收集 Zscaler DLP 日志

支持的平台:

本文档介绍了如何通过设置 Google 安全运营 Feed 来导出 Zscaler DLP 日志,以及日志字段如何映射到 Google SecOps Unified Data Model (UDM) 字段。

如需了解详情,请参阅将数据提取到 Google SecOps 概览

典型的部署包括 Zscaler DLP 和配置为将日志发送到 Google SecOps 的 Google SecOps Webhook Feed。每个客户部署都可能不同,并且可能更复杂。

该部署包含以下组件:

  • Zscaler DLP:您要从中收集日志的平台。

  • Google SecOps Feed:Google SecOps Feed 会从 Zscaler DLP 提取日志并将日志写入 Google SecOps。

  • Google Security Operations:保留和分析日志。

注入标签标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档中的信息适用于具有 ZSCALER_DLP 标签的解析器。

准备工作

  • 确保您有权访问 Zscaler Internet Access 控制台。如需了解详情,请参阅 Secure Internet and SaaS Access ZIA Help
  • 确保您使用的是 Zscaler DLP 2024 或更高版本。
  • 确保部署架构中的所有系统都使用世界协调时间 (UTC) 时区进行配置。
  • 确保您拥有在 Google Security Operations 中完成 Feed 设置所需的 API 密钥。如需了解详情,请参阅设置 API 密钥

在 Google SecOps 中设置提取 Feed,以提取 Zscaler DLP 日志

  1. 依次前往 SIEM 设置 > Feed
  2. 点击新增
  3. Feed 名称字段中,输入 Feed 的名称(例如 Zscaler DLP 日志)。
  4. 选择 Webhook 作为来源类型
  5. 选择 Zscaler DLP 作为日志类型
  6. 点击下一步
  7. 可选:为以下输入参数指定值:
    1. 分隔符:用于分隔日志行(如果不使用分隔符,请留空)。
    2. 资源命名空间:资源命名空间。
    3. 提取标签:要应用于此 Feed 中的事件的标签。
  8. 点击下一步
  9. 最终确定界面中查看新的 Feed 配置,然后点击提交
  10. 点击生成 Secret 密钥以生成用于对此 Feed 进行身份验证的 Secret 密钥。

设置 Zscaler DLP

  1. 在 Zscaler Internet Access 控制台中,依次选择管理 > Nanolog 流式传输服务 > Cloud NSS Feed
  2. 点击添加 Cloud NSS Feed
  3. Feed 名称字段中输入 Feed 的名称。
  4. NSS 类型中,选择 NSS for Web
  5. 状态列表中选择状态,以启用或停用 NSS Feed。
  6. SIEM 速率菜单中的值保留为不限。如需因许可或其他限制而抑制输出流,请更改此值。
  7. SIEM 类型列表中,选择 Other(其他)。
  8. OAuth 2.0 Authentication(OAuth 2.0 身份验证)列表中,选择 Disabled(已停用)。
  9. Max Batch Size(最大批量大小)中,输入单个 HTTP 请求载荷的大小限制(例如 512 KB),以遵循 SIEM 的最佳实践。
  10. 在 API 网址中输入 Chronicle API 端点的 HTTPS 网址,格式如下:

    https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    
    • CHRONICLE_REGION:Google SecOps 实例的托管区域(例如 US)。
    • GOOGLE_PROJECT_NUMBER:自助创建项目的项目编号(请从 C4 获取)。
    • LOCATION:Google SecOps 区域(例如 US)。
    • CUSTOMER_ID:Google SecOps 客户 ID(请从 C4 获取)。
    • FEED_ID:新创建的 webhook 的 Feed 界面上显示的 Feed ID。

    API 网址示例:

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    
  11. 点击添加 HTTP 标头,以添加包含键和值的更多 HTTP 标头。

    例如:

    • X-goog-api-key
    • :基于 Google Cloud BYOP 的 API 凭据生成的 API 密钥

  12. 日志类型列表中选择端点 DLP

  13. Feed 输出类型列表中,选择 JSON

  14. Feed 转义字符设置为 , \ "

  15. 如需向 Feed 输出格式添加新字段,请在 Feed 输出类型列表中选择自定义

  16. 复制并粘贴Feed 输出格式,然后添加新字段。确保键名称与实际字段名称一致。

    以下是默认的Feed 输出格式

    \{ "sourcetype" : "zscalernss-edlp", "event" :\{"time":"%s{time}","recordid":"%d{recordid}","login":"%s{user}","dept":"%s{department}","filetypename":"%s{filetypename}","filemd5":"%s{filemd5}","dlpdictnames":"%s{dlpdictnames}","dlpdictcount":"%s{dlpcounts}","dlpenginenames":"%s{dlpengnames}","channel":"%s{channel}","actiontaken":"%s{actiontaken}","severity":"%s{severity}","rulename":"%s{triggeredrulelabel}","itemdstname":"%s{itemdstname}"\}\}
    
  17. 时区列表中,为输出文件中的 Time 字段选择时区。默认情况下,时区会设为贵组织的时区。

  18. 查看已配置的设置。

  19. 点击保存以测试连接。如果连接成功,系统会显示一个绿色对勾标记,以及消息 Test Connectivity Successful: OK (200)

如需详细了解 Google SecOps Feed,请参阅 Google SecOps Feed 文档。如需了解每种 Feed 类型的要求,请参阅按类型配置 Feed

如果您在创建 Feed 时遇到问题,请与 Google SecOps 支持团队联系。

UDM 映射表

下表列出了 ZSCALER_DLP 日志类型的日志字段及其对应的 UDM 字段。

Log field UDM mapping Logic
mon additional.fields[mon]
day additional.fields[day]
scantime additional.fields[scantime]
numdlpengids additional.fields[numdlpengids]
numdlpdictids additional.fields[numdlpdictids]
recordid metadata.product_log_id
scanned_bytes additional.fields[scanned_bytes]
dlpidentifier security_result.detection_fields[dlpidentifier]
login principal.user.user_display_name
b64user principal.user.user_display_name
euser principal.user.user_display_name
ouser security_result.detection_fields[ouser]
dept principal.user.department
b64department principal.user.department
edepartment principal.user.department
odepartment security_result.detection_fields[odepartment]
odevicename security_result.detection_fields[odevicename]
devicetype principal.asset.attribute.labels[devicetype]
principal.asset.platform_software.platform If the deviceostype log field value matches the regular expression pattern (?i)Windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.
principal.asset.asset_id If the devicename log field value is not empty, then the asset_id:devicename log field is mapped to the principal.asset.asset_id UDM field.

If the b64devicename log field value is not empty, then the asset_id:b64devicename log field is mapped to the principal.asset.asset_id UDM field.

If the edevicename log field value is not empty, then the asset_id:edevicename log field is mapped to the principal.asset.asset_id UDM field.
deviceplatform principal.asset.attribute.labels[deviceplatform]
deviceosversion principal.asset.platform_software.platform_version
devicemodel principal.asset.hardware.model
deviceappversion additional.fields[deviceappversion]
deviceowner principal.user.userid
b64deviceowner principal.user.userid
edeviceowner principal.user.userid
odeviceowner security_result.detection_fields[odeviceowner]
devicehostname principal.hostname
b64devicehostname principal.hostname
edevicehostname principal.hostname
odevicehostname security_result.detection_fields[odevicehostname]
datacenter target.location.name
datacentercity target.location.city
datacentercountry target.location.country_or_region
dsttype target.resource.resource_subtype
filedoctype additional.fields[filedoctype]
filedstpath target.file.full_path
b64filedstpath target.file.full_path
efiledstpath target.file.full_path
filemd5 target.file.md5 If the filemd5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the filemd5 log field is mapped to the target.file.md5 UDM field.
filesha target.file.sha256 If the filesha log field value matches the regular expression pattern ^[0-9a-f]+$, then the filesha log field is mapped to the target.file.sha256 UDM field.
filesrcpath src.file.full_path
b64filesrcpath src.file.full_path
efilesrcpath src.file.full_path
filetypecategory additional.fields[filetypecategory]
filetypename target.file.mime_type
itemdstname target.resource.name
b64itemdstname target.resource.name
eitemdstname target.resource.name
itemname target.resource.attribute.labels[itemname]
b64itemname target.resource.attribute.labels[itemname]
eitemname target.resource.attribute.labels[itemname]
itemsrcname src.resource.name
b64itemsrcname src.resource.name
eitemsrcname src.resource.name
itemtype target.resource.attribute.labels[itemtype]
ofiledstpath security_result.detection_fields[ofiledstpath]
ofilesrcpath security_result.detection_fields[ofilesrcpath]
oitemdstname security_result.detection_fields[oitemdstname]
oitemname security_result.detection_fields[oitemname]
odlpengnames security_result.detection_fields[odlpengnames]
oitemsrcname security_result.detection_fields[oitemsrcname]
srctype src.resource.resource_subtype
actiontaken security_result.action_details
security_result.action If the actiontaken log field value matches the regular expression pattern (?i)allow, then the security_result.action UDM field is set to ALLOW.

Else, if the actiontaken log field value matches the regular expression pattern (?i)block, then the security_result.action UDM field is set to BLOCK.
activitytype metadata.product_event_type
addinfo additional.fields[addinfo]
channel security_result.detection_fields[channel]
confirmaction security_result.detection_fields[confirmaction]
confirmjust security_result.description
dlpdictcount security_result.detection_fields[dlpdictcount]
dlpdictnames security_result.detection_fields[dlpdictnames]
b64dlpdictnames security_result.detection_fields[dlpdictnames]
edlpdictnames security_result.detection_fields[dlpdictnames]
dlpenginenames security_result.detection_fields[dlpenginenames]
b64dlpengnames security_result.detection_fields[dlpenginenames]
edlpengnames security_result.detection_fields[dlpenginenames]
expectedaction security_result.detection_fields[expectedaction]
logtype security_result.category_details
odlpdictnames security_result.detection_fields[odlpdictnames]
ootherrulelabels security_result.detection_fields[ootherrulelabels]
otherrulelabels security_result.rule_labels[otherrulelabels]
b64otherrulelabels security_result.rule_labels[otherrulelabels]
eotherrulelabels security_result.rule_labels[otherrulelabels]
otriggeredrulelabel security_result.rule_labels[otriggeredrulelabel]
severity security_result.severity_details
security_result.severity If the severity log field value matches the regular expression pattern (?i)High, then the security_result.severity UDM field is set to HIGH.

Else, if the severity log field value matches the regular expression pattern (?i)Medium, then the security_result.severity UDM field is set to MEDIUM.

Else, if the severity log field value matches the regular expression pattern (?i)Low, then the security_result.severity UDM field is set to LOW.

Else, if the severity log field value matches the regular expression pattern (?i)Info, then the security_result.severity UDM field is set to INFORMATIONAL.
rulename security_result.rule_name
b64triggeredrulelabel security_result.rule_name
etriggeredrulelabel security_result.rule_name
zdpmode security_result.detection_fields[zdpmode]
tz additional.fields[tz]
ss additional.fields[ss]
mm additional.fields[mm]
hh additional.fields[hh]
dd additional.fields[dd]
mth additional.fields[mth]
yyyy additional.fields[yyyy]
sourcetype additional.fields[sourcetype]
eventtime metadata.event_timestamp
time metadata.collected_timestamp
rtime additional.fields[rtime]
metadata.vendor_name The metadata.vendor_name UDM field is set to Zscaler.
metadata.product_name The metadata.product_name UDM field is set to DLP.
metadata.event_type If the activitytype log field value contain one of the following values, then the metadata.event_type UDM field is set to FILE_UNCATEGORIZED.
  • Upload
  • Download
Else, if the activitytype log field value is equal to File Copy, then the metadata.event_type UDM field is set to FILE_COPY.

Else, if the activitytype log field value is equal to File Read, then the metadata.event_type UDM field is set to FILE_READ.

Else, if the activitytype log field value is equal to File Write, then the metadata.event_type UDM field is set to FILE_MODIFICATION.

Else, if the activitytype log field value is equal to Email Sent, then the metadata.event_type UDM field is set to EMAIL_UNCATEGORIZED.

Else, if the activitytype log field value is equal to Print, then the metadata.event_type UDM field is set to STATUS_UPDATE.

Else, the metadata.event_type UDM field is set to GENERIC_EVENT.

需要更多帮助?向社区成员和 Google SecOps 专业人士寻求解答。