Cette page a été traduite par l'API Cloud Translation.

Collecter les journaux DNS Zscaler

Compatible avec:

Google SecOps SIEM

Ce document explique comment exporter les journaux DNS Zscaler en configurant un flux Google Security Operations, et comment les champs de journal correspondent aux champs du modèle de données unifié (UDM) Google SecOps.

Pour en savoir plus, consultez la section Présentation de l'ingestion de données dans Google SecOps.

Un déploiement typique se compose du DNS Zscaler et du flux de webhook Google SecOps configuré pour envoyer des journaux à Google SecOps. Chaque déploiement client peut être différent et plus complexe.

Le déploiement contient les composants suivants:

DNS Zscaler: plate-forme à partir de laquelle vous collectez les journaux.
Flux Google SecOps: flux Google SecOps qui extrait les journaux du DNS Zscaler et les écrit dans Google SecOps.
Google SecOps: conserve et analyse les journaux.

Un libellé d'ingestion identifie l'analyseur qui normalise les données de journal brutes au format UDM structuré. Les informations de ce document s'appliquent à l'analyseur avec le libellé d'ingestion ZSCALER_DNS.

Avant de commencer

Assurez-vous d'avoir accès à la console Zscaler Internet Access. Pour en savoir plus, consultez l'aide ZIA sur la sécurisation de l'accès à Internet et aux services SaaS.
Assurez-vous d'utiliser Zscaler DNS 2024 ou une version ultérieure.
Assurez-vous que tous les systèmes de l'architecture de déploiement sont configurés avec le fuseau horaire UTC.
Assurez-vous de disposer de la clé API nécessaire pour terminer la configuration du flux dans Google SecOps. Pour en savoir plus, consultez Configurer des clés API.

Configurer un flux d'ingestion dans Google SecOps pour ingérer les journaux DNS Zscaler

Accédez à Paramètres du SIEM > Flux.
Cliquez sur Ajouter.
Dans le champ Nom du flux, saisissez un nom pour le flux (par exemple, Journaux DNS Zscaler).
Sélectionnez Webhook comme type de source.
Sélectionnez DNS ZScaler comme Type de journal.
Cliquez sur Suivant.
Facultatif: saisissez des valeurs pour les paramètres d'entrée suivants :
1. Délimiteur de fractionnement: délimiteur utilisé pour séparer les lignes de journal. Laissez ce champ vide si aucun délimiteur n'est utilisé.
2. Espace de noms de l'asset: espace de noms de l'asset.
3. Libellés d'ingestion: libellé à appliquer aux événements de ce flux.
Cliquez sur Suivant.
Vérifiez la configuration de votre nouveau flux, puis cliquez sur Envoyer.
Cliquez sur Générer une clé secrète pour générer une clé secrète permettant d'authentifier ce flux.

Configurer le DNS Zscaler

Dans la console Zscaler Internet Access, cliquez sur Administration > Nanolog Streaming Service > Cloud NSS Feeds (Flux NSS cloud), puis sur Add Cloud NSS Feed (Ajouter un flux NSS cloud).
La fenêtre Ajouter un flux NSS cloud s'affiche. Dans la fenêtre Add Cloud NSS Feed (Ajouter un flux NSS cloud), saisissez les informations.
Attribuez un nom au flux dans le champ Nom du flux.
Sélectionnez NSS pour DNS dans Type de NSS.
Sélectionnez l'état dans la liste État pour activer ou désactiver le flux NSS.
Laissez la valeur Illimité dans le menu déroulant Taux du SIEM. Pour supprimer le flux de sortie en raison de licences ou d'autres contraintes, modifiez la valeur.
Sélectionnez Autre dans la liste Type de SIEM.
Sélectionnez Désactivée dans la liste Authentification OAuth 2.0.
Dans Taille de lot maximale, saisissez une limite de taille pour la charge utile d'une requête HTTP individuelle conformément aux bonnes pratiques du SIEM. (par exemple, 512 Ko).
Saisissez l'URL HTTPS du point de terminaison de l'API Chronicle dans l'URL de l'API au format suivant:
```
  https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
```
- CHRONICLE_REGION: région où est hébergée votre instance Chronicle. (par exemple, États-Unis)
- GOOGLE_PROJECT_NUMBER: numéro de projet BYOP. Obtenez-le auprès de C4.
- LOCATION: région Chronicle. (par exemple, États-Unis)
- CUSTOMER_ID: ID client Chronicle. Obtenir de C4.
- FEED_ID: ID du flux affiché dans l'interface utilisateur du flux du nouveau webhook créé
- Exemple d'URL d'API:
```
https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
```
Cliquez sur Ajouter un en-tête HTTP pour ajouter d'autres en-têtes HTTP avec des clés et des valeurs.
Par exemple, en-tête 1 : Key1: X-goog-api-key et Value1: clé API générée sur les identifiants d'API BYOP Google Cloud .
Sélectionnez Journaux DNS dans la liste Types de journaux.
Sélectionnez JSON dans la liste Type de sortie du flux.
Définissez Feed Escape Character (Caractère d'échappement du flux) sur , \ ".
Pour ajouter un champ au format de sortie du flux,sélectionnez Personnalisé dans la liste Type de sortie du flux.
Copiez-collez le format de sortie du flux, puis ajoutez de nouveaux champs. Assurez-vous que les noms des clés correspondent aux noms des champs.

Voici le format de sortie du flux par défaut:

  \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","respipcategory":"%s{respipcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\}

Dans la liste Fuseau horaire, sélectionnez le fuseau horaire du champ Heure dans le fichier de sortie. Par défaut, le fuseau horaire est défini sur celui de votre organisation.
Vérifiez les paramètres configurés.
Cliquez sur Enregistrer pour tester la connectivité. Si la connexion aboutit, une coche verte s'affiche, accompagnée du message Test de connectivité réussi: OK (200).

Pour en savoir plus sur les flux Google SecOps, consultez la documentation sur les flux Google SecOps. Pour en savoir plus sur les exigences de chaque type de flux, consultez la section Configuration des flux par type.

Si vous rencontrez des problèmes lors de la création de flux, contactez l'assistance Google SecOps.

Référence du mappage de champs

Référence de mappage de champ: ZSCALER_DNS

Le tableau suivant répertorie les champs de journal du type de journal ZSCALER_DNS et les champs UDM correspondants.

Log field	UDM mapping	Logic
	`metadata.event_type`	The `metadata.event_type` UDM field is set to `NETWORK_DNS`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `DNS`.
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Zscaler`.
	`metadata.description`	If the `category` log field value is not empty and the `durationms` log field value is not empty, then the `NSSDNSLog \| Duration: durationms ms \| Category: category` log field is mapped to the `metadata.description` UDM field. Else, if the `category` log field value is not empty, then the `DNS request to \category\` log field is mapped to the `metadata.description` UDM field.
`recordid`	`metadata.product_log_id`
`datetime`	`metadata.event_timestamp`
`epochtime`	`metadata.event_timestamp`
	`network.application_protocol`	The `network.application_protocol` UDM field is set to `DNS`.
	`network.dns.response_code`	If the `dns_resp` log field value is equal to `NOERROR`, then the `network.dns.response_code` UDM field is set to `0`. Else, if the `dns_resp` log field value is equal to `FORMERR`, then the `network.dns.response_code` UDM field is set to `1`. Else, if the `dns_resp` log field value is equal to `SERVFAIL`, then the `network.dns.response_code` UDM field is set to `2`. Else, if the `dns_resp` log field value is equal to `NXDOMAIN`, then the `network.dns.response_code` UDM field is set to `3`. Else, if the `dns_resp` log field value is equal to `NOTIMP`, then the `network.dns.response_code` UDM field is set to `4`. Else, if the `dns_resp` log field value is equal to `REFUSED`, then the `network.dns.response_code` UDM field is set to `5`. Else, if the `dns_resp` log field value is equal to `YXDOMAIN`, then the `network.dns.response_code` UDM field is set to `6`. Else, if the `dns_resp` log field value is equal to `YXRRSET`, then the `network.dns.response_code` UDM field is set to `7`. Else, if the `dns_resp` log field value is equal to `NXRRSET`, then the `network.dns.response_code` UDM field is set to `8`. Else, if the `dns_resp` log field value is equal to `NOTAUTH`, then the `network.dns.response_code` UDM field is set to `9`. Else, if the `dns_resp` log field value is equal to `NOTZONE`, then the `network.dns.response_code` UDM field is set to `10`.
`dns_resp`	`network.dns.answers.data`
	`network.dns.answers.type`	If the `restype` log field value matches the regular expression pattern `ipv4`, then the `network.dns.answers.type` UDM field is set to `1`. Else, if the `restype` log field value matches the regular expression pattern `ipv6`, then the `network.dns.answers.type` UDM field is set to `28`.
`dns_req`	`network.dns.questions.name`
	`network.dns.questions.type`	If the `record_type` log field value is equal to `A`, then the `network.dns.questions.type` UDM field is set to `1`. Else, if the `record_type` log field value is equal to `NS`, then the `network.dns.questions.type` UDM field is set to `2`. Else, if the `record_type` log field value is equal to `MD`, then the `network.dns.questions.type` UDM field is set to `3`. Else, if the `record_type` log field value is equal to `MF`, then the `network.dns.questions.type` UDM field is set to `4`. Else, if the `record_type` log field value is equal to `CNAME`, then the `network.dns.questions.type` UDM field is set to `5`. Else, if the `record_type` log field value is equal to `SOA`, then the `network.dns.questions.type` UDM field is set to `6`. Else, if the `record_type` log field value is equal to `MB`, then the `network.dns.questions.type` UDM field is set to `7`. Else, if the `record_type` log field value is equal to `MG`, then the `network.dns.questions.type` UDM field is set to `8`. Else, if the `record_type` log field value is equal to `MR`, then the `network.dns.questions.type` UDM field is set to `9`. Else, if the `record_type` log field value is equal to `NULL`, then the `network.dns.questions.type` UDM field is set to `10`. Else, if the `record_type` log field value is equal to `WKS`, then the `network.dns.questions.type` UDM field is set to `11`. Else, if the `record_type` log field value is equal to `PTR`, then the `network.dns.questions.type` UDM field is set to `12`. Else, if the `record_type` log field value is equal to `HINFO`, then the `network.dns.questions.type` UDM field is set to `13`. Else, if the `record_type` log field value is equal to `MINFO`, then the `network.dns.questions.type` UDM field is set to `14`. Else, if the `record_type` log field value is equal to `MX`, then the `network.dns.questions.type` UDM field is set to `15`. Else, if the `record_type` log field value is equal to `TXT`, then the `network.dns.questions.type` UDM field is set to `16`. Else, if the `record_type` log field value is equal to `RP`, then the `network.dns.questions.type` UDM field is set to `17`. Else, if the `record_type` log field value is equal to `AFSDB`, then the `network.dns.questions.type` UDM field is set to `18`. Else, if the `record_type` log field value is equal to `X25`, then the `network.dns.questions.type` UDM field is set to `19`. Else, if the `record_type` log field value is equal to `ISDN`, then the `network.dns.questions.type` UDM field is set to `20`. Else, if the `record_type` log field value is equal to `RT`, then the `network.dns.questions.type` UDM field is set to `21`. Else, if the `record_type` log field value is equal to `NSAP`, then the `network.dns.questions.type` UDM field is set to `22`. Else, if the `record_type` log field value is equal to `NSAP-PTR`, then the `network.dns.questions.type` UDM field is set to `23`. Else, if the `record_type` log field value is equal to `SIG`, then the `network.dns.questions.type` UDM field is set to `24`. Else, if the `record_type` log field value is equal to `KEY`, then the `network.dns.questions.type` UDM field is set to `25`. Else, if the `record_type` log field value is equal to `PX`, then the `network.dns.questions.type` UDM field is set to `26`. Else, if the `record_type` log field value is equal to `GPOS`, then the `network.dns.questions.type` UDM field is set to `27`. Else, if the `record_type` log field value is equal to `AAAA`, then the `network.dns.questions.type` UDM field is set to `28`. Else, if the `record_type` log field value is equal to `LOC`, then the `network.dns.questions.type` UDM field is set to `29`. Else, if the `record_type` log field value is equal to `NXT`, then the `network.dns.questions.type` UDM field is set to `30`. Else, if the `record_type` log field value is equal to `EID`, then the `network.dns.questions.type` UDM field is set to `31`. Else, if the `record_type` log field value is equal to `NIMLOC`, then the `network.dns.questions.type` UDM field is set to `32`. Else, if the `record_type` log field value is equal to `SRV`, then the `network.dns.questions.type` UDM field is set to `33`. Else, if the `record_type` log field value is equal to `ATMA`, then the `network.dns.questions.type` UDM field is set to `34`. Else, if the `record_type` log field value is equal to `NAPTR`, then the `network.dns.questions.type` UDM field is set to `35`. Else, if the `record_type` log field value is equal to `KX`, then the `network.dns.questions.type` UDM field is set to `36`. Else, if the `record_type` log field value is equal to `CERT`, then the `network.dns.questions.type` UDM field is set to `37`. Else, if the `record_type` log field value is equal to `A6`, then the `network.dns.questions.type` UDM field is set to `38`. Else, if the `record_type` log field value is equal to `DNAME`, then the `network.dns.questions.type` UDM field is set to `39`. Else, if the `record_type` log field value is equal to `SINK`, then the `network.dns.questions.type` UDM field is set to `40`. Else, if the `record_type` log field value is equal to `OPT`, then the `network.dns.questions.type` UDM field is set to `41`. Else, if the `record_type` log field value is equal to `APL`, then the `network.dns.questions.type` UDM field is set to `42`. Else, if the `record_type` log field value is equal to `DS`, then the `network.dns.questions.type` UDM field is set to `43`. Else, if the `record_type` log field value is equal to `SSHFP`, then the `network.dns.questions.type` UDM field is set to `44`. Else, if the `record_type` log field value is equal to `IPSECKEY`, then the `network.dns.questions.type` UDM field is set to `45`. Else, if the `record_type` log field value is equal to `RRSIG`, then the `network.dns.questions.type` UDM field is set to `46`. Else, if the `record_type` log field value is equal to `NSEC`, then the `network.dns.questions.type` UDM field is set to `47`. Else, if the `record_type` log field value is equal to `DNSKEY`, then the `network.dns.questions.type` UDM field is set to `48`. Else, if the `record_type` log field value is equal to `DHCID`, then the `network.dns.questions.type` UDM field is set to `49`. Else, if the `record_type` log field value is equal to `NSEC3`, then the `network.dns.questions.type` UDM field is set to `50`. Else, if the `record_type` log field value is equal to `NSEC3PARAM`, then the `network.dns.questions.type` UDM field is set to `51`. Else, if the `record_type` log field value is equal to `TLSA`, then the `network.dns.questions.type` UDM field is set to `52`. Else, if the `record_type` log field value is equal to `SMIMEA`, then the `network.dns.questions.type` UDM field is set to `53`. Else, if the `record_type` log field value is equal to `UNASSIGNED`, then the `network.dns.questions.type` UDM field is set to `54`. Else, if the `record_type` log field value is equal to `HIP`, then the `network.dns.questions.type` UDM field is set to `55`. Else, if the `record_type` log field value is equal to `NINFO`, then the `network.dns.questions.type` UDM field is set to `56`. Else, if the `record_type` log field value is equal to `RKEY`, then the `network.dns.questions.type` UDM field is set to `57`. Else, if the `record_type` log field value is equal to `TALINK`, then the `network.dns.questions.type` UDM field is set to `58`. Else, if the `record_type` log field value is equal to `CDS`, then the `network.dns.questions.type` UDM field is set to `59`. Else, if the `record_type` log field value is equal to `CDNSKEY`, then the `network.dns.questions.type` UDM field is set to `60`. Else, if the `record_type` log field value is equal to `OPENPGPKEY`, then the `network.dns.questions.type` UDM field is set to `61`. Else, if the `record_type` log field value is equal to `CSYNC`, then the `network.dns.questions.type` UDM field is set to `62`. Else, if the `record_type` log field value is equal to `ZONEMD`, then the `network.dns.questions.type` UDM field is set to `63`. Else, if the `record_type` log field value is equal to `SVCB`, then the `network.dns.questions.type` UDM field is set to `64`. Else, if the `record_type` log field value is equal to `HTTPS`, then the `network.dns.questions.type` UDM field is set to `65`. Else, if the `record_type` log field value is equal to `SPF`, then the `network.dns.questions.type` UDM field is set to `99`. Else, if the `record_type` log field value is equal to `UINFO`, then the `network.dns.questions.type` UDM field is set to `100`. Else, if the `record_type` log field value is equal to `UID`, then the `network.dns.questions.type` UDM field is set to `101`. Else, if the `record_type` log field value is equal to `GID`, then the `network.dns.questions.type` UDM field is set to `102`. Else, if the `record_type` log field value is equal to `UNSPEC`, then the `network.dns.questions.type` UDM field is set to `103`. Else, if the `record_type` log field value is equal to `NID`, then the `network.dns.questions.type` UDM field is set to `104`. Else, if the `record_type` log field value is equal to `L32`, then the `network.dns.questions.type` UDM field is set to `105`. Else, if the `record_type` log field value is equal to `L64`, then the `network.dns.questions.type` UDM field is set to `106`. Else, if the `record_type` log field value is equal to `LP`, then the `network.dns.questions.type` UDM field is set to `107`. Else, if the `record_type` log field value is equal to `EUI48`, then the `network.dns.questions.type` UDM field is set to `108`. Else, if the `record_type` log field value is equal to `EUI64`, then the `network.dns.questions.type` UDM field is set to `109`. Else, if the `record_type` log field value is equal to `TKEY`, then the `network.dns.questions.type` UDM field is set to `249`. Else, if the `record_type` log field value is equal to `TSIG`, then the `network.dns.questions.type` UDM field is set to `250`. Else, if the `record_type` log field value is equal to `IXFR`, then the `network.dns.questions.type` UDM field is set to `251`. Else, if the `record_type` log field value is equal to `AXFR`, then the `network.dns.questions.type` UDM field is set to `252`. Else, if the `record_type` log field value is equal to `MAILB`, then the `network.dns.questions.type` UDM field is set to `253`. Else, if the `record_type` log field value is equal to `MAILA`, then the `network.dns.questions.type` UDM field is set to `254`. Else, if the `record_type` log field value is equal to `ALL`, then the `network.dns.questions.type` UDM field is set to `255`. Else, if the `record_type` log field value is equal to `URI`, then the `network.dns.questions.type` UDM field is set to `256`. Else, if the `record_type` log field value is equal to `CAA`, then the `network.dns.questions.type` UDM field is set to `257`. Else, if the `record_type` log field value is equal to `AVC`, then the `network.dns.questions.type` UDM field is set to `258`. Else, if the `record_type` log field value is equal to `DOA`, then the `network.dns.questions.type` UDM field is set to `259`. Else, if the `record_type` log field value is equal to `AMTRELAY`, then the `network.dns.questions.type` UDM field is set to `260`. Else, if the `record_type` log field value is equal to `TA`, then the `network.dns.questions.type` UDM field is set to `32768`. Else, if the `record_type` log field value is equal to `DLV`, then the `network.dns.questions.type` UDM field is set to `32769`.
`dns_reqtype`	`additional.fields [dns_reqtype]`
`http_code`	`network.http.response_code`
`protocol`	`network.ip_protocol`	If the `protocol` log field value contain one of the following values, then the `protocol` log field is mapped to the `network.ip_protocol` UDM field. `TCP` `EIGRP` `ESP` `ETHERIP` `GRE` `ICMP` `IGMP` `IP6IN4` `PIM` `UDP` `VRRP` .
`durationms`	`network.session_duration.seconds`
`devicemodel`	`principal.asset.hardware.model`
`devicename`	`principal.asset.asset_id`
`devicehostname`	`principal.asset.hostname`
	`principal.asset.platform_software.platform`	If the `deviceostype` log field value matches the regular expression pattern `(?i)win`, then the `principal.asset.platform_software.platform` UDM field is set to `WINDOWS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)lin`, then the `principal.asset.platform_software.platform` UDM field is set to `LINUX`.
`deviceosversion`	`principal.asset.platform_software.platform_version`
`company`	`principal.user.company_name`
`department`	`principal.user.department`
`user`	`principal.user.email_addresses`	If the `user` log field value matches the regular expression pattern `(^.@.$)` or the `login` log field value matches the regular expression pattern `(^.@.$)`, then if the `user` log field value is not empty, then the `user` log field is mapped to the `principal.user.email_addresses` UDM field.
`login`	`principal.user.email_addresses`	If the `user` log field value matches the regular expression pattern `(^.@.$)` or the `login` log field value matches the regular expression pattern `(^.@.$)`, then if the `user` log field value is not empty, then else, the `login` log field is mapped to the `principal.user.email_addresses` UDM field.
`deviceowner`	`principal.user.userid`
`clt_sip`	`principal.ip`
`location`	`principal.location.name`
`reqrulelabel`	`security_result.rule_name`
`rule`	`security_result.rule_name`
	`security_result.action`	If the `reqaction` log field value matches the regular expression pattern `(?i)BLOCK`, then the `security_result.action` UDM field is set to `BLOCK`. Else, if the `reqaction` log field value matches the regular expression pattern `(?i)ALLOW`, then the `security_result.action` UDM field is set to `ALLOW`.
`reqaction`	`security_result.action_details`
	`security_result.category`	If the `category` log field value is not empty, then the `security_result.category` UDM field is set to `NETWORK_CATEGORIZED_CONTENT`.
`category`	`security_result.category_details`
`resrulelabel`	`security_result.rule_name`
	`security_result.action`	If the `resaction` log field value matches the regular expression pattern `(?i)BLOCK`, then the `security_result.action` UDM field is set to `BLOCK`. Else, if the `resaction` log field value matches the regular expression pattern `(?i)ALLOW`, then the `security_result.action` UDM field is set to `ALLOW`.
`resaction`	`security_result.action_details`
	`security_result.category`	If the `respipcategory` log field value is not empty, then the `security_result.category` UDM field is set to `NETWORK_CATEGORIZED_CONTENT`.
`respipcategory`	`security_result.category_details`
`ecs_slot`	`security_result.rule_labels [ecs_slot]`	If the `dnsgw_slot` log field value is empty, then the `ecs_slot` log field is mapped to the `security_result.rule_name` UDM field.
`dnsgw_slot`	`security_result.rule_name`	If the `dnsgw_slot` log field value is not empty, then the `dnsgw_slot` log field is mapped to the `security_result.rule_name` UDM field.
`ecs_slot`	`security_result.rule_name`	If the `dnsgw_slot` log field value is not empty, then the `ecs_slot` log field is mapped to the `security_result.rule_labels` UDM field.
`dnsapp`	`target.application`
`srv_dip`	`target.ip`
`srv_dport`	`target.port`
`datacentercity`	`target.location.city`
`datacentercountry`	`target.location.country_or_region`
`datacenter`	`target.location.name`
`cloudname`	`security_result.detection_fields [cloudname]`
`dnsappcat`	`security_result.detection_fields [dnsappcat]`
`ecs_prefix`	`security_result.detection_fields [ecs_prefix]`
`error`	`security_result.detection_fields [error]`
`istcp`	`security_result.detection_fields [istcp]`
`ocip`	`security_result.detection_fields [ocip]`
`odevicehostname`	`security_result.detection_fields [odevicehostname]`
`odeviceowner`	`security_result.detection_fields [odeviceowner]`
`odevicename`	`security_result.detection_fields [odevicename]`
`odomcat`	`security_result.detection_fields [odomcat]`
`dnsgw_flags`	`security_result.detection_fields[dnsgw_flags]`
`dnsgw_srv_proto`	`security_result.detection_fields[dnsgw_srv_proto]`
`erulelabel`	`security_result.rule_labels [erulelabel]`
`ethreatname`	`security_result.threat_name`
`durationms`	`additional.fields [durationms]`	If the `durationms` log field value is equal to `1`, then the `durationms` log field is mapped to the `additional.fields.durationms` UDM field.
`sourcetype`	`additional.fields[sourcetype]`
`deviceappversion`	`additional.fields [deviceappversion]`
`devicetype`	`additional.fields [devicetype]`
`eedone`	`additional.fields [eedone]`
`tz`	`additional.fields [tz]`
`ss`	`additional.fields [ss]`
`mm`	`additional.fields [mm]`
`hh`	`additional.fields [hh]`
`dd`	`additional.fields [dd]`
`mth`	`additional.fields [mth]`
`yyyy`	`additional.fields [yyyy]`
`mon`	`additional.fields [mon]`
`day`	`additional.fields [day]`