Google Cloud IDS ログを収集する

このドキュメントでは、Google Security Operations への Google Cloud テレメトリーの取り込みを有効にして Google Cloud IDS ログを収集する方法と、Google Cloud IDS ログのログ フィールドを Google Security Operations の統合データモデル（UDM）フィールドにマッピングする方法について説明します。

詳細については、Google Security Operations へのデータの取り込みをご覧ください。

一般的なデプロイは、Google Security Operations への取り込みに対して有効になっている Google Cloud IDS ログで構成されています。お客様のデプロイはそれぞれこの表現とは異なる可能性があり、より複雑になることがあります。

デプロイには次のコンポーネントが含まれます。

• Google Cloud: ログの収集元となる Google Cloud サービスとプロダクト。

• Google Cloud IDS のログ: Google Security Operations への取り込みに対して有効になっている Google Cloud IDS のログ。

• Google Security Operations: Google Security Operations は Google Cloud IDS のログを保持して分析します。

取り込みラベルによって、未加工のログデータを構造化 UDM 形式に正規化するパーサーが識別されます。このドキュメントの情報は、取り込みラベル GCP_IDS が付加されたパーサーに適用されます。

準備

• デプロイ アーキテクチャ内のすべてのシステムが、UTC タイムゾーンに構成されていることを確認します。

Google Cloud IDS ログを取り込むように Google Cloud を構成する

Google Cloud IDS ログを Google Security Operations に取り込むには、Google Cloud Logs を Google Security Operations に取り込むの手順に従います。

Google Cloud IDS ログを取り込むときに問題が発生した場合は、Google Security Operations サポートにお問い合わせください。

フィールド マッピング リファレンス

フィールド マッピング リファレンス: GCP_IDS

次の表に、GCP_IDS ログタイプのログ フィールドと、対応する UDM フィールドを示します。

非推奨:

UDM 名詞の次の labels フィールドは非推奨になりました。about.labels、intermediary.labels、observer.labels、principal.labels、src.labels、security_result.about.labels、target.labels。既存のパーサーの場合、これらの UDM フィールドに加えて、ログ フィールドは Key/Value additional.fields UDM フィールドにもマッピングされます。新しいパーサーの場合、非推奨の labels UDM フィールドの代わりに additional.fields UDM フィールドの Key/Value 設定が使用されます。サポートが終了した labels UDM フィールドではなく、additional.fields UDM フィールドの Key/Value 設定を使用するように、既存のルールを更新することをおすすめします。

Log field	UDM mapping	Logic
insertId	metadata.product_log_id
jsonPayload.alert_severity	security_result.severity
jsonPayload.alert_time	metadata.event_timestamp
jsonPayload.application	principal.application	If the jsonPayload.direction log field value is equal to server-to-client, then the jsonPayload.application log field is mapped to the principal.application UDM field.
jsonPayload.application	target.application	If the jsonPayload.direction log field value is equal to client-to-server or the logName log field value matches the regular expression pattern traffic, then the jsonPayload.application log field is mapped to the target.application UDM field.
jsonPayload.category	security_result.category_details
jsonPayload.cves	extensions.vulns.vulnerabilities.cve_id	If the jsonPayload.cves log field value is not empty, then the jsonPayload.cves log field is mapped to the extensions.vulns.vulnerabilities.cve_id UDM field.
jsonPayload.destination_ip_address	target.ip
jsonPayload.destination_port	target.port
jsonPayload.details	extensions.vulns.vulnerabilities.description	If the jsonPayload.cves log field value is not empty, then the jsonPayload.details log field is mapped to the extensions.vulns.vulnerabilities.description UDM field.
jsonPayload.direction	network.direction	If the jsonPayload.direction log field value is equal to client-to-server, then the network.direction UDM field is set to OUTBOUND. Else, if the jsonPayload.direction log field value is equal to server-to-client, then the network.direction UDM field is set to INBOUND.
jsonPayload.elapsed_time	network.session_duration.seconds
jsonPayload.ip_protocol	network.ip_protocol	If the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ICMP. 1 ICMP ICMPV6 58 1.0 58.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IGMP. 2 IGMP 2.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to TCP. 6 TCP 6.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to UDP. 17 UDP 17.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to IP6IN4. 41 IP6IN4 41.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to GRE. 47 GRE 47.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ESP. 50 ESP 50.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to EIGRP. 88 EIGRP 88.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to ETHERIP. 97 ETHERIP 97.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to PIM. 103 PIM 103.0 Else, if the jsonPayload.ip_protocol log field value contains one of the following values, then the network.ip_protocol UDM field is set to VRRP. 112 VRRP 112.0
jsonPayload.name	security_result.threat_name
jsonPayload.network	target.resource.name	If the jsonPayload.direction log field value is equal to client-to-server or the logName log field value matches the regular expression pattern traffic, then the jsonPayload.network log field is mapped to the target.resource.name UDM field.
jsonPayload.network	principal.resource.name	If the jsonPayload.direction log field value is equal to server-to-client, then the jsonPayload.network log field is mapped to the principal.resource.name UDM field.
	target.resource.resource_type	If the jsonPayload.direction log field value is equal to client-to-server or the logName log field value matches the regular expression pattern traffic, then the target.resource.resource_type UDM field is set to VPC_NETWORK.
	principal.resource.resource_type	If the jsonPayload.direction log field value is equal to server-to-client, then the principal.resource.resource_type UDM field is set to VPC_NETWORK.
jsonPayload.repeat_count	security_result.detection_fields[repeat_count]
jsonPayload.session_id	network.session_id
jsonPayload.source_ip_address	principal.ip
jsonPayload.source_port	principal.port
jsonPayload.start_time	about.labels[start_time] (deprecated)
jsonPayload.start_time	additional.fields[start_time]
jsonPayload.threat_id	security_result.threat_id
jsonPayload.total_bytes	about.labels[total_bytes] (deprecated)
jsonPayload.total_bytes	additional.fields[total_bytes]
jsonPayload.total_packets	about.labels[total_packets] (deprecated)
jsonPayload.total_packets	additional.fields[total_packets]
jsonPayload.type	security_result.detection_fields[type]
jsonPayload.uri_or_filename	target.file.full_path
logName	security_result.category_details
receiveTimestamp	metadata.collected_timestamp
resource.labels.id	observer.resource.product_object_id
resource.labels.location	observer.location.name
resource.labels.resource_container	observer.resource.name
resource.type	observer.resource.resource_subtype
timestamp	metadata.event_timestamp	If the logName log field value matches the regular expression pattern traffic, then the timestamp log field is mapped to the metadata.event_timestamp UDM field.
	observer.resource.resource_type	The observer.resource.resource_type UDM field is set to CLOUD_PROJECT.
	observer.resource.attribute.cloud.environment	The observer.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.
	idm.is_alert	If the jsonPayload.alert_severity log field value is equal to CRITICAL, then the idm.is_alert UDM field is set to true.
	idm.is_significant	If the jsonPayload.alert_severity log field value is equal to CRITICAL, then the idm.is_significant UDM field is set to true.
	security_result.category	If the jsonPayload.category log field value is equal to dos, then the security_result.category UDM field is set to NETWORK_DENIAL_OF_SERVICE. Else, if the jsonPayload.category log field value is equal to info-leak, then the security_result.category UDM field is set to NETWORK_SUSPICIOUS. Else, if the jsonPayload.category log field value is equal to protocol-anomaly, then the security_result.category UDM field is set to NETWORK_MALICIOUS. Else, if the jsonPayload.category log field value contains one of the following values, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS. backdoor spyware trojan
	extensions.vulns.vulnerabilities.vendor	if the jsonPayload.cves log field value is not empty, then the extensions.vulns.vulnerabilities.vendor UDM field is set to GCP_IDS.
	metadata.product_name	The metadata.product_name UDM field is set to GCP_IDS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Google Cloud Platform.
	metadata.event_type	If the jsonPayload.cves log field value is not empty, then the metadata.event_type UDM field is set to SCAN_VULN_NETWROK. Else, if the jsonPayload.source_ip_address log field value is not empty, then the metadata.event_type UDM field is set to SCAN_NETWORK. Else, the metadata.event_type UDM field is set to GENERIC_EVENT.

次のステップ

• Google Security Operations へのデータの取り込み