Recopila registros de DNS de Zscaler

Compatible con:

Google SecOps SIEM

Nota: Esta función está sujeta a las Condiciones de las ofertas de la fase previa a la DG de las Condiciones Específicas del Servicio de Operaciones de Seguridad de Google. Las características de la fase previa a la DG pueden tener asistencia limitada, y es posible que los cambios en las características de la fase previa a la DG no sean compatibles con otras versiones de la fase previa a la DG. Para obtener más información, consulta los lineamientos del servicio de asistencia técnica de Google Security Operations y las Condiciones específicas del servicio de Google Security Operations.

En este documento, se describe cómo puedes exportar registros de DNS de Zscaler configurando un feed de operaciones de seguridad de Google y cómo los campos de registro se asignan a los campos del modelo de datos unificados (UDM) de SecOps de Google.

Para obtener más información, consulta la descripción general de la transferencia de datos a Google SecOps.

Una implementación típica consta del DNS de Zscaler y el feed de webhook de Google SecOps configurado para enviar registros a Google SecOps. Cada implementación de cliente puede diferir y ser más compleja.

La implementación contiene los siguientes componentes:

• DNS de Zscaler: Es la plataforma desde la que recopilas registros.

• Feed de Google SecOps: Es el feed de Google SecOps que recupera registros del DNS de Zscaler y escribe registros en Google SecOps.

• Google SecOps: Retiene y analiza los registros.

Una etiqueta de transferencia identifica el analizador que normaliza los datos de registro sin procesar al formato estructurado del UDM. La información de este documento se aplica al analizador con la etiqueta de transferencia ZSCALER_DNS.

Antes de comenzar

• Asegúrate de tener acceso a la consola de acceso a Internet de Zscaler. Para obtener más información, consulta la Ayuda de ZIA de acceso seguro a Internet y SaaS.
• Asegúrate de usar el DNS de Zscaler 2024 o una versión posterior.
• Asegúrate de que todos los sistemas de la arquitectura de implementación estén configurados con la zona horaria UTC.
• Asegúrate de tener la clave de API necesaria para completar la configuración del feed en Google SecOps. Para obtener más información, consulta Configura claves de API.

Configura un feed de transferencia en Google SecOps para transferir registros de DNS de Zscaler

1. Ve a Configuración de SIEM > Feeds.
2. Haz clic en Agregar nueva.
3. En el campo Nombre del feed, ingresa un nombre para el feed (por ejemplo, Registros de DNS de Zscaler).
4. Selecciona Webhook como el Tipo de origen.
5. Selecciona ZScaler DNS como el Tipo de registro.
6. Haz clic en Siguiente.
7. Opcional: Ingresa valores para los siguientes parámetros de entrada:
   1. Delimitador de división: Es el delimitador que se usa para separar las líneas de los registros. Deja el campo en blanco si no se usa un delimitador.
   2. Espacio de nombres del activo: Es el espacio de nombres del activo.
   3. Etiquetas de transferencia: Es la etiqueta que se aplicará a los eventos de este feed.
8. Haz clic en Siguiente.
9. Revisa la configuración del nuevo feed y, luego, haz clic en Enviar.
10. Haz clic en Generate Secret Key para generar una clave secreta que autentique este feed.

Configura el DNS de Zscaler

1. En la consola de acceso a Internet de Zscaler, haz clic en Administración > Servicio de transmisión de Nanolog > Feeds de NSS de Cloud y, luego, en Agregar feed de NSS de Cloud.
2. Aparecerá la ventana Add Cloud NSS Feed. En la ventana Add Cloud NSS Feed, ingresa los detalles.
3. Ingresa un nombre para el feed en el campo Nombre del feed.
4. Selecciona NSS para DNS en Tipo de NSS.
5. Selecciona el estado de la lista Estado para activar o desactivar el feed de NSS.
6. Mantén el valor en el menú desplegable SIEM Rate como Unlimited. Para suprimir el flujo de salida debido a licencias o a otras restricciones, cambia el valor.
7. Selecciona Otro en la lista Tipo de SIEM.
8. Selecciona Disabled en la lista OAuth 2.0 Authentication.
9. Ingresa un límite de tamaño para una carga útil de solicitud HTTP individual en las prácticas recomendadas de SIEM en Max Batch Size. Por ejemplo, 512 KB.

10. Ingresa la URL HTTPS del extremo de API de Chronicle en la URL de la API con el siguiente formato:

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    

    • CHRONICLE_REGION: Es la región en la que se aloja tu instancia de Chronicle. Por ejemplo, EE.UU.
    • GOOGLE_PROJECT_NUMBER: Es el número de proyecto de BYOP. Obtén esta información de C4.
    • LOCATION: Región de Chronicle. Por ejemplo, EE.UU.
    • CUSTOMER_ID: ID de cliente de Chronicle. Obtener de C4
    • FEED_ID: Es el ID del feed que se muestra en la IU del feed en el nuevo webhook creado.
    • URL de API de muestra:

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    

11. Haz clic en Agregar encabezado HTTP para agregar más encabezados HTTP con claves y valores.

    Por ejemplo, encabezado 1 : Key1: X-goog-api-key y Value1: Clave de API generada en las credenciales de la API de BYOP de Google Cloud .

12. Selecciona Registros de DNS en la lista Tipos de registro.

13. Selecciona JSON en la lista Tipo de salida del feed.

14. Establece el carácter de escape del feed en , \ ".

15. Para agregar un campo nuevo al Formato de salida del feed, selecciona Personalizado en la lista Tipo de salida del feed.

16. Copia y pega el Formato de salida del feed y agrega campos nuevos. Asegúrate de que los nombres de las claves coincidan con los nombres de los campos reales.

17. A continuación, se muestra el formato de salida del feed predeterminado:

      \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","respipcategory":"%s{respipcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\}
    

18. Selecciona la zona horaria para el campo Time en el archivo de salida en la lista Timezone. De forma predeterminada, la zona horaria se establece en la de tu organización.

19. Revisa la configuración establecida.

20. Haz clic en Guardar para probar la conectividad. Si la conexión se realiza correctamente, aparecerá una marca de verificación verde acompañada del mensaje Test Connectivity Successful: OK (200).

Para obtener más información sobre los feeds de Google SecOps, consulta la documentación de los feeds de Google SecOps. Para obtener información sobre los requisitos de cada tipo de feed, consulta Configuración de feeds por tipo.

Si tienes problemas cuando creas feeds, comunícate con el equipo de asistencia de SecOps de Google.

Referencia de la asignación de campos

Referencia de asignación de campos: ZSCALER_DNS

En la siguiente tabla, se enumeran los campos de registro del tipo de registro ZSCALER_DNS y sus campos de UDM correspondientes.

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to NETWORK_DNS.
	metadata.product_name	The metadata.product_name UDM field is set to DNS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Zscaler.
	metadata.description	If the category log field value is not empty and the durationms log field value is not empty, then the NSSDNSLog | Duration: durationms ms | Category: category log field is mapped to the metadata.description UDM field. Else, if the category log field value is not empty, then the DNS request to \category\ log field is mapped to the metadata.description UDM field.
recordid	metadata.product_log_id
datetime	metadata.event_timestamp
epochtime	metadata.event_timestamp
	network.application_protocol	The network.application_protocol UDM field is set to DNS.
	network.dns.response_code	If the dns_resp log field value is equal to NOERROR, then the network.dns.response_code UDM field is set to 0. Else, if the dns_resp log field value is equal to FORMERR, then the network.dns.response_code UDM field is set to 1. Else, if the dns_resp log field value is equal to SERVFAIL, then the network.dns.response_code UDM field is set to 2. Else, if the dns_resp log field value is equal to NXDOMAIN, then the network.dns.response_code UDM field is set to 3. Else, if the dns_resp log field value is equal to NOTIMP, then the network.dns.response_code UDM field is set to 4. Else, if the dns_resp log field value is equal to REFUSED, then the network.dns.response_code UDM field is set to 5. Else, if the dns_resp log field value is equal to YXDOMAIN, then the network.dns.response_code UDM field is set to 6. Else, if the dns_resp log field value is equal to YXRRSET, then the network.dns.response_code UDM field is set to 7. Else, if the dns_resp log field value is equal to NXRRSET, then the network.dns.response_code UDM field is set to 8. Else, if the dns_resp log field value is equal to NOTAUTH, then the network.dns.response_code UDM field is set to 9. Else, if the dns_resp log field value is equal to NOTZONE, then the network.dns.response_code UDM field is set to 10.
dns_resp	network.dns.answers.data
	network.dns.answers.type	If the restype log field value matches the regular expression pattern ipv4, then the network.dns.answers.type UDM field is set to 1. Else, if the restype log field value matches the regular expression pattern ipv6, then the network.dns.answers.type UDM field is set to 28.
dns_req	network.dns.questions.name
	network.dns.questions.type	If the record_type log field value is equal to A, then the network.dns.questions.type UDM field is set to 1. Else, if the record_type log field value is equal to NS, then the network.dns.questions.type UDM field is set to 2. Else, if the record_type log field value is equal to MD, then the network.dns.questions.type UDM field is set to 3. Else, if the record_type log field value is equal to MF, then the network.dns.questions.type UDM field is set to 4. Else, if the record_type log field value is equal to CNAME, then the network.dns.questions.type UDM field is set to 5. Else, if the record_type log field value is equal to SOA, then the network.dns.questions.type UDM field is set to 6. Else, if the record_type log field value is equal to MB, then the network.dns.questions.type UDM field is set to 7. Else, if the record_type log field value is equal to MG, then the network.dns.questions.type UDM field is set to 8. Else, if the record_type log field value is equal to MR, then the network.dns.questions.type UDM field is set to 9. Else, if the record_type log field value is equal to NULL, then the network.dns.questions.type UDM field is set to 10. Else, if the record_type log field value is equal to WKS, then the network.dns.questions.type UDM field is set to 11. Else, if the record_type log field value is equal to PTR, then the network.dns.questions.type UDM field is set to 12. Else, if the record_type log field value is equal to HINFO, then the network.dns.questions.type UDM field is set to 13. Else, if the record_type log field value is equal to MINFO, then the network.dns.questions.type UDM field is set to 14. Else, if the record_type log field value is equal to MX, then the network.dns.questions.type UDM field is set to 15. Else, if the record_type log field value is equal to TXT, then the network.dns.questions.type UDM field is set to 16. Else, if the record_type log field value is equal to RP, then the network.dns.questions.type UDM field is set to 17. Else, if the record_type log field value is equal to AFSDB, then the network.dns.questions.type UDM field is set to 18. Else, if the record_type log field value is equal to X25, then the network.dns.questions.type UDM field is set to 19. Else, if the record_type log field value is equal to ISDN, then the network.dns.questions.type UDM field is set to 20. Else, if the record_type log field value is equal to RT, then the network.dns.questions.type UDM field is set to 21. Else, if the record_type log field value is equal to NSAP, then the network.dns.questions.type UDM field is set to 22. Else, if the record_type log field value is equal to NSAP-PTR, then the network.dns.questions.type UDM field is set to 23. Else, if the record_type log field value is equal to SIG, then the network.dns.questions.type UDM field is set to 24. Else, if the record_type log field value is equal to KEY, then the network.dns.questions.type UDM field is set to 25. Else, if the record_type log field value is equal to PX, then the network.dns.questions.type UDM field is set to 26. Else, if the record_type log field value is equal to GPOS, then the network.dns.questions.type UDM field is set to 27. Else, if the record_type log field value is equal to AAAA, then the network.dns.questions.type UDM field is set to 28. Else, if the record_type log field value is equal to LOC, then the network.dns.questions.type UDM field is set to 29. Else, if the record_type log field value is equal to NXT, then the network.dns.questions.type UDM field is set to 30. Else, if the record_type log field value is equal to EID, then the network.dns.questions.type UDM field is set to 31. Else, if the record_type log field value is equal to NIMLOC, then the network.dns.questions.type UDM field is set to 32. Else, if the record_type log field value is equal to SRV, then the network.dns.questions.type UDM field is set to 33. Else, if the record_type log field value is equal to ATMA, then the network.dns.questions.type UDM field is set to 34. Else, if the record_type log field value is equal to NAPTR, then the network.dns.questions.type UDM field is set to 35. Else, if the record_type log field value is equal to KX, then the network.dns.questions.type UDM field is set to 36. Else, if the record_type log field value is equal to CERT, then the network.dns.questions.type UDM field is set to 37. Else, if the record_type log field value is equal to A6, then the network.dns.questions.type UDM field is set to 38. Else, if the record_type log field value is equal to DNAME, then the network.dns.questions.type UDM field is set to 39. Else, if the record_type log field value is equal to SINK, then the network.dns.questions.type UDM field is set to 40. Else, if the record_type log field value is equal to OPT, then the network.dns.questions.type UDM field is set to 41. Else, if the record_type log field value is equal to APL, then the network.dns.questions.type UDM field is set to 42. Else, if the record_type log field value is equal to DS, then the network.dns.questions.type UDM field is set to 43. Else, if the record_type log field value is equal to SSHFP, then the network.dns.questions.type UDM field is set to 44. Else, if the record_type log field value is equal to IPSECKEY, then the network.dns.questions.type UDM field is set to 45. Else, if the record_type log field value is equal to RRSIG, then the network.dns.questions.type UDM field is set to 46. Else, if the record_type log field value is equal to NSEC, then the network.dns.questions.type UDM field is set to 47. Else, if the record_type log field value is equal to DNSKEY, then the network.dns.questions.type UDM field is set to 48. Else, if the record_type log field value is equal to DHCID, then the network.dns.questions.type UDM field is set to 49. Else, if the record_type log field value is equal to NSEC3, then the network.dns.questions.type UDM field is set to 50. Else, if the record_type log field value is equal to NSEC3PARAM, then the network.dns.questions.type UDM field is set to 51. Else, if the record_type log field value is equal to TLSA, then the network.dns.questions.type UDM field is set to 52. Else, if the record_type log field value is equal to SMIMEA, then the network.dns.questions.type UDM field is set to 53. Else, if the record_type log field value is equal to UNASSIGNED, then the network.dns.questions.type UDM field is set to 54. Else, if the record_type log field value is equal to HIP, then the network.dns.questions.type UDM field is set to 55. Else, if the record_type log field value is equal to NINFO, then the network.dns.questions.type UDM field is set to 56. Else, if the record_type log field value is equal to RKEY, then the network.dns.questions.type UDM field is set to 57. Else, if the record_type log field value is equal to TALINK, then the network.dns.questions.type UDM field is set to 58. Else, if the record_type log field value is equal to CDS, then the network.dns.questions.type UDM field is set to 59. Else, if the record_type log field value is equal to CDNSKEY, then the network.dns.questions.type UDM field is set to 60. Else, if the record_type log field value is equal to OPENPGPKEY, then the network.dns.questions.type UDM field is set to 61. Else, if the record_type log field value is equal to CSYNC, then the network.dns.questions.type UDM field is set to 62. Else, if the record_type log field value is equal to ZONEMD, then the network.dns.questions.type UDM field is set to 63. Else, if the record_type log field value is equal to SVCB, then the network.dns.questions.type UDM field is set to 64. Else, if the record_type log field value is equal to HTTPS, then the network.dns.questions.type UDM field is set to 65. Else, if the record_type log field value is equal to SPF, then the network.dns.questions.type UDM field is set to 99. Else, if the record_type log field value is equal to UINFO, then the network.dns.questions.type UDM field is set to 100. Else, if the record_type log field value is equal to UID, then the network.dns.questions.type UDM field is set to 101. Else, if the record_type log field value is equal to GID, then the network.dns.questions.type UDM field is set to 102. Else, if the record_type log field value is equal to UNSPEC, then the network.dns.questions.type UDM field is set to 103. Else, if the record_type log field value is equal to NID, then the network.dns.questions.type UDM field is set to 104. Else, if the record_type log field value is equal to L32, then the network.dns.questions.type UDM field is set to 105. Else, if the record_type log field value is equal to L64, then the network.dns.questions.type UDM field is set to 106. Else, if the record_type log field value is equal to LP, then the network.dns.questions.type UDM field is set to 107. Else, if the record_type log field value is equal to EUI48, then the network.dns.questions.type UDM field is set to 108. Else, if the record_type log field value is equal to EUI64, then the network.dns.questions.type UDM field is set to 109. Else, if the record_type log field value is equal to TKEY, then the network.dns.questions.type UDM field is set to 249. Else, if the record_type log field value is equal to TSIG, then the network.dns.questions.type UDM field is set to 250. Else, if the record_type log field value is equal to IXFR, then the network.dns.questions.type UDM field is set to 251. Else, if the record_type log field value is equal to AXFR, then the network.dns.questions.type UDM field is set to 252. Else, if the record_type log field value is equal to MAILB, then the network.dns.questions.type UDM field is set to 253. Else, if the record_type log field value is equal to MAILA, then the network.dns.questions.type UDM field is set to 254. Else, if the record_type log field value is equal to ALL, then the network.dns.questions.type UDM field is set to 255. Else, if the record_type log field value is equal to URI, then the network.dns.questions.type UDM field is set to 256. Else, if the record_type log field value is equal to CAA, then the network.dns.questions.type UDM field is set to 257. Else, if the record_type log field value is equal to AVC, then the network.dns.questions.type UDM field is set to 258. Else, if the record_type log field value is equal to DOA, then the network.dns.questions.type UDM field is set to 259. Else, if the record_type log field value is equal to AMTRELAY, then the network.dns.questions.type UDM field is set to 260. Else, if the record_type log field value is equal to TA, then the network.dns.questions.type UDM field is set to 32768. Else, if the record_type log field value is equal to DLV, then the network.dns.questions.type UDM field is set to 32769.
dns_reqtype	additional.fields [dns_reqtype]
http_code	network.http.response_code
protocol	network.ip_protocol	If the protocol log field value contain one of the following values, then the protocol log field is mapped to the network.ip_protocol UDM field. TCP EIGRP ESP ETHERIP GRE ICMP IGMP IP6IN4 PIM UDP VRRP .
durationms	network.session_duration.seconds
devicemodel	principal.asset.hardware.model
devicename	principal.asset.asset_id
devicehostname	principal.asset.hostname
	principal.asset.platform_software.platform	If the deviceostype log field value matches the regular expression pattern (?i)win, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the deviceostype log field value matches the regular expression pattern (?i)lin, then the principal.asset.platform_software.platform UDM field is set to LINUX.
deviceosversion	principal.asset.platform_software.platform_version
company	principal.user.company_name
department	principal.user.department
user	principal.user.email_addresses	If the user log field value matches the regular expression pattern (^.@.$) or the login log field value matches the regular expression pattern (^.@.$), then if the user log field value is not empty, then the user log field is mapped to the principal.user.email_addresses UDM field.
login	principal.user.email_addresses	If the user log field value matches the regular expression pattern (^.@.$) or the login log field value matches the regular expression pattern (^.@.$), then if the user log field value is not empty, then else, the login log field is mapped to the principal.user.email_addresses UDM field.
deviceowner	principal.user.userid
clt_sip	principal.ip
location	principal.location.name
reqrulelabel	security_result.rule_name
rule	security_result.rule_name
	security_result.action	If the reqaction log field value matches the regular expression pattern (?i)BLOCK, then the security_result.action UDM field is set to BLOCK. Else, if the reqaction log field value matches the regular expression pattern (?i)ALLOW, then the security_result.action UDM field is set to ALLOW.
reqaction	security_result.action_details
	security_result.category	If the category log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
category	security_result.category_details
resrulelabel	security_result.rule_name
	security_result.action	If the resaction log field value matches the regular expression pattern (?i)BLOCK, then the security_result.action UDM field is set to BLOCK. Else, if the resaction log field value matches the regular expression pattern (?i)ALLOW, then the security_result.action UDM field is set to ALLOW.
resaction	security_result.action_details
	security_result.category	If the respipcategory log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
respipcategory	security_result.category_details
ecs_slot	security_result.rule_labels [ecs_slot]	If the dnsgw_slot log field value is empty, then the ecs_slot log field is mapped to the security_result.rule_name UDM field.
dnsgw_slot	security_result.rule_name	If the dnsgw_slot log field value is not empty, then the dnsgw_slot log field is mapped to the security_result.rule_name UDM field.
ecs_slot	security_result.rule_name	If the dnsgw_slot log field value is not empty, then the ecs_slot log field is mapped to the security_result.rule_labels UDM field.
dnsapp	target.application
srv_dip	target.ip
srv_dport	target.port
datacentercity	target.location.city
datacentercountry	target.location.country_or_region
datacenter	target.location.name
cloudname	security_result.detection_fields [cloudname]
dnsappcat	security_result.detection_fields [dnsappcat]
ecs_prefix	security_result.detection_fields [ecs_prefix]
error	security_result.detection_fields [error]
istcp	security_result.detection_fields [istcp]
ocip	security_result.detection_fields [ocip]
odevicehostname	security_result.detection_fields [odevicehostname]
odeviceowner	security_result.detection_fields [odeviceowner]
odevicename	security_result.detection_fields [odevicename]
odomcat	security_result.detection_fields [odomcat]
dnsgw_flags	security_result.detection_fields[dnsgw_flags]
dnsgw_srv_proto	security_result.detection_fields[dnsgw_srv_proto]
erulelabel	security_result.rule_labels [erulelabel]
ethreatname	security_result.threat_name
durationms	additional.fields [durationms]	If the durationms log field value is equal to 1, then the durationms log field is mapped to the additional.fields.durationms UDM field.
sourcetype	additional.fields[sourcetype]
deviceappversion	additional.fields [deviceappversion]
devicetype	additional.fields [devicetype]
eedone	additional.fields [eedone]
tz	additional.fields [tz]
ss	additional.fields [ss]
mm	additional.fields [mm]
hh	additional.fields [hh]
dd	additional.fields [dd]
mth	additional.fields [mth]
yyyy	additional.fields [yyyy]
mon	additional.fields [mon]
day	additional.fields [day]