Questa pagina è stata tradotta dall'API Cloud Translation.

Raccogliere i log DNS di Zscaler

Supportato in:

Google SecOps SIEM

Questo documento descrive come esportare i log DNS di Zscaler configurando un feed di Google Security Operations e come i campi dei log vengono mappati ai campi del modello di dati unificato (UDM) di Google SecOps.

Per ulteriori informazioni, consulta la panoramica dell'importazione dei dati in Google SecOps.

Un deployment tipico è costituito da Zscaler DNS e dal feed webhook di Google SecOps configurato per inviare i log a Google SecOps. Ogni implementazione del cliente può essere diversa e potrebbe essere più complessa.

Il deployment contiene i seguenti componenti:

Zscaler DNS: la piattaforma da cui raccogli i log.
Feed Google SecOps: il feed Google SecOps che recupera i log da Zscaler DNS e li scrive in Google SecOps.
Google SecOps: conserva e analizza i log.

Un'etichetta di importazione identifica l'analizzatore sintattico che normalizza i dati dei log non elaborati in formato UDM strutturato. Le informazioni contenute in questo documento si applicano al parser con l'etichetta di importazione ZSCALER_DNS.

Prima di iniziare

Assicurati di avere accesso alla console Zscaler Internet Access. Per ulteriori informazioni, consulta la guida di ZIA per l'accesso sicuro a internet e ai servizi SaaS.
Assicurati di utilizzare Zscaler DNS 2024 o versioni successive.
Assicurati che tutti i sistemi nell'architettura di deployment siano configurati con il fuso orario UTC.
Assicurati di disporre della chiave API necessaria per completare la configurazione del feed in Google SecOps. Per ulteriori informazioni, vedi Configurare le chiavi API.

Configura un feed di importazione in Google SecOps per importare i log DNS di Zscaler

Vai a Impostazioni SIEM > Feed.
Fai clic su Aggiungi nuovo.
Nel campo Nome feed, inserisci un nome per il feed (ad esempio Log DNS Zscaler).
Seleziona Webhook come Tipo di origine.
Seleziona ZScaler DNS come Tipo di log.
Fai clic su Avanti.
(Facoltativo) Inserisci i valori per i seguenti parametri di input:
1. Delimitatore di separazione: il delimitatore utilizzato per separare le righe dei log. Lascia vuoto se non viene utilizzato un delimitatore.
2. Spazio dei nomi degli asset: lo spazio dei nomi degli asset.
3. Etichette di importazione: l'etichetta da applicare agli eventi di questo feed.
Fai clic su Avanti.
Esamina la configurazione del nuovo feed e poi fai clic su Invia.
Fai clic su Genera chiave segreta per generare una chiave segreta per autenticare questo feed.

Configurare il DNS di Zscaler

Nella console Zscaler Internet Access, fai clic su Amministrazione > Nanolog Streaming Service > Feed NSS cloud e poi su Aggiungi feed NSS cloud.
Viene visualizzata la finestra Aggiungi feed NSS cloud. Nella finestra Aggiungi feed NSS cloud, inserisci i dettagli.
Inserisci un nome per il feed nel campo Nome feed.
Seleziona NSS per DNS in Tipo NSS.
Seleziona lo stato dall'elenco Stato per attivare o disattivare il feed NSS.
Mantieni il valore nel menu a discesa Tariffa SIEM impostato su Illimitato. Per eliminare lo stream di output a causa di licenze o altri vincoli, modifica il valore.
Seleziona Altro nell'elenco Tipo SIEM.
Seleziona Disattivata nell'elenco Autenticazione OAuth 2.0.
Inserisci un limite di dimensioni per il payload di una singola richiesta HTTP in base alle best practice del SIEM in Dimensione massima batch. Ad esempio, 512 KB.
Inserisci l'URL HTTPS dell'endpoint API Chronicle nell'URL API nel seguente formato:
```
  https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
```
- CHRONICLE_REGION: regione in cui è ospitata l'istanza di Chronicle. Ad esempio, US.
- GOOGLE_PROJECT_NUMBER: numero del progetto BYOP. Richiedi questo documento a C4.
- LOCATION: regione di Chronicle. Ad esempio, US.
- CUSTOMER_ID: ID cliente Chronicle. Ottieni da C4.
- FEED_ID: ID feed visualizzato nell'interfaccia utente del feed nel nuovo webhook creato
- URL API di esempio:
```
https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
```
Fai clic su Aggiungi intestazione HTTP per aggiungere altre intestazioni HTTP con chiavi e valori.
Ad esempio, Intestazione 1 : Chiave1: X-goog-api-key e Valore1: chiave API generata nelle credenziali API di Google Cloud BYOP.
Seleziona Log DNS nell'elenco Tipi di log.
Seleziona JSON nell'elenco Tipo di output del feed.
Imposta Carattere di escape del feed su , \ ".
Per aggiungere un nuovo campo al Formato di output del feed,seleziona Personalizzato nell'elenco Tipo di output del feed.
Copia e incolla il Formato di output del feed e aggiungi nuovi campi. Assicurati che i nomi delle chiavi corrispondano ai nomi effettivi dei campi.

Di seguito è riportato il formato di output del feed predefinito:

  \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","respipcategory":"%s{respipcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\}

Seleziona il fuso orario per il campo Ora nel file di output nell'elenco Fuso orario. Per impostazione predefinita, il fuso orario è impostato su quello della tua organizzazione.
Rivedi le impostazioni configurate.
Fai clic su Salva per verificare la connettività. Se la connessione è riuscita, viene visualizzata una spunta verde accompagnata dal messaggio Test di connettività riuscito: OK (200).

Per ulteriori informazioni sui feed di Google SecOps, consulta la documentazione dei feed di Google SecOps. Per informazioni sui requisiti per ciascun tipo di feed, consulta Configurazione dei feed per tipo.

Se riscontri problemi durante la creazione dei feed, contatta l'assistenza Google SecOps.

Riferimento alla mappatura dei campi

Riferimento alla mappatura dei campi: ZSCALER_DNS

La tabella seguente elenca i campi del log del tipo ZSCALER_DNS e i relativi campi UDM.

Log field	UDM mapping	Logic
	`metadata.event_type`	The `metadata.event_type` UDM field is set to `NETWORK_DNS`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `DNS`.
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Zscaler`.
	`metadata.description`	If the `category` log field value is not empty and the `durationms` log field value is not empty, then the `NSSDNSLog \| Duration: durationms ms \| Category: category` log field is mapped to the `metadata.description` UDM field. Else, if the `category` log field value is not empty, then the `DNS request to \category\` log field is mapped to the `metadata.description` UDM field.
`recordid`	`metadata.product_log_id`
`datetime`	`metadata.event_timestamp`
`epochtime`	`metadata.event_timestamp`
	`network.application_protocol`	The `network.application_protocol` UDM field is set to `DNS`.
	`network.dns.response_code`	If the `dns_resp` log field value is equal to `NOERROR`, then the `network.dns.response_code` UDM field is set to `0`. Else, if the `dns_resp` log field value is equal to `FORMERR`, then the `network.dns.response_code` UDM field is set to `1`. Else, if the `dns_resp` log field value is equal to `SERVFAIL`, then the `network.dns.response_code` UDM field is set to `2`. Else, if the `dns_resp` log field value is equal to `NXDOMAIN`, then the `network.dns.response_code` UDM field is set to `3`. Else, if the `dns_resp` log field value is equal to `NOTIMP`, then the `network.dns.response_code` UDM field is set to `4`. Else, if the `dns_resp` log field value is equal to `REFUSED`, then the `network.dns.response_code` UDM field is set to `5`. Else, if the `dns_resp` log field value is equal to `YXDOMAIN`, then the `network.dns.response_code` UDM field is set to `6`. Else, if the `dns_resp` log field value is equal to `YXRRSET`, then the `network.dns.response_code` UDM field is set to `7`. Else, if the `dns_resp` log field value is equal to `NXRRSET`, then the `network.dns.response_code` UDM field is set to `8`. Else, if the `dns_resp` log field value is equal to `NOTAUTH`, then the `network.dns.response_code` UDM field is set to `9`. Else, if the `dns_resp` log field value is equal to `NOTZONE`, then the `network.dns.response_code` UDM field is set to `10`.
`dns_resp`	`network.dns.answers.data`
	`network.dns.answers.type`	If the `restype` log field value matches the regular expression pattern `ipv4`, then the `network.dns.answers.type` UDM field is set to `1`. Else, if the `restype` log field value matches the regular expression pattern `ipv6`, then the `network.dns.answers.type` UDM field is set to `28`.
`dns_req`	`network.dns.questions.name`
	`network.dns.questions.type`	If the `record_type` log field value is equal to `A`, then the `network.dns.questions.type` UDM field is set to `1`. Else, if the `record_type` log field value is equal to `NS`, then the `network.dns.questions.type` UDM field is set to `2`. Else, if the `record_type` log field value is equal to `MD`, then the `network.dns.questions.type` UDM field is set to `3`. Else, if the `record_type` log field value is equal to `MF`, then the `network.dns.questions.type` UDM field is set to `4`. Else, if the `record_type` log field value is equal to `CNAME`, then the `network.dns.questions.type` UDM field is set to `5`. Else, if the `record_type` log field value is equal to `SOA`, then the `network.dns.questions.type` UDM field is set to `6`. Else, if the `record_type` log field value is equal to `MB`, then the `network.dns.questions.type` UDM field is set to `7`. Else, if the `record_type` log field value is equal to `MG`, then the `network.dns.questions.type` UDM field is set to `8`. Else, if the `record_type` log field value is equal to `MR`, then the `network.dns.questions.type` UDM field is set to `9`. Else, if the `record_type` log field value is equal to `NULL`, then the `network.dns.questions.type` UDM field is set to `10`. Else, if the `record_type` log field value is equal to `WKS`, then the `network.dns.questions.type` UDM field is set to `11`. Else, if the `record_type` log field value is equal to `PTR`, then the `network.dns.questions.type` UDM field is set to `12`. Else, if the `record_type` log field value is equal to `HINFO`, then the `network.dns.questions.type` UDM field is set to `13`. Else, if the `record_type` log field value is equal to `MINFO`, then the `network.dns.questions.type` UDM field is set to `14`. Else, if the `record_type` log field value is equal to `MX`, then the `network.dns.questions.type` UDM field is set to `15`. Else, if the `record_type` log field value is equal to `TXT`, then the `network.dns.questions.type` UDM field is set to `16`. Else, if the `record_type` log field value is equal to `RP`, then the `network.dns.questions.type` UDM field is set to `17`. Else, if the `record_type` log field value is equal to `AFSDB`, then the `network.dns.questions.type` UDM field is set to `18`. Else, if the `record_type` log field value is equal to `X25`, then the `network.dns.questions.type` UDM field is set to `19`. Else, if the `record_type` log field value is equal to `ISDN`, then the `network.dns.questions.type` UDM field is set to `20`. Else, if the `record_type` log field value is equal to `RT`, then the `network.dns.questions.type` UDM field is set to `21`. Else, if the `record_type` log field value is equal to `NSAP`, then the `network.dns.questions.type` UDM field is set to `22`. Else, if the `record_type` log field value is equal to `NSAP-PTR`, then the `network.dns.questions.type` UDM field is set to `23`. Else, if the `record_type` log field value is equal to `SIG`, then the `network.dns.questions.type` UDM field is set to `24`. Else, if the `record_type` log field value is equal to `KEY`, then the `network.dns.questions.type` UDM field is set to `25`. Else, if the `record_type` log field value is equal to `PX`, then the `network.dns.questions.type` UDM field is set to `26`. Else, if the `record_type` log field value is equal to `GPOS`, then the `network.dns.questions.type` UDM field is set to `27`. Else, if the `record_type` log field value is equal to `AAAA`, then the `network.dns.questions.type` UDM field is set to `28`. Else, if the `record_type` log field value is equal to `LOC`, then the `network.dns.questions.type` UDM field is set to `29`. Else, if the `record_type` log field value is equal to `NXT`, then the `network.dns.questions.type` UDM field is set to `30`. Else, if the `record_type` log field value is equal to `EID`, then the `network.dns.questions.type` UDM field is set to `31`. Else, if the `record_type` log field value is equal to `NIMLOC`, then the `network.dns.questions.type` UDM field is set to `32`. Else, if the `record_type` log field value is equal to `SRV`, then the `network.dns.questions.type` UDM field is set to `33`. Else, if the `record_type` log field value is equal to `ATMA`, then the `network.dns.questions.type` UDM field is set to `34`. Else, if the `record_type` log field value is equal to `NAPTR`, then the `network.dns.questions.type` UDM field is set to `35`. Else, if the `record_type` log field value is equal to `KX`, then the `network.dns.questions.type` UDM field is set to `36`. Else, if the `record_type` log field value is equal to `CERT`, then the `network.dns.questions.type` UDM field is set to `37`. Else, if the `record_type` log field value is equal to `A6`, then the `network.dns.questions.type` UDM field is set to `38`. Else, if the `record_type` log field value is equal to `DNAME`, then the `network.dns.questions.type` UDM field is set to `39`. Else, if the `record_type` log field value is equal to `SINK`, then the `network.dns.questions.type` UDM field is set to `40`. Else, if the `record_type` log field value is equal to `OPT`, then the `network.dns.questions.type` UDM field is set to `41`. Else, if the `record_type` log field value is equal to `APL`, then the `network.dns.questions.type` UDM field is set to `42`. Else, if the `record_type` log field value is equal to `DS`, then the `network.dns.questions.type` UDM field is set to `43`. Else, if the `record_type` log field value is equal to `SSHFP`, then the `network.dns.questions.type` UDM field is set to `44`. Else, if the `record_type` log field value is equal to `IPSECKEY`, then the `network.dns.questions.type` UDM field is set to `45`. Else, if the `record_type` log field value is equal to `RRSIG`, then the `network.dns.questions.type` UDM field is set to `46`. Else, if the `record_type` log field value is equal to `NSEC`, then the `network.dns.questions.type` UDM field is set to `47`. Else, if the `record_type` log field value is equal to `DNSKEY`, then the `network.dns.questions.type` UDM field is set to `48`. Else, if the `record_type` log field value is equal to `DHCID`, then the `network.dns.questions.type` UDM field is set to `49`. Else, if the `record_type` log field value is equal to `NSEC3`, then the `network.dns.questions.type` UDM field is set to `50`. Else, if the `record_type` log field value is equal to `NSEC3PARAM`, then the `network.dns.questions.type` UDM field is set to `51`. Else, if the `record_type` log field value is equal to `TLSA`, then the `network.dns.questions.type` UDM field is set to `52`. Else, if the `record_type` log field value is equal to `SMIMEA`, then the `network.dns.questions.type` UDM field is set to `53`. Else, if the `record_type` log field value is equal to `UNASSIGNED`, then the `network.dns.questions.type` UDM field is set to `54`. Else, if the `record_type` log field value is equal to `HIP`, then the `network.dns.questions.type` UDM field is set to `55`. Else, if the `record_type` log field value is equal to `NINFO`, then the `network.dns.questions.type` UDM field is set to `56`. Else, if the `record_type` log field value is equal to `RKEY`, then the `network.dns.questions.type` UDM field is set to `57`. Else, if the `record_type` log field value is equal to `TALINK`, then the `network.dns.questions.type` UDM field is set to `58`. Else, if the `record_type` log field value is equal to `CDS`, then the `network.dns.questions.type` UDM field is set to `59`. Else, if the `record_type` log field value is equal to `CDNSKEY`, then the `network.dns.questions.type` UDM field is set to `60`. Else, if the `record_type` log field value is equal to `OPENPGPKEY`, then the `network.dns.questions.type` UDM field is set to `61`. Else, if the `record_type` log field value is equal to `CSYNC`, then the `network.dns.questions.type` UDM field is set to `62`. Else, if the `record_type` log field value is equal to `ZONEMD`, then the `network.dns.questions.type` UDM field is set to `63`. Else, if the `record_type` log field value is equal to `SVCB`, then the `network.dns.questions.type` UDM field is set to `64`. Else, if the `record_type` log field value is equal to `HTTPS`, then the `network.dns.questions.type` UDM field is set to `65`. Else, if the `record_type` log field value is equal to `SPF`, then the `network.dns.questions.type` UDM field is set to `99`. Else, if the `record_type` log field value is equal to `UINFO`, then the `network.dns.questions.type` UDM field is set to `100`. Else, if the `record_type` log field value is equal to `UID`, then the `network.dns.questions.type` UDM field is set to `101`. Else, if the `record_type` log field value is equal to `GID`, then the `network.dns.questions.type` UDM field is set to `102`. Else, if the `record_type` log field value is equal to `UNSPEC`, then the `network.dns.questions.type` UDM field is set to `103`. Else, if the `record_type` log field value is equal to `NID`, then the `network.dns.questions.type` UDM field is set to `104`. Else, if the `record_type` log field value is equal to `L32`, then the `network.dns.questions.type` UDM field is set to `105`. Else, if the `record_type` log field value is equal to `L64`, then the `network.dns.questions.type` UDM field is set to `106`. Else, if the `record_type` log field value is equal to `LP`, then the `network.dns.questions.type` UDM field is set to `107`. Else, if the `record_type` log field value is equal to `EUI48`, then the `network.dns.questions.type` UDM field is set to `108`. Else, if the `record_type` log field value is equal to `EUI64`, then the `network.dns.questions.type` UDM field is set to `109`. Else, if the `record_type` log field value is equal to `TKEY`, then the `network.dns.questions.type` UDM field is set to `249`. Else, if the `record_type` log field value is equal to `TSIG`, then the `network.dns.questions.type` UDM field is set to `250`. Else, if the `record_type` log field value is equal to `IXFR`, then the `network.dns.questions.type` UDM field is set to `251`. Else, if the `record_type` log field value is equal to `AXFR`, then the `network.dns.questions.type` UDM field is set to `252`. Else, if the `record_type` log field value is equal to `MAILB`, then the `network.dns.questions.type` UDM field is set to `253`. Else, if the `record_type` log field value is equal to `MAILA`, then the `network.dns.questions.type` UDM field is set to `254`. Else, if the `record_type` log field value is equal to `ALL`, then the `network.dns.questions.type` UDM field is set to `255`. Else, if the `record_type` log field value is equal to `URI`, then the `network.dns.questions.type` UDM field is set to `256`. Else, if the `record_type` log field value is equal to `CAA`, then the `network.dns.questions.type` UDM field is set to `257`. Else, if the `record_type` log field value is equal to `AVC`, then the `network.dns.questions.type` UDM field is set to `258`. Else, if the `record_type` log field value is equal to `DOA`, then the `network.dns.questions.type` UDM field is set to `259`. Else, if the `record_type` log field value is equal to `AMTRELAY`, then the `network.dns.questions.type` UDM field is set to `260`. Else, if the `record_type` log field value is equal to `TA`, then the `network.dns.questions.type` UDM field is set to `32768`. Else, if the `record_type` log field value is equal to `DLV`, then the `network.dns.questions.type` UDM field is set to `32769`.
`dns_reqtype`	`additional.fields [dns_reqtype]`
`http_code`	`network.http.response_code`
`protocol`	`network.ip_protocol`	If the `protocol` log field value contain one of the following values, then the `protocol` log field is mapped to the `network.ip_protocol` UDM field. `TCP` `EIGRP` `ESP` `ETHERIP` `GRE` `ICMP` `IGMP` `IP6IN4` `PIM` `UDP` `VRRP` .
`durationms`	`network.session_duration.seconds`
`devicemodel`	`principal.asset.hardware.model`
`devicename`	`principal.asset.asset_id`
`devicehostname`	`principal.asset.hostname`
	`principal.asset.platform_software.platform`	If the `deviceostype` log field value matches the regular expression pattern `(?i)win`, then the `principal.asset.platform_software.platform` UDM field is set to `WINDOWS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)lin`, then the `principal.asset.platform_software.platform` UDM field is set to `LINUX`.
`deviceosversion`	`principal.asset.platform_software.platform_version`
`company`	`principal.user.company_name`
`department`	`principal.user.department`
`user`	`principal.user.email_addresses`	If the `user` log field value matches the regular expression pattern `(^.@.$)` or the `login` log field value matches the regular expression pattern `(^.@.$)`, then if the `user` log field value is not empty, then the `user` log field is mapped to the `principal.user.email_addresses` UDM field.
`login`	`principal.user.email_addresses`	If the `user` log field value matches the regular expression pattern `(^.@.$)` or the `login` log field value matches the regular expression pattern `(^.@.$)`, then if the `user` log field value is not empty, then else, the `login` log field is mapped to the `principal.user.email_addresses` UDM field.
`deviceowner`	`principal.user.userid`
`clt_sip`	`principal.ip`
`location`	`principal.location.name`
`reqrulelabel`	`security_result.rule_name`
`rule`	`security_result.rule_name`
	`security_result.action`	If the `reqaction` log field value matches the regular expression pattern `(?i)BLOCK`, then the `security_result.action` UDM field is set to `BLOCK`. Else, if the `reqaction` log field value matches the regular expression pattern `(?i)ALLOW`, then the `security_result.action` UDM field is set to `ALLOW`.
`reqaction`	`security_result.action_details`
	`security_result.category`	If the `category` log field value is not empty, then the `security_result.category` UDM field is set to `NETWORK_CATEGORIZED_CONTENT`.
`category`	`security_result.category_details`
`resrulelabel`	`security_result.rule_name`
	`security_result.action`	If the `resaction` log field value matches the regular expression pattern `(?i)BLOCK`, then the `security_result.action` UDM field is set to `BLOCK`. Else, if the `resaction` log field value matches the regular expression pattern `(?i)ALLOW`, then the `security_result.action` UDM field is set to `ALLOW`.
`resaction`	`security_result.action_details`
	`security_result.category`	If the `respipcategory` log field value is not empty, then the `security_result.category` UDM field is set to `NETWORK_CATEGORIZED_CONTENT`.
`respipcategory`	`security_result.category_details`
`ecs_slot`	`security_result.rule_labels [ecs_slot]`	If the `dnsgw_slot` log field value is empty, then the `ecs_slot` log field is mapped to the `security_result.rule_name` UDM field.
`dnsgw_slot`	`security_result.rule_name`	If the `dnsgw_slot` log field value is not empty, then the `dnsgw_slot` log field is mapped to the `security_result.rule_name` UDM field.
`ecs_slot`	`security_result.rule_name`	If the `dnsgw_slot` log field value is not empty, then the `ecs_slot` log field is mapped to the `security_result.rule_labels` UDM field.
`dnsapp`	`target.application`
`srv_dip`	`target.ip`
`srv_dport`	`target.port`
`datacentercity`	`target.location.city`
`datacentercountry`	`target.location.country_or_region`
`datacenter`	`target.location.name`
`cloudname`	`security_result.detection_fields [cloudname]`
`dnsappcat`	`security_result.detection_fields [dnsappcat]`
`ecs_prefix`	`security_result.detection_fields [ecs_prefix]`
`error`	`security_result.detection_fields [error]`
`istcp`	`security_result.detection_fields [istcp]`
`ocip`	`security_result.detection_fields [ocip]`
`odevicehostname`	`security_result.detection_fields [odevicehostname]`
`odeviceowner`	`security_result.detection_fields [odeviceowner]`
`odevicename`	`security_result.detection_fields [odevicename]`
`odomcat`	`security_result.detection_fields [odomcat]`
`dnsgw_flags`	`security_result.detection_fields[dnsgw_flags]`
`dnsgw_srv_proto`	`security_result.detection_fields[dnsgw_srv_proto]`
`erulelabel`	`security_result.rule_labels [erulelabel]`
`ethreatname`	`security_result.threat_name`
`durationms`	`additional.fields [durationms]`	If the `durationms` log field value is equal to `1`, then the `durationms` log field is mapped to the `additional.fields.durationms` UDM field.
`sourcetype`	`additional.fields[sourcetype]`
`deviceappversion`	`additional.fields [deviceappversion]`
`devicetype`	`additional.fields [devicetype]`
`eedone`	`additional.fields [eedone]`
`tz`	`additional.fields [tz]`
`ss`	`additional.fields [ss]`
`mm`	`additional.fields [mm]`
`hh`	`additional.fields [hh]`
`dd`	`additional.fields [dd]`
`mth`	`additional.fields [mth]`
`yyyy`	`additional.fields [yyyy]`
`mon`	`additional.fields [mon]`
`day`	`additional.fields [day]`