Mengumpulkan log DNS Zscaler

Didukung di:

Google SecOps SIEM

Catatan: Fitur ini tercakup dalam Persyaratan Penawaran Pra-GA dari Persyaratan Khusus Layanan Operasi Keamanan Google. Fitur pra-GA mungkin memiliki dukungan terbatas, dan perubahan pada fitur pra-GA mungkin tidak kompatibel dengan versi pra-GA lainnya. Untuk mengetahui informasi selengkapnya, lihat panduan Layanan Dukungan Teknis Google Security Operations dan Persyaratan Khusus Layanan Google Security Operations.

Dokumen ini menjelaskan cara mengekspor log DNS Zscaler dengan menyiapkan feed Google Security Operations dan cara kolom log dipetakan ke kolom Unified Data Model (UDM) Google SecOps.

Untuk mengetahui informasi selengkapnya, lihat Ringkasan penyerapan data ke Google SecOps.

Deployment standar terdiri dari DNS Zscaler dan feed Webhook Google SecOps yang dikonfigurasi untuk mengirim log ke Google SecOps. Setiap deployment pelanggan dapat berbeda dan mungkin lebih kompleks.

Deployment berisi komponen berikut:

• DNS Zscaler: Platform tempat Anda mengumpulkan log.

• Feed Google SecOps: Feed Google SecOps yang mengambil log dari DNS Zscaler dan menulis log ke Google SecOps.

• Google SecOps: Mempertahankan dan menganalisis log.

Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser dengan label transfer ZSCALER_DNS.

Sebelum memulai

• Pastikan Anda memiliki akses ke konsol Akses Internet Zscaler. Untuk informasi selengkapnya, lihat Bantuan ZIA Akses Internet dan SaaS yang Aman.
• Pastikan Anda menggunakan Zscaler DNS 2024 atau yang lebih baru.
• Pastikan semua sistem dalam arsitektur deployment dikonfigurasi dengan zona waktu UTC.
• Pastikan Anda memiliki kunci API yang diperlukan untuk menyelesaikan penyiapan feed di Google SecOps. Untuk mengetahui informasi selengkapnya, lihat Menyiapkan kunci API.

Menyiapkan feed transfer di Google SecOps untuk menyerap log DNS Zscaler

1. Buka Setelan SIEM > Feed.
2. Klik Tambahkan baru.
3. Di kolom Feed name, masukkan nama untuk feed (misalnya, Zscaler DNS Logs).
4. Pilih Webhook sebagai Jenis Sumber.
5. Pilih ZScaler DNS sebagai Log Type.
6. Klik Berikutnya.
7. Opsional: Masukkan nilai untuk parameter input berikut:
   1. Pemisah pemisahan: pemisah yang digunakan untuk memisahkan baris log. Biarkan kosong jika pembatas tidak digunakan.
   2. Namespace aset: namespace aset.
   3. Label penyerapan: label yang akan diterapkan ke peristiwa dari feed ini.
8. Klik Berikutnya.
9. Tinjau konfigurasi feed baru Anda, lalu klik Kirim.
10. Klik Buat Kunci Rahasia untuk membuat kunci rahasia guna mengautentikasi feed ini.

Menyiapkan DNS Zscaler

1. Di konsol Zscaler Internet Access, klik Administration > Nanolog Streaming Service > Cloud NSS Feeds, lalu klik Add Cloud NSS Feed.
2. Jendela Add Cloud NSS Feed akan muncul. Di jendela Tambahkan Feed NSS Cloud, masukkan detailnya.
3. Masukkan nama untuk feed di kolom Feed Name.
4. Pilih NSS for DNS di NSS Type.
5. Pilih status dari daftar Status untuk mengaktifkan atau menonaktifkan feed NSS.
6. Tetapkan nilai di drop-down SIEM Rate sebagai Unlimited. Untuk menyembunyikan aliran output karena pemberian lisensi atau batasan lainnya, ubah nilainya.
7. Pilih Lainnya di daftar Jenis SIEM.
8. Pilih Nonaktif di daftar Autentikasi OAuth 2.0.
9. Masukkan batas ukuran untuk setiap payload permintaan HTTP ke praktik terbaik SIEM di Max Batch Size. Misalnya, 512 KB.

10. Masukkan URL HTTPS endpoint Chronicle API di URL API dalam format berikut:

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    

    • CHRONICLE_REGION: Region tempat instance Chronicle Anda dihosting. Misalnya, US.
    • GOOGLE_PROJECT_NUMBER: Nomor project BYOP. Dapatkan ini dari C4.
    • LOCATION: Region Chronicle. Misalnya, US.
    • CUSTOMER_ID: ID pelanggan Chronicle. Dapatkan dari C4.
    • FEED_ID: ID feed yang ditampilkan di UI Feed pada webhook baru yang dibuat
    • Contoh URL API:

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    

11. Klik Tambahkan Header HTTP untuk menambahkan header HTTP lainnya dengan kunci dan nilai.

    Misalnya, Header 1 : Key1: X-goog-api-key dan Value1: Kunci API yang dibuat di Google Cloud Kredensial API BYOP.

12. Pilih DNS Logs di daftar Log Types.

13. Pilih JSON di daftar Jenis Output Feed.

14. Tetapkan Feed Escape Character ke , \ ".

15. Untuk menambahkan kolom baru ke Format Output Feed,pilih Kustom di daftar Jenis Output Feed.

16. Salin-tempel Format Output Feed dan tambahkan kolom baru. Pastikan nama kunci cocok dengan nama kolom yang sebenarnya.

17. Berikut adalah Format Output Feed default:

      \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","respipcategory":"%s{respipcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\}
    

18. Pilih zona waktu untuk kolom Time dalam file output di daftar Timezone. Secara default, zona waktu ditetapkan ke zona waktu organisasi Anda.

19. Tinjau setelan yang dikonfigurasi.

20. Klik Simpan untuk menguji konektivitas. Jika koneksi berhasil, tanda centang hijau yang disertai pesan Uji Konektivitas Berhasil: OK (200) akan muncul.

Untuk mengetahui informasi selengkapnya tentang feed Google SecOps, lihat dokumentasi feed Google SecOps. Untuk mengetahui informasi tentang persyaratan untuk setiap jenis feed, lihat Konfigurasi feed menurut jenis.

Jika Anda mengalami masalah saat membuat feed, hubungi dukungan Google SecOps.

Referensi pemetaan kolom

Referensi pemetaan kolom: ZSCALER_DNS

Tabel berikut mencantumkan kolom log dari jenis log ZSCALER_DNS dan kolom UDM yang sesuai.

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to NETWORK_DNS.
	metadata.product_name	The metadata.product_name UDM field is set to DNS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Zscaler.
	metadata.description	If the category log field value is not empty and the durationms log field value is not empty, then the NSSDNSLog | Duration: durationms ms | Category: category log field is mapped to the metadata.description UDM field. Else, if the category log field value is not empty, then the DNS request to \category\ log field is mapped to the metadata.description UDM field.
recordid	metadata.product_log_id
datetime	metadata.event_timestamp
epochtime	metadata.event_timestamp
	network.application_protocol	The network.application_protocol UDM field is set to DNS.
	network.dns.response_code	If the dns_resp log field value is equal to NOERROR, then the network.dns.response_code UDM field is set to 0. Else, if the dns_resp log field value is equal to FORMERR, then the network.dns.response_code UDM field is set to 1. Else, if the dns_resp log field value is equal to SERVFAIL, then the network.dns.response_code UDM field is set to 2. Else, if the dns_resp log field value is equal to NXDOMAIN, then the network.dns.response_code UDM field is set to 3. Else, if the dns_resp log field value is equal to NOTIMP, then the network.dns.response_code UDM field is set to 4. Else, if the dns_resp log field value is equal to REFUSED, then the network.dns.response_code UDM field is set to 5. Else, if the dns_resp log field value is equal to YXDOMAIN, then the network.dns.response_code UDM field is set to 6. Else, if the dns_resp log field value is equal to YXRRSET, then the network.dns.response_code UDM field is set to 7. Else, if the dns_resp log field value is equal to NXRRSET, then the network.dns.response_code UDM field is set to 8. Else, if the dns_resp log field value is equal to NOTAUTH, then the network.dns.response_code UDM field is set to 9. Else, if the dns_resp log field value is equal to NOTZONE, then the network.dns.response_code UDM field is set to 10.
dns_resp	network.dns.answers.data
	network.dns.answers.type	If the restype log field value matches the regular expression pattern ipv4, then the network.dns.answers.type UDM field is set to 1. Else, if the restype log field value matches the regular expression pattern ipv6, then the network.dns.answers.type UDM field is set to 28.
dns_req	network.dns.questions.name
	network.dns.questions.type	If the record_type log field value is equal to A, then the network.dns.questions.type UDM field is set to 1. Else, if the record_type log field value is equal to NS, then the network.dns.questions.type UDM field is set to 2. Else, if the record_type log field value is equal to MD, then the network.dns.questions.type UDM field is set to 3. Else, if the record_type log field value is equal to MF, then the network.dns.questions.type UDM field is set to 4. Else, if the record_type log field value is equal to CNAME, then the network.dns.questions.type UDM field is set to 5. Else, if the record_type log field value is equal to SOA, then the network.dns.questions.type UDM field is set to 6. Else, if the record_type log field value is equal to MB, then the network.dns.questions.type UDM field is set to 7. Else, if the record_type log field value is equal to MG, then the network.dns.questions.type UDM field is set to 8. Else, if the record_type log field value is equal to MR, then the network.dns.questions.type UDM field is set to 9. Else, if the record_type log field value is equal to NULL, then the network.dns.questions.type UDM field is set to 10. Else, if the record_type log field value is equal to WKS, then the network.dns.questions.type UDM field is set to 11. Else, if the record_type log field value is equal to PTR, then the network.dns.questions.type UDM field is set to 12. Else, if the record_type log field value is equal to HINFO, then the network.dns.questions.type UDM field is set to 13. Else, if the record_type log field value is equal to MINFO, then the network.dns.questions.type UDM field is set to 14. Else, if the record_type log field value is equal to MX, then the network.dns.questions.type UDM field is set to 15. Else, if the record_type log field value is equal to TXT, then the network.dns.questions.type UDM field is set to 16. Else, if the record_type log field value is equal to RP, then the network.dns.questions.type UDM field is set to 17. Else, if the record_type log field value is equal to AFSDB, then the network.dns.questions.type UDM field is set to 18. Else, if the record_type log field value is equal to X25, then the network.dns.questions.type UDM field is set to 19. Else, if the record_type log field value is equal to ISDN, then the network.dns.questions.type UDM field is set to 20. Else, if the record_type log field value is equal to RT, then the network.dns.questions.type UDM field is set to 21. Else, if the record_type log field value is equal to NSAP, then the network.dns.questions.type UDM field is set to 22. Else, if the record_type log field value is equal to NSAP-PTR, then the network.dns.questions.type UDM field is set to 23. Else, if the record_type log field value is equal to SIG, then the network.dns.questions.type UDM field is set to 24. Else, if the record_type log field value is equal to KEY, then the network.dns.questions.type UDM field is set to 25. Else, if the record_type log field value is equal to PX, then the network.dns.questions.type UDM field is set to 26. Else, if the record_type log field value is equal to GPOS, then the network.dns.questions.type UDM field is set to 27. Else, if the record_type log field value is equal to AAAA, then the network.dns.questions.type UDM field is set to 28. Else, if the record_type log field value is equal to LOC, then the network.dns.questions.type UDM field is set to 29. Else, if the record_type log field value is equal to NXT, then the network.dns.questions.type UDM field is set to 30. Else, if the record_type log field value is equal to EID, then the network.dns.questions.type UDM field is set to 31. Else, if the record_type log field value is equal to NIMLOC, then the network.dns.questions.type UDM field is set to 32. Else, if the record_type log field value is equal to SRV, then the network.dns.questions.type UDM field is set to 33. Else, if the record_type log field value is equal to ATMA, then the network.dns.questions.type UDM field is set to 34. Else, if the record_type log field value is equal to NAPTR, then the network.dns.questions.type UDM field is set to 35. Else, if the record_type log field value is equal to KX, then the network.dns.questions.type UDM field is set to 36. Else, if the record_type log field value is equal to CERT, then the network.dns.questions.type UDM field is set to 37. Else, if the record_type log field value is equal to A6, then the network.dns.questions.type UDM field is set to 38. Else, if the record_type log field value is equal to DNAME, then the network.dns.questions.type UDM field is set to 39. Else, if the record_type log field value is equal to SINK, then the network.dns.questions.type UDM field is set to 40. Else, if the record_type log field value is equal to OPT, then the network.dns.questions.type UDM field is set to 41. Else, if the record_type log field value is equal to APL, then the network.dns.questions.type UDM field is set to 42. Else, if the record_type log field value is equal to DS, then the network.dns.questions.type UDM field is set to 43. Else, if the record_type log field value is equal to SSHFP, then the network.dns.questions.type UDM field is set to 44. Else, if the record_type log field value is equal to IPSECKEY, then the network.dns.questions.type UDM field is set to 45. Else, if the record_type log field value is equal to RRSIG, then the network.dns.questions.type UDM field is set to 46. Else, if the record_type log field value is equal to NSEC, then the network.dns.questions.type UDM field is set to 47. Else, if the record_type log field value is equal to DNSKEY, then the network.dns.questions.type UDM field is set to 48. Else, if the record_type log field value is equal to DHCID, then the network.dns.questions.type UDM field is set to 49. Else, if the record_type log field value is equal to NSEC3, then the network.dns.questions.type UDM field is set to 50. Else, if the record_type log field value is equal to NSEC3PARAM, then the network.dns.questions.type UDM field is set to 51. Else, if the record_type log field value is equal to TLSA, then the network.dns.questions.type UDM field is set to 52. Else, if the record_type log field value is equal to SMIMEA, then the network.dns.questions.type UDM field is set to 53. Else, if the record_type log field value is equal to UNASSIGNED, then the network.dns.questions.type UDM field is set to 54. Else, if the record_type log field value is equal to HIP, then the network.dns.questions.type UDM field is set to 55. Else, if the record_type log field value is equal to NINFO, then the network.dns.questions.type UDM field is set to 56. Else, if the record_type log field value is equal to RKEY, then the network.dns.questions.type UDM field is set to 57. Else, if the record_type log field value is equal to TALINK, then the network.dns.questions.type UDM field is set to 58. Else, if the record_type log field value is equal to CDS, then the network.dns.questions.type UDM field is set to 59. Else, if the record_type log field value is equal to CDNSKEY, then the network.dns.questions.type UDM field is set to 60. Else, if the record_type log field value is equal to OPENPGPKEY, then the network.dns.questions.type UDM field is set to 61. Else, if the record_type log field value is equal to CSYNC, then the network.dns.questions.type UDM field is set to 62. Else, if the record_type log field value is equal to ZONEMD, then the network.dns.questions.type UDM field is set to 63. Else, if the record_type log field value is equal to SVCB, then the network.dns.questions.type UDM field is set to 64. Else, if the record_type log field value is equal to HTTPS, then the network.dns.questions.type UDM field is set to 65. Else, if the record_type log field value is equal to SPF, then the network.dns.questions.type UDM field is set to 99. Else, if the record_type log field value is equal to UINFO, then the network.dns.questions.type UDM field is set to 100. Else, if the record_type log field value is equal to UID, then the network.dns.questions.type UDM field is set to 101. Else, if the record_type log field value is equal to GID, then the network.dns.questions.type UDM field is set to 102. Else, if the record_type log field value is equal to UNSPEC, then the network.dns.questions.type UDM field is set to 103. Else, if the record_type log field value is equal to NID, then the network.dns.questions.type UDM field is set to 104. Else, if the record_type log field value is equal to L32, then the network.dns.questions.type UDM field is set to 105. Else, if the record_type log field value is equal to L64, then the network.dns.questions.type UDM field is set to 106. Else, if the record_type log field value is equal to LP, then the network.dns.questions.type UDM field is set to 107. Else, if the record_type log field value is equal to EUI48, then the network.dns.questions.type UDM field is set to 108. Else, if the record_type log field value is equal to EUI64, then the network.dns.questions.type UDM field is set to 109. Else, if the record_type log field value is equal to TKEY, then the network.dns.questions.type UDM field is set to 249. Else, if the record_type log field value is equal to TSIG, then the network.dns.questions.type UDM field is set to 250. Else, if the record_type log field value is equal to IXFR, then the network.dns.questions.type UDM field is set to 251. Else, if the record_type log field value is equal to AXFR, then the network.dns.questions.type UDM field is set to 252. Else, if the record_type log field value is equal to MAILB, then the network.dns.questions.type UDM field is set to 253. Else, if the record_type log field value is equal to MAILA, then the network.dns.questions.type UDM field is set to 254. Else, if the record_type log field value is equal to ALL, then the network.dns.questions.type UDM field is set to 255. Else, if the record_type log field value is equal to URI, then the network.dns.questions.type UDM field is set to 256. Else, if the record_type log field value is equal to CAA, then the network.dns.questions.type UDM field is set to 257. Else, if the record_type log field value is equal to AVC, then the network.dns.questions.type UDM field is set to 258. Else, if the record_type log field value is equal to DOA, then the network.dns.questions.type UDM field is set to 259. Else, if the record_type log field value is equal to AMTRELAY, then the network.dns.questions.type UDM field is set to 260. Else, if the record_type log field value is equal to TA, then the network.dns.questions.type UDM field is set to 32768. Else, if the record_type log field value is equal to DLV, then the network.dns.questions.type UDM field is set to 32769.
dns_reqtype	additional.fields [dns_reqtype]
http_code	network.http.response_code
protocol	network.ip_protocol	If the protocol log field value contain one of the following values, then the protocol log field is mapped to the network.ip_protocol UDM field. TCP EIGRP ESP ETHERIP GRE ICMP IGMP IP6IN4 PIM UDP VRRP .
durationms	network.session_duration.seconds
devicemodel	principal.asset.hardware.model
devicename	principal.asset.asset_id
devicehostname	principal.asset.hostname
	principal.asset.platform_software.platform	If the deviceostype log field value matches the regular expression pattern (?i)win, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the deviceostype log field value matches the regular expression pattern (?i)lin, then the principal.asset.platform_software.platform UDM field is set to LINUX.
deviceosversion	principal.asset.platform_software.platform_version
company	principal.user.company_name
department	principal.user.department
user	principal.user.email_addresses	If the user log field value matches the regular expression pattern (^.@.$) or the login log field value matches the regular expression pattern (^.@.$), then if the user log field value is not empty, then the user log field is mapped to the principal.user.email_addresses UDM field.
login	principal.user.email_addresses	If the user log field value matches the regular expression pattern (^.@.$) or the login log field value matches the regular expression pattern (^.@.$), then if the user log field value is not empty, then else, the login log field is mapped to the principal.user.email_addresses UDM field.
deviceowner	principal.user.userid
clt_sip	principal.ip
location	principal.location.name
reqrulelabel	security_result.rule_name
rule	security_result.rule_name
	security_result.action	If the reqaction log field value matches the regular expression pattern (?i)BLOCK, then the security_result.action UDM field is set to BLOCK. Else, if the reqaction log field value matches the regular expression pattern (?i)ALLOW, then the security_result.action UDM field is set to ALLOW.
reqaction	security_result.action_details
	security_result.category	If the category log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
category	security_result.category_details
resrulelabel	security_result.rule_name
	security_result.action	If the resaction log field value matches the regular expression pattern (?i)BLOCK, then the security_result.action UDM field is set to BLOCK. Else, if the resaction log field value matches the regular expression pattern (?i)ALLOW, then the security_result.action UDM field is set to ALLOW.
resaction	security_result.action_details
	security_result.category	If the respipcategory log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
respipcategory	security_result.category_details
ecs_slot	security_result.rule_labels [ecs_slot]	If the dnsgw_slot log field value is empty, then the ecs_slot log field is mapped to the security_result.rule_name UDM field.
dnsgw_slot	security_result.rule_name	If the dnsgw_slot log field value is not empty, then the dnsgw_slot log field is mapped to the security_result.rule_name UDM field.
ecs_slot	security_result.rule_name	If the dnsgw_slot log field value is not empty, then the ecs_slot log field is mapped to the security_result.rule_labels UDM field.
dnsapp	target.application
srv_dip	target.ip
srv_dport	target.port
datacentercity	target.location.city
datacentercountry	target.location.country_or_region
datacenter	target.location.name
cloudname	security_result.detection_fields [cloudname]
dnsappcat	security_result.detection_fields [dnsappcat]
ecs_prefix	security_result.detection_fields [ecs_prefix]
error	security_result.detection_fields [error]
istcp	security_result.detection_fields [istcp]
ocip	security_result.detection_fields [ocip]
odevicehostname	security_result.detection_fields [odevicehostname]
odeviceowner	security_result.detection_fields [odeviceowner]
odevicename	security_result.detection_fields [odevicename]
odomcat	security_result.detection_fields [odomcat]
dnsgw_flags	security_result.detection_fields[dnsgw_flags]
dnsgw_srv_proto	security_result.detection_fields[dnsgw_srv_proto]
erulelabel	security_result.rule_labels [erulelabel]
ethreatname	security_result.threat_name
durationms	additional.fields [durationms]	If the durationms log field value is equal to 1, then the durationms log field is mapped to the additional.fields.durationms UDM field.
sourcetype	additional.fields[sourcetype]
deviceappversion	additional.fields [deviceappversion]
devicetype	additional.fields [devicetype]
eedone	additional.fields [eedone]
tz	additional.fields [tz]
ss	additional.fields [ss]
mm	additional.fields [mm]
hh	additional.fields [hh]
dd	additional.fields [dd]
mth	additional.fields [mth]
yyyy	additional.fields [yyyy]
mon	additional.fields [mon]
day	additional.fields [day]