 외에도 로그 필드가 키/값 additional.fields UDM 필드에 매핑됩니다. 새 파서의 경우 지원 중단된 labels UDM 필드 대신 additional.fields UDM 필드의 키-값 설정이 사용됩니다. 지원 중단된 labels UDM 필드 대신 additional.fields UDM 필드에서 키-값 설정을 사용하도록 기존 규칙을 업데이트하는 것이 좋습니다.

Log field	UDM mapping	Logic
alias_query_response_code	about.labels[alias_query_response_code] (deprecated)
alias_query_response_code	additional.fields[alias_query_response_code]
egressError	about.labels[egress_error] (deprecated)
egressError	additional.fields[egress_error]
healthyIps	about.ip
jsonPayload.serverLatency	about.labels[server_latency] (deprecated)
jsonPayload.serverLatency	additional.fields[server_latency]
unHealthyIps	about.labels[un_healthy_ips] (deprecated)
unHealthyIps	additional.fields[un_healthy_ips]
jsonPayload.responseCode	additional.fields[response_code]
jsonPayload.egressIP	intermediary.ip
receiveTimestamp	metadata.collected_timestamp
timestamp	metadata.event_timestamp
	metadata.event_type	If the jsonPayload.sourceIP log field value is not empty and the jsonPayload.queryName log field value is not empty or does not contain an end period (.), then the metadata.event_type UDM field is set to NETWORK_DNS. Else, if the jsonPayload.sourceIP log field value is not empty and the jsonPayload.queryName log field value is not empty or does not contain an end period (.), then the metadata.event_type UDM field is set to STATUS_UPDATE. Else, the metadata.event_type UDM field is set to GENERIC_EVENT.
insertId	metadata.product_log_id
	metadata.product_name	The metadata.product_name UDM field is set to Google Cloud DNS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Google Cloud Platform.
resource.type	metadata.description
	network.application_protocol	The network.application_protocol UDM field is set to DNS.
jsonPayload.structuredRdata.class	network.dns.answers.class	If the jsonPayload.structuredRdata.class log field value is equal to IN, then the network.dns.answers.class UDM field is set to 1. Else, if the jsonPayload.structuredRdata.class log field value is equal to CH, then the network.dns.answers.class UDM field is set to 3. Else, if the jsonPayload.structuredRdata.class log field value is equal to HS, then the network.dns.answers.class UDM field is set to 4.
jsonPayload.rdata.class	network.dns.answers.class	If the jsonPayload.rdata.class log field value is equal to IN, then the network.dns.answers.class UDM field is set to 1. Else, if the jsonPayload.rdata.class log field value is equal to CH, then the network.dns.answers.class UDM field is set to 3. Else, if the jsonPayload.rdata.class log field value is equal to HS, then the network.dns.answers.class UDM field is set to 4.
jsonPayload.structuredRdata.rvalue	network.dns.answers.data
jsonPayload.rdata.data	network.dns.answers.data
jsonPayload.structuredRdata.domainName	network.dns.answers.name	Extracted domainName from the jsonPayload.structuredRdata.domainName log field using the Grok pattern and mapped to the network.dns.answers.name UDM field.
jsonPayload.rdata.name	network.dns.answers.name	Extracted domainName from the jsonPayload.rdata.name log field using the Grok pattern and mapped to the network.dns.answers.name UDM field.
jsonPayload.structuredRdata.ttl	network.dns.answers.ttl
jsonPayload.rdata.ttl	network.dns.answers.ttl
jsonPayload.structuredRdata.type	network.dns.answers.type	If the jsonPayload.structuredRdata.type log field value is equal to A, then the network.dns.answers.type UDM field is set to 1. Else, if the jsonPayload.structuredRdata.type log field value is equal to NS, then the network.dns.answers.type UDM field is set to 2. Else, if the jsonPayload.structuredRdata.type log field value is equal to MD, then the network.dns.answers.type UDM field is set to 3. Else, if the jsonPayload.structuredRdata.type log field value is equal to MF, then the network.dns.answers.type UDM field is set to 4. Else, if the jsonPayload.structuredRdata.type log field value is equal to CNAME, then the network.dns.answers.type UDM field is set to 5. Else, if the jsonPayload.structuredRdata.type log field value is equal to SOA, then the network.dns.answers.type UDM field is set to 6. Else, if the jsonPayload.structuredRdata.type log field value is equal to MB, then the network.dns.answers.type UDM field is set to 7. Else, if the jsonPayload.structuredRdata.type log field value is equal to MG, then the network.dns.answers.type UDM field is set to 8. Else, if the jsonPayload.structuredRdata.type log field value is equal to MR, then the network.dns.answers.type UDM field is set to 9. Else, if the jsonPayload.structuredRdata.type log field value is equal to NULL, then the network.dns.answers.type UDM field is set to 10. Else, if the jsonPayload.structuredRdata.type log field value is equal to WKS, then the network.dns.answers.type UDM field is set to 11. Else, if the jsonPayload.structuredRdata.type log field value is equal to PTR, then the network.dns.answers.type UDM field is set to 12. Else, if the jsonPayload.structuredRdata.type log field value is equal to HINFO, then the network.dns.answers.type UDM field is set to 13. Else, if the jsonPayload.structuredRdata.type log field value is equal to MINFO, then the network.dns.answers.type UDM field is set to 14. Else, if the jsonPayload.structuredRdata.type log field value is equal to MX, then the network.dns.answers.type UDM field is set to 15. Else, if the jsonPayload.structuredRdata.type log field value is equal to TXT, then the network.dns.answers.type UDM field is set to 16. Else, if the jsonPayload.structuredRdata.type log field value is equal to RP, then the network.dns.answers.type UDM field is set to 17. Else, if the jsonPayload.structuredRdata.type log field value is equal to AFSDB, then the network.dns.answers.type UDM field is set to 18. Else, if the jsonPayload.structuredRdata.type log field value is equal to X25, then the network.dns.answers.type UDM field is set to 19. Else, if the jsonPayload.structuredRdata.type log field value is equal to ISDN, then the network.dns.answers.type UDM field is set to 20. Else, if the jsonPayload.structuredRdata.type log field value is equal to RT, then the network.dns.answers.type UDM field is set to 21. Else, if the jsonPayload.structuredRdata.type log field value is equal to NSAP, then the network.dns.answers.type UDM field is set to 22. Else, if the jsonPayload.structuredRdata.type log field value is equal to NSAP-PTR, then the network.dns.answers.type UDM field is set to 23. Else, if the jsonPayload.structuredRdata.type log field value is equal to SIG, then the network.dns.answers.type UDM field is set to 24. Else, if the jsonPayload.structuredRdata.type log field value is equal to KEY, then the network.dns.answers.type UDM field is set to 25. Else, if the jsonPayload.structuredRdata.type log field value is equal to PX, then the network.dns.answers.type UDM field is set to 26. Else, if the jsonPayload.structuredRdata.type log field value is equal to GPOS, then the network.dns.answers.type UDM field is set to 27. Else, if the jsonPayload.structuredRdata.type log field value is equal to AAAA, then the network.dns.answers.type UDM field is set to 28. Else, if the jsonPayload.structuredRdata.type log field value is equal to LOC, then the network.dns.answers.type UDM field is set to 29. Else, if the jsonPayload.structuredRdata.type log field value is equal to NXT, then the network.dns.answers.type UDM field is set to 30. Else, if the jsonPayload.structuredRdata.type log field value is equal to EID, then the network.dns.answers.type UDM field is set to 31. Else, if the jsonPayload.structuredRdata.type log field value is equal to NIMLOC, then the network.dns.answers.type UDM field is set to 32. Else, if the jsonPayload.structuredRdata.type log field value is equal to SRV, then the network.dns.answers.type UDM field is set to 33. Else, if the jsonPayload.structuredRdata.type log field value is equal to ATMA, then the network.dns.answers.type UDM field is set to 34. Else, if the jsonPayload.structuredRdata.type log field value is equal to NAPTR, then the network.dns.answers.type UDM field is set to 35. Else, if the jsonPayload.structuredRdata.type log field value is equal to KX, then the network.dns.answers.type UDM field is set to 36. Else, if the jsonPayload.structuredRdata.type log field value is equal to CERT, then the network.dns.answers.type UDM field is set to 37. Else, if the jsonPayload.structuredRdata.type log field value is equal to A6, then the network.dns.answers.type UDM field is set to 38. Else, if the jsonPayload.structuredRdata.type log field value is equal to DNAME, then the network.dns.answers.type UDM field is set to 39. Else, if the jsonPayload.structuredRdata.type log field value is equal to SINK, then the network.dns.answers.type UDM field is set to 40. Else, if the jsonPayload.structuredRdata.type log field value is equal to OPT, then the network.dns.answers.type UDM field is set to 41. Else, if the jsonPayload.structuredRdata.type log field value is equal to APL, then the network.dns.answers.type UDM field is set to 42. Else, if the jsonPayload.structuredRdata.type log field value is equal to DS, then the network.dns.answers.type UDM field is set to 43. Else, if the jsonPayload.structuredRdata.type log field value is equal to SSHFP, then the network.dns.answers.type UDM field is set to 44. Else, if the jsonPayload.structuredRdata.type log field value is equal to IPSECKEY, then the network.dns.answers.type UDM field is set to 45. Else, if the jsonPayload.structuredRdata.type log field value is equal to RRSIG, then the network.dns.answers.type UDM field is set to 46. Else, if the jsonPayload.structuredRdata.type log field value is equal to NSEC, then the network.dns.answers.type UDM field is set to 47. Else, if the jsonPayload.structuredRdata.type log field value is equal to DNSKEY, then the network.dns.answers.type UDM field is set to 48. Else, if the jsonPayload.structuredRdata.type log field value is equal to DHCID, then the network.dns.answers.type UDM field is set to 49. Else, if the jsonPayload.structuredRdata.type log field value is equal to NSEC3, then the network.dns.answers.type UDM field is set to 50. Else, if the jsonPayload.structuredRdata.type log field value is equal to NSEC3PARAM, then the network.dns.answers.type UDM field is set to 51. Else, if the jsonPayload.structuredRdata.type log field value is equal to TLSA, then the network.dns.answers.type UDM field is set to 52. Else, if the jsonPayload.structuredRdata.type log field value is equal to SMIMEA, then the network.dns.answers.type UDM field is set to 53. Else, if the jsonPayload.structuredRdata.type log field value is equal to UNASSIGN, then the network.dns.answers.type UDM field is set to 54. Else, if the jsonPayload.structuredRdata.type log field value is equal to HIP, then the network.dns.answers.type UDM field is set to 55. Else, if the jsonPayload.structuredRdata.type log field value is equal to NINFO, then the network.dns.answers.type UDM field is set to 56. Else, if the jsonPayload.structuredRdata.type log field value is equal to RKEY, then the network.dns.answers.type UDM field is set to 57. Else, if the jsonPayload.structuredRdata.type log field value is equal to TALINK, then the network.dns.answers.type UDM field is set to 58. Else, if the jsonPayload.structuredRdata.type log field value is equal to CDS, then the network.dns.answers.type UDM field is set to 59. Else, if the jsonPayload.structuredRdata.type log field value is equal to CDNSKEY, then the network.dns.answers.type UDM field is set to 60. Else, if the jsonPayload.structuredRdata.type log field value is equal to OPENPGPK, then the network.dns.answers.type UDM field is set to 61. Else, if the jsonPayload.structuredRdata.type log field value is equal to CSYNC, then the network.dns.answers.type UDM field is set to 62. Else, if the jsonPayload.structuredRdata.type log field value is equal to ZONEMD, then the network.dns.answers.type UDM field is set to 63. Else, if the jsonPayload.structuredRdata.type log field value is equal to SVCB, then the network.dns.answers.type UDM field is set to 64. Else, if the jsonPayload.structuredRdata.type log field value is equal to HTTPS, then the network.dns.answers.type UDM field is set to 65. Else, if the jsonPayload.structuredRdata.type log field value is equal to SPF, then the network.dns.answers.type UDM field is set to 99. Else, if the jsonPayload.structuredRdata.type log field value is equal to UINFO, then the network.dns.answers.type UDM field is set to 100. Else, if the jsonPayload.structuredRdata.type log field value is equal to UID, then the network.dns.answers.type UDM field is set to 101. Else, if the jsonPayload.structuredRdata.type log field value is equal to GID, then the network.dns.answers.type UDM field is set to 102. Else, if the jsonPayload.structuredRdata.type log field value is equal to UNSPEC, then the network.dns.answers.type UDM field is set to 103. Else, if the jsonPayload.structuredRdata.type log field value is equal to NID, then the network.dns.answers.type UDM field is set to 104. Else, if the jsonPayload.structuredRdata.type log field value is equal to L32, then the network.dns.answers.type UDM field is set to 105. Else, if the jsonPayload.structuredRdata.type log field value is equal to L64, then the network.dns.answers.type UDM field is set to 106. Else, if the jsonPayload.structuredRdata.type log field value is equal to LP, then the network.dns.answers.type UDM field is set to 107. Else, if the jsonPayload.structuredRdata.type log field value is equal to EUI48, then the network.dns.answers.type UDM field is set to 108. Else, if the jsonPayload.structuredRdata.type log field value is equal to EUI64, then the network.dns.answers.type UDM field is set to 109. Else, if the jsonPayload.structuredRdata.type log field value is equal to TKEY, then the network.dns.answers.type UDM field is set to 249. Else, if the jsonPayload.structuredRdata.type log field value is equal to TSIG, then the network.dns.answers.type UDM field is set to 250. Else, if the jsonPayload.structuredRdata.type log field value is equal to IXFR, then the network.dns.answers.type UDM field is set to 251. Else, if the jsonPayload.structuredRdata.type log field value is equal to AXFR, then the network.dns.answers.type UDM field is set to 252. Else, if the jsonPayload.structuredRdata.type log field value is equal to MAILB, then the network.dns.answers.type UDM field is set to 253. Else, if the jsonPayload.structuredRdata.type log field value is equal to MAILA, then the network.dns.answers.type UDM field is set to 254. Else, if the jsonPayload.structuredRdata.type log field value is equal to ALL, then the network.dns.answers.type UDM field is set to 255. Else, if the jsonPayload.structuredRdata.type log field value is equal to URI, then the network.dns.answers.type UDM field is set to 256. Else, if the jsonPayload.structuredRdata.type log field value is equal to CAA, then the network.dns.answers.type UDM field is set to 257. Else, if the jsonPayload.structuredRdata.type log field value is equal to AVC, then the network.dns.answers.type UDM field is set to 258. Else, if the jsonPayload.structuredRdata.type log field value is equal to DOA, then the network.dns.answers.type UDM field is set to 259. Else, if the jsonPayload.structuredRdata.type log field value is equal to AMTRELAY, then the network.dns.answers.type UDM field is set to 260. Else, if the jsonPayload.structuredRdata.type log field value is equal to TA, then the network.dns.answers.type UDM field is set to 32768. Else, if the jsonPayload.structuredRdata.type log field value is equal to DLV, then the network.dns.answers.type UDM field is set to 32769.
jsonPayload.rdata.type	network.dns.answers.type	If the jsonPayload.rdata.type log field value is equal to A, then the network.dns.answers.type UDM field is set to 1. Else, if the jsonPayload.rdata.type log field value is equal to NS, then the network.dns.answers.type UDM field is set to 2. Else, if the jsonPayload.rdata.type log field value is equal to MD, then the network.dns.answers.type UDM field is set to 3. Else, if the jsonPayload.rdata.type log field value is equal to MF, then the network.dns.answers.type UDM field is set to 4. Else, if the jsonPayload.rdata.type log field value is equal to CNAME, then the network.dns.answers.type UDM field is set to 5. Else, if the jsonPayload.rdata.type log field value is equal to SOA, then the network.dns.answers.type UDM field is set to 6. Else, if the jsonPayload.rdata.type log field value is equal to MB, then the network.dns.answers.type UDM field is set to 7. Else, if the jsonPayload.rdata.type log field value is equal to MG, then the network.dns.answers.type UDM field is set to 8. Else, if the jsonPayload.rdata.type log field value is equal to MR, then the network.dns.answers.type UDM field is set to 9. Else, if the jsonPayload.rdata.type log field value is equal to NULL, then the network.dns.answers.type UDM field is set to 10. Else, if the jsonPayload.rdata.type log field value is equal to WKS, then the network.dns.answers.type UDM field is set to 11. Else, if the jsonPayload.rdata.type log field value is equal to PTR, then the network.dns.answers.type UDM field is set to 12. Else, if the jsonPayload.rdata.type log field value is equal to HINFO, then the network.dns.answers.type UDM field is set to 13. Else, if the jsonPayload.rdata.type log field value is equal to MINFO, then the network.dns.answers.type UDM field is set to 14. Else, if the jsonPayload.rdata.type log field value is equal to MX, then the network.dns.answers.type UDM field is set to 15. Else, if the jsonPayload.rdata.type log field value is equal to TXT, then the network.dns.answers.type UDM field is set to 16. Else, if the jsonPayload.rdata.type log field value is equal to RP, then the network.dns.answers.type UDM field is set to 17. Else, if the jsonPayload.rdata.type log field value is equal to AFSDB, then the network.dns.answers.type UDM field is set to 18. Else, if the jsonPayload.rdata.type log field value is equal to X25, then the network.dns.answers.type UDM field is set to 19. Else, if the jsonPayload.rdata.type log field value is equal to ISDN, then the network.dns.answers.type UDM field is set to 20. Else, if the jsonPayload.rdata.type log field value is equal to RT, then the network.dns.answers.type UDM field is set to 21. Else, if the jsonPayload.rdata.type log field value is equal to NSAP, then the network.dns.answers.type UDM field is set to 22. Else, if the jsonPayload.rdata.type log field value is equal to NSAP-PTR, then the network.dns.answers.type UDM field is set to 23. Else, if the jsonPayload.rdata.type log field value is equal to SIG, then the network.dns.answers.type UDM field is set to 24. Else, if the jsonPayload.rdata.type log field value is equal to KEY, then the network.dns.answers.type UDM field is set to 25. Else, if the jsonPayload.rdata.type log field value is equal to PX, then the network.dns.answers.type UDM field is set to 26. Else, if the jsonPayload.rdata.type log field value is equal to GPOS, then the network.dns.answers.type UDM field is set to 27. Else, if the jsonPayload.rdata.type log field value is equal to AAAA, then the network.dns.answers.type UDM field is set to 28. Else, if the jsonPayload.rdata.type log field value is equal to LOC, then the network.dns.answers.type UDM field is set to 29. Else, if the jsonPayload.rdata.type log field value is equal to NXT, then the network.dns.answers.type UDM field is set to 30. Else, if the jsonPayload.rdata.type log field value is equal to EID, then the network.dns.answers.type UDM field is set to 31. Else, if the jsonPayload.rdata.type log field value is equal to NIMLOC, then the network.dns.answers.type UDM field is set to 32. Else, if the jsonPayload.rdata.type log field value is equal to SRV, then the network.dns.answers.type UDM field is set to 33. Else, if the jsonPayload.rdata.type log field value is equal to ATMA, then the network.dns.answers.type UDM field is set to 34. Else, if the jsonPayload.rdata.type log field value is equal to NAPTR, then the network.dns.answers.type UDM field is set to 35. Else, if the jsonPayload.rdata.type log field value is equal to KX, then the network.dns.answers.type UDM field is set to 36. Else, if the jsonPayload.rdata.type log field value is equal to CERT, then the network.dns.answers.type UDM field is set to 37. Else, if the jsonPayload.rdata.type log field value is equal to A6, then the network.dns.answers.type UDM field is set to 38. Else, if the jsonPayload.rdata.type log field value is equal to DNAME, then the network.dns.answers.type UDM field is set to 39. Else, if the jsonPayload.rdata.type log field value is equal to SINK, then the network.dns.answers.type UDM field is set to 40. Else, if the jsonPayload.rdata.type log field value is equal to OPT, then the network.dns.answers.type UDM field is set to 41. Else, if the jsonPayload.rdata.type log field value is equal to APL, then the network.dns.answers.type UDM field is set to 42. Else, if the jsonPayload.rdata.type log field value is equal to DS, then the network.dns.answers.type UDM field is set to 43. Else, if the jsonPayload.rdata.type log field value is equal to SSHFP, then the network.dns.answers.type UDM field is set to 44. Else, if the jsonPayload.rdata.type log field value is equal to IPSECKEY, then the network.dns.answers.type UDM field is set to 45. Else, if the jsonPayload.rdata.type log field value is equal to RRSIG, then the network.dns.answers.type UDM field is set to 46. Else, if the jsonPayload.rdata.type log field value is equal to NSEC, then the network.dns.answers.type UDM field is set to 47. Else, if the jsonPayload.rdata.type log field value is equal to DNSKEY, then the network.dns.answers.type UDM field is set to 48. Else, if the jsonPayload.rdata.type log field value is equal to DHCID, then the network.dns.answers.type UDM field is set to 49. Else, if the jsonPayload.rdata.type log field value is equal to NSEC3, then the network.dns.answers.type UDM field is set to 50. Else, if the jsonPayload.rdata.type log field value is equal to NSEC3PARAM, then the network.dns.answers.type UDM field is set to 51. Else, if the jsonPayload.rdata.type log field value is equal to TLSA, then the network.dns.answers.type UDM field is set to 52. Else, if the jsonPayload.rdata.type log field value is equal to SMIMEA, then the network.dns.answers.type UDM field is set to 53. Else, if the jsonPayload.rdata.type log field value is equal to UNASSIGN, then the network.dns.answers.type UDM field is set to 54. Else, if the jsonPayload.rdata.type log field value is equal to HIP, then the network.dns.answers.type UDM field is set to 55. Else, if the jsonPayload.rdata.type log field value is equal to NINFO, then the network.dns.answers.type UDM field is set to 56. Else, if the jsonPayload.rdata.type log field value is equal to RKEY, then the network.dns.answers.type UDM field is set to 57. Else, if the jsonPayload.rdata.type log field value is equal to TALINK, then the network.dns.answers.type UDM field is set to 58. Else, if the jsonPayload.rdata.type log field value is equal to CDS, then the network.dns.answers.type UDM field is set to 59. Else, if the jsonPayload.rdata.type log field value is equal to CDNSKEY, then the network.dns.answers.type UDM field is set to 60. Else, if the jsonPayload.rdata.type log field value is equal to OPENPGPK, then the network.dns.answers.type UDM field is set to 61. Else, if the jsonPayload.rdata.type log field value is equal to CSYNC, then the network.dns.answers.type UDM field is set to 62. Else, if the jsonPayload.rdata.type log field value is equal to ZONEMD, then the network.dns.answers.type UDM field is set to 63. Else, if the jsonPayload.rdata.type log field value is equal to SVCB, then the network.dns.answers.type UDM field is set to 64. Else, if the jsonPayload.rdata.type log field value is equal to HTTPS, then the network.dns.answers.type UDM field is set to 65. Else, if the jsonPayload.rdata.type log field value is equal to SPF, then the network.dns.answers.type UDM field is set to 99. Else, if the jsonPayload.rdata.type log field value is equal to UINFO, then the network.dns.answers.type UDM field is set to 100. Else, if the jsonPayload.rdata.type log field value is equal to UID, then the network.dns.answers.type UDM field is set to 101. Else, if the jsonPayload.rdata.type log field value is equal to GID, then the network.dns.answers.type UDM field is set to 102. Else, if the jsonPayload.rdata.type log field value is equal to UNSPEC, then the network.dns.answers.type UDM field is set to 103. Else, if the jsonPayload.rdata.type log field value is equal to NID, then the network.dns.answers.type UDM field is set to 104. Else, if the jsonPayload.rdata.type log field value is equal to L32, then the network.dns.answers.type UDM field is set to 105. Else, if the jsonPayload.rdata.type log field value is equal to L64, then the network.dns.answers.type UDM field is set to 106. Else, if the jsonPayload.rdata.type log field value is equal to LP, then the network.dns.answers.type UDM field is set to 107. Else, if the jsonPayload.rdata.type log field value is equal to EUI48, then the network.dns.answers.type UDM field is set to 108. Else, if the jsonPayload.rdata.type log field value is equal to EUI64, then the network.dns.answers.type UDM field is set to 109. Else, if the jsonPayload.rdata.type log field value is equal to TKEY, then the network.dns.answers.type UDM field is set to 249. Else, if the jsonPayload.rdata.type log field value is equal to TSIG, then the network.dns.answers.type UDM field is set to 250. Else, if the jsonPayload.rdata.type log field value is equal to IXFR, then the network.dns.answers.type UDM field is set to 251. Else, if the jsonPayload.rdata.type log field value is equal to AXFR, then the network.dns.answers.type UDM field is set to 252. Else, if the jsonPayload.rdata.type log field value is equal to MAILB, then the network.dns.answers.type UDM field is set to 253. Else, if the jsonPayload.rdata.type log field value is equal to MAILA, then the network.dns.answers.type UDM field is set to 254. Else, if the jsonPayload.rdata.type log field value is equal to ALL, then the network.dns.answers.type UDM field is set to 255. Else, if the jsonPayload.rdata.type log field value is equal to URI, then the network.dns.answers.type UDM field is set to 256. Else, if the jsonPayload.rdata.type log field value is equal to CAA, then the network.dns.answers.type UDM field is set to 257. Else, if the jsonPayload.rdata.type log field value is equal to AVC, then the network.dns.answers.type UDM field is set to 258. Else, if the jsonPayload.rdata.type log field value is equal to DOA, then the network.dns.answers.type UDM field is set to 259. Else, if the jsonPayload.rdata.type log field value is equal to AMTRELAY, then the network.dns.answers.type UDM field is set to 260. Else, if the jsonPayload.rdata.type log field value is equal to TA, then the network.dns.answers.type UDM field is set to 32768. Else, if the jsonPayload.rdata.type log field value is equal to DLV, then the network.dns.answers.type UDM field is set to 32769.
jsonPayload.authAnswer	network.dns.authoritative	If the jsonPayload.authAnswer log field value is equal to true, then the network.dns.authoritative UDM field is set to test.
jsonPayload.queryName	network.dns.questions.name	If the jsonPayload.queryName log field matches the regular expression pattern %{WORD:part1}%{GREEDYDATA}\\\\%{WORD}%{GREEDYDATA:part2}, then the extracted fields part1 and part2 are mapped to the network.dns.questions.name UDM field. Else, if the jsonPayload.queryName log field matches the regular expression pattern (?P.*)\.$, then the extracted field domain is mapped to the network.dns.questions.name UDM field.
jsonPayload.queryType	network.dns.questions.type	If the jsonPayload.queryType log field value is equal to A, then the network.dns.questions.type UDM field is set to 1. Else, if the jsonPayload.queryType log field value is equal to NS, then the network.dns.questions.type UDM field is set to 2. Else, if the jsonPayload.queryType log field value is equal to MD, then the network.dns.questions.type UDM field is set to 3. Else, if the jsonPayload.queryType log field value is equal to MF, then the network.dns.questions.type UDM field is set to 4. Else, if the jsonPayload.queryType log field value is equal to CNAME, then the network.dns.questions.type UDM field is set to 5. Else, if the jsonPayload.queryType log field value is equal to SOA, then the network.dns.questions.type UDM field is set to 6. Else, if the jsonPayload.queryType log field value is equal to MB, then the network.dns.questions.type UDM field is set to 7. Else, if the jsonPayload.queryType log field value is equal to MG, then the network.dns.questions.type UDM field is set to 8. Else, if the jsonPayload.queryType log field value is equal to MR, then the network.dns.questions.type UDM field is set to 9. Else, if the jsonPayload.queryType log field value is equal to NULL, then the network.dns.questions.type UDM field is set to 10. Else, if the jsonPayload.queryType log field value is equal to WKS, then the network.dns.questions.type UDM field is set to 11. Else, if the jsonPayload.queryType log field value is equal to PTR, then the network.dns.questions.type UDM field is set to 12. Else, if the jsonPayload.queryType log field value is equal to HINFO, then the network.dns.questions.type UDM field is set to 13. Else, if the jsonPayload.queryType log field value is equal to MINFO, then the network.dns.questions.type UDM field is set to 14. Else, if the jsonPayload.queryType log field value is equal to MX, then the network.dns.questions.type UDM field is set to 15. Else, if the jsonPayload.queryType log field value is equal to TXT, then the network.dns.questions.type UDM field is set to 16. Else, if the jsonPayload.queryType log field value is equal to RP, then the network.dns.questions.type UDM field is set to 17. Else, if the jsonPayload.queryType log field value is equal to AFSDB, then the network.dns.questions.type UDM field is set to 18. Else, if the jsonPayload.queryType log field value is equal to X25, then the network.dns.questions.type UDM field is set to 19. Else, if the jsonPayload.queryType log field value is equal to ISDN, then the network.dns.questions.type UDM field is set to 20. Else, if the jsonPayload.queryType log field value is equal to RT, then the network.dns.questions.type UDM field is set to 21. Else, if the jsonPayload.queryType log field value is equal to NSAP, then the network.dns.questions.type UDM field is set to 22. Else, if the jsonPayload.queryType log field value is equal to NSAP-PTR, then the network.dns.questions.type UDM field is set to 23. Else, if the jsonPayload.queryType log field value is equal to SIG, then the network.dns.questions.type UDM field is set to 24. Else, if the jsonPayload.queryType log field value is equal to KEY, then the network.dns.questions.type UDM field is set to 25. Else, if the jsonPayload.queryType log field value is equal to PX, then the network.dns.questions.type UDM field is set to 26. Else, if the jsonPayload.queryType log field value is equal to GPOS, then the network.dns.questions.type UDM field is set to 27. Else, if the jsonPayload.queryType log field value is equal to AAAA, then the network.dns.questions.type UDM field is set to 28. Else, if the jsonPayload.queryType log field value is equal to LOC, then the network.dns.questions.type UDM field is set to 29. Else, if the jsonPayload.queryType log field value is equal to NXT, then the network.dns.questions.type UDM field is set to 30. Else, if the jsonPayload.queryType log field value is equal to EID, then the network.dns.questions.type UDM field is set to 31. Else, if the jsonPayload.queryType log field value is equal to NIMLOC, then the network.dns.questions.type UDM field is set to 32. Else, if the jsonPayload.queryType log field value is equal to SRV, then the network.dns.questions.type UDM field is set to 33. Else, if the jsonPayload.queryType log field value is equal to ATMA, then the network.dns.questions.type UDM field is set to 34. Else, if the jsonPayload.queryType log field value is equal to NAPTR, then the network.dns.questions.type UDM field is set to 35. Else, if the jsonPayload.queryType log field value is equal to KX, then the network.dns.questions.type UDM field is set to 36. Else, if the jsonPayload.queryType log field value is equal to CERT, then the network.dns.questions.type UDM field is set to 37. Else, if the jsonPayload.queryType log field value is equal to A6, then the network.dns.questions.type UDM field is set to 38. Else, if the jsonPayload.queryType log field value is equal to DNAME, then the network.dns.questions.type UDM field is set to 39. Else, if the jsonPayload.queryType log field value is equal to SINK, then the network.dns.questions.type UDM field is set to 40. Else, if the jsonPayload.queryType log field value is equal to OPT, then the network.dns.questions.type UDM field is set to 41. Else, if the jsonPayload.queryType log field value is equal to APL, then the network.dns.questions.type UDM field is set to 42. Else, if the jsonPayload.queryType log field value is equal to DS, then the network.dns.questions.type UDM field is set to 43. Else, if the jsonPayload.queryType log field value is equal to SSHFP, then the network.dns.questions.type UDM field is set to 44. Else, if the jsonPayload.queryType log field value is equal to IPSECKEY, then the network.dns.questions.type UDM field is set to 45. Else, if the jsonPayload.queryType log field value is equal to RRSIG, then the network.dns.questions.type UDM field is set to 46. Else, if the jsonPayload.queryType log field value is equal to NSEC, then the network.dns.questions.type UDM field is set to 47. Else, if the jsonPayload.queryType log field value is equal to DNSKEY, then the network.dns.questions.type UDM field is set to 48. Else, if the jsonPayload.queryType log field value is equal to DHCID, then the network.dns.questions.type UDM field is set to 49. Else, if the jsonPayload.queryType log field value is equal to NSEC3, then the network.dns.questions.type UDM field is set to 50. Else, if the jsonPayload.queryType log field value is equal to NSEC3PARAM, then the network.dns.questions.type UDM field is set to 51. Else, if the jsonPayload.queryType log field value is equal to TLSA, then the network.dns.questions.type UDM field is set to 52. Else, if the jsonPayload.queryType log field value is equal to SMIMEA, then the network.dns.questions.type UDM field is set to 53. Else, if the jsonPayload.queryType log field value is equal to UNASSIGN, then the network.dns.questions.type UDM field is set to 54. Else, if the jsonPayload.queryType log field value is equal to HIP, then the network.dns.questions.type UDM field is set to 55. Else, if the jsonPayload.queryType log field value is equal to NINFO, then the network.dns.questions.type UDM field is set to 56. Else, if the jsonPayload.queryType log field value is equal to RKEY, then the network.dns.questions.type UDM field is set to 57. Else, if the jsonPayload.queryType log field value is equal to TALINK, then the network.dns.questions.type UDM field is set to 58. Else, if the jsonPayload.queryType log field value is equal to CDS, then the network.dns.questions.type UDM field is set to 59. Else, if the jsonPayload.queryType log field value is equal to CDNSKEY, then the network.dns.questions.type UDM field is set to 60. Else, if the jsonPayload.queryType log field value is equal to OPENPGPK, then the network.dns.questions.type UDM field is set to 61. Else, if the jsonPayload.queryType log field value is equal to CSYNC, then the network.dns.questions.type UDM field is set to 62. Else, if the jsonPayload.queryType log field value is equal to ZONEMD, then the network.dns.questions.type UDM field is set to 63. Else, if the jsonPayload.queryType log field value is equal to SVCB, then the network.dns.questions.type UDM field is set to 64. Else, if the jsonPayload.queryType log field value is equal to HTTPS, then the network.dns.questions.type UDM field is set to 65. Else, if the jsonPayload.queryType log field value is equal to SPF, then the network.dns.questions.type UDM field is set to 99. Else, if the jsonPayload.queryType log field value is equal to UINFO, then the network.dns.questions.type UDM field is set to 100. Else, if the jsonPayload.queryType log field value is equal to UID, then the network.dns.questions.type UDM field is set to 101. Else, if the jsonPayload.queryType log field value is equal to GID, then the network.dns.questions.type UDM field is set to 102. Else, if the jsonPayload.queryType log field value is equal to UNSPEC, then the network.dns.questions.type UDM field is set to 103. Else, if the jsonPayload.queryType log field value is equal to NID, then the network.dns.questions.type UDM field is set to 104. Else, if the jsonPayload.queryType log field value is equal to L32, then the network.dns.questions.type UDM field is set to 105. Else, if the jsonPayload.queryType log field value is equal to L64, then the network.dns.questions.type UDM field is set to 106. Else, if the jsonPayload.queryType log field value is equal to LP, then the network.dns.questions.type UDM field is set to 107. Else, if the jsonPayload.queryType log field value is equal to EUI48, then the network.dns.questions.type UDM field is set to 108. Else, if the jsonPayload.queryType log field value is equal to EUI64, then the network.dns.questions.type UDM field is set to 109. Else, if the jsonPayload.queryType log field value is equal to TKEY, then the network.dns.questions.type UDM field is set to 249. Else, if the jsonPayload.queryType log field value is equal to TSIG, then the network.dns.questions.type UDM field is set to 250. Else, if the jsonPayload.queryType log field value is equal to IXFR, then the network.dns.questions.type UDM field is set to 251. Else, if the jsonPayload.queryType log field value is equal to AXFR, then the network.dns.questions.type UDM field is set to 252. Else, if the jsonPayload.queryType log field value is equal to MAILB, then the network.dns.questions.type UDM field is set to 253. Else, if the jsonPayload.queryType log field value is equal to MAILA, then the network.dns.questions.type UDM field is set to 254. Else, if the jsonPayload.queryType log field value is equal to ALL, then the network.dns.questions.type UDM field is set to 255. Else, if the jsonPayload.queryType log field value is equal to URI, then the network.dns.questions.type UDM field is set to 256. Else, if the jsonPayload.queryType log field value is equal to CAA, then the network.dns.questions.type UDM field is set to 257. Else, if the jsonPayload.queryType log field value is equal to AVC, then the network.dns.questions.type UDM field is set to 258. Else, if the jsonPayload.queryType log field value is equal to DOA, then the network.dns.questions.type UDM field is set to 259. Else, if the jsonPayload.queryType log field value is equal to AMTRELAY, then the network.dns.questions.type UDM field is set to 260. Else, if the jsonPayload.queryType log field value is equal to TA, then the network.dns.questions.type UDM field is set to 32768. Else, if the jsonPayload.queryType log field value is equal to DLV, then the network.dns.questions.type UDM field is set to 32769.
jsonPayload.responseCode	network.dns.response_code	If the jsonPayload.responseCode log field value is equal to FORMERR, then the network.dns.response_code UDM field is set to 1. Else, if the jsonPayload.responseCode log field value is equal to SERVFAIL, then the network.dns.response_code UDM field is set to 2. Else, if the jsonPayload.responseCode log field value is equal to NXDOMAIN, then the network.dns.response_code UDM field is set to 3. Else, if the jsonPayload.responseCode log field value is equal to NOTIMP, then the network.dns.response_code UDM field is set to 4. Else, if the jsonPayload.responseCode log field value is equal to REFUSED, then the network.dns.response_code UDM field is set to 5. Else, if the jsonPayload.responseCode log field value is equal to YXDOMAIN, then the network.dns.response_code UDM field is set to 6. Else, if the jsonPayload.responseCode log field value is equal to YXRRSET, then the network.dns.response_code UDM field is set to 7. Else, if the jsonPayload.responseCode log field value is equal to NXRRSET, then the network.dns.response_code UDM field is set to 8. Else, if the jsonPayload.responseCode log field value is equal to NOTAUTH, then the network.dns.response_code UDM field is set to 9. Else, if the jsonPayload.responseCode log field value is equal to NOTZONE, then the network.dns.response_code UDM field is set to 10. Else, if the jsonPayload.responseCode log field value is equal to DSOTYPENI, then the network.dns.response_code UDM field is set to 11. Else, if the jsonPayload.responseCode log field value is equal to BADVERS, then the network.dns.response_code UDM field is set to 16. Else, if the jsonPayload.responseCode log field value is equal to BADSIG, then the network.dns.response_code UDM field is set to 16. Else, if the jsonPayload.responseCode log field value is equal to BADKEY, then the network.dns.response_code UDM field is set to 17. Else, if the jsonPayload.responseCode log field value is equal to BADTIME, then the network.dns.response_code UDM field is set to 18. Else, if the jsonPayload.responseCode log field value is equal to BADMODE, then the network.dns.response_code UDM field is set to 19. Else, if the jsonPayload.responseCode log field value is equal to BADNAME, then the network.dns.response_code UDM field is set to 20. Else, if the jsonPayload.responseCode log field value is equal to BADALG, then the network.dns.response_code UDM field is set to 21. Else, if the jsonPayload.responseCode log field value is equal to BADTRUNC, then the network.dns.response_code UDM field is set to 22. Else, if the jsonPayload.responseCode log field value is equal to BADCOOKIE, then the network.dns.response_code UDM field is set to 23.
	network.dns.truncated	If the jsonPayload.rdata log field value is not empty, then the network.dns.truncated UDM field is set to true.
jsonPayload.protocol	network.ip_protocol	If the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ICMP. 1 ICMP ICMPV6 58 Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IGMP. 2 IGMP Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to TCP. 6 TCP Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to UDP. 17 UDP Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IP6IN4. 41 IP6IN4 Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to GRE. 47 GRE Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ESP. 50 ESP Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to EIGRP. 88 EIGRP Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ETHERIP. 97 ETHERIP Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to PIM. 103 PIM Else, if the jsonPayload.protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to VRRP. 112 VRRP .
jsonPayload.sourceIP	principal.ip
jsonPayload.sourceNetwork	principal.namespace	If the jsonPayload.vmProjectId log field value is not empty and the jsonPayload.sourceNetwork log field value is not empty, then the %{jsonPayload.vmProjectId}:%{jsonPayload.sourceNetwork} log field is mapped to the principal.namespace UDM field. Else, if the resource.labels.project_id log field value is not empty and the jsonPayload.sourceNetwork log field value is not empty, then the %{resource.labels.project_id}:%{jsonPayload.sourceNetwork} log field is mapped to the principal.namespace UDM field. Else, if the jsonPayload.sourceNetwork log field value is not empty, then the jsonPayload.sourceNetwork log field is mapped to the principal.namespace UDM field.
resource.labels.location	principal.location.name
jsonPayload.vmZoneName	principal.resource.attribute.cloud.availability_zone
	principal.resource.attribute.cloud.environment	The principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
	principal.cloud.environment	The principal.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
resource.labels.source_type	principal.resource.attribute.labels[source_type]
resource.labels.target_name	principal.resource.attribute.labels[target_name]
resource.labels.target_type	principal.resource.attribute.labels[target_type]
jsonPayload.vmInstanceName	principal.resource.name	Extracted projectororg from the logName log field using the Grok pattern. If the jsonPayload.vmInstanceName log field value is not empty, then the //compute.googleapis.com/projects/%{projectororg}/zones/%{resource.labels.location}/instances/%{jsonPayload.vmInstanceName} field is mapped to the principal.resource.name UDM field.
logName	principal.resource.name	Extracted projectororg from the logName log field using the Grok pattern.
jsonPayload.vmInstanceIdString	principal.resource.id	If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.id UDM field. Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.id UDM field.
jsonPayload.vmInstanceId	principal.resource.id	If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.id UDM field. Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.id UDM field.
jsonPayload.vmInstanceIdString	principal.resource.product_object_id	If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.product_object_id UDM field. Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.product_object_id UDM field.
jsonPayload.vmInstanceId	principal.resource.product_object_id	If the jsonPayload.vmInstanceIdString log field value is not empty, then the jsonPayload.vmInstanceIdString log field is mapped to the principal.resource.product_object_id UDM field. Else, if the jsonPayload.vmInstanceId log field value is not empty, then the jsonPayload.vmInstanceId log field is mapped to the principal.resource.product_object_id UDM field.
jsonPayload.vmProjectId	principal.cloud.project.name	If the jsonPayload.vmProjectId log field value is not empty, then the jsonPayload.vmProjectId log field is mapped to the principal.cloud.project.name UDM field.
resource.labels.project_id	principal.cloud.project.name	If the jsonPayload.vmProjectId log field value is empty, then the resource.labels.project_id log field is mapped to the principal.cloud.project.name UDM field.
jsonPayload.vmProjectId	principal.resource_ancestors.name
resource.labels.project_id	principal.resource_ancestors.name
	principal.resource_ancestors.resource_subtype	If the jsonPayload.vmProjectId log field value is not empty, then the principal.resource_ancestors.resource_subtype UDM field is set to Virtual Machine Project. If the resource.labels.project_id log field value is not empty, then the principal.resource_ancestors.resource_subtype UDM field is set to Project.
	principal.resource_ancestors.resource_type	If the jsonPayload.vmProjectId log field value is not empty, then the principal.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT. If the resource.labels.project_id log field value is not empty, then the principal.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT.
resource.type	principal.resource.resource_subtype
	principal.resource.resource_type	The principal.resource.resource_type UDM field is set to VIRTUAL_MACHINE.
	security_result.severity	If the severity log field value contains one of the following values, then the security_result.severity UDM field is set to INFORMATIONAL. INFO DEBUG Else, if the severity log field value is equal to NOTICE, then the security_result.severity UDM field is set to LOW. Else, if the severity log field value is equal to WARNING, then the security_result.severity UDM field is set to MEDIUM. Else, if the severity log field value is equal to ERROR, then the security_result.severity UDM field is set to ERROR. Else, if the severity log field value contains one of the following values, then the security_result.severity UDM field is set to CRITICAL and the is_alert UDM field is set to true and the is_significant UDM field is set to true. CRITICAL ALERT EMERGENCY Else, if the severity log field value is equal to DEFAULT or the severity log field value is not empty, then the security_result.severity UDM field is set to UNKNOWN_SEVERITY.
severity	security_result.severity_details
jsonPayload.destinationIP	target.ip
	target.resource.attribute.cloud.environment	The target.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.

다음 단계

• Google Security Operations에 데이터 수집