收集 Zscaler DNS 日志

支持的平台：

Google SecOps SIEM

注意 ：此功能受《Google 安全运营服务专用条款》的正式发布前产品条款约束。我们对正式发布前功能的支持可能有限，并且对正式发布前功能的更改可能与其他正式发布前版本不兼容。如需了解详情，请参阅 Google 安全运营技术支持服务准则和 Google 安全运营服务专用条款。

本文档介绍了如何通过设置 Google 安全运营 Feed 来导出 Zscaler DNS 日志，以及日志字段如何映射到 Google SecOps 统一数据模型 (UDM) 字段。

如需了解详情，请参阅将数据提取到 Google SecOps 概览。

典型的部署包括 Zscaler DNS 和配置为将日志发送到 Google SecOps 的 Google SecOps Webhook Feed。每个客户部署都可能不同，并且可能更复杂。

该部署包含以下组件：

• Zscaler DNS：您要从中收集日志的平台。

• Google SecOps Feed：Google SecOps Feed 会从 Zscaler DNS 提取日志并将日志写入 Google SecOps。

• Google SecOps：保留和分析日志。

注入标签标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档中的信息适用于具有 ZSCALER_DNS 注入标签的解析器。

准备工作

• 确保您有权访问 Zscaler Internet Access 控制台。如需了解详情，请参阅 Secure Internet and SaaS Access ZIA Help。
• 确保您使用的是 Zscaler DNS 2024 或更高版本。
• 确保部署架构中的所有系统都使用世界协调时间 (UTC) 时区进行配置。
• 确保您拥有在 Google SecOps 中完成 Feed 设置所需的 API 密钥。如需了解详情，请参阅设置 API 密钥。

在 Google SecOps 中设置提取 Feed，以提取 Zscaler DNS 日志

1. 依次前往 SIEM 设置 > Feed。
2. 点击新增。
3. 在 Feed 名称字段中，输入 Feed 的名称（例如 Zscaler DNS 日志）。
4. 选择 Webhook 作为来源类型。
5. 选择 ZScaler DNS 作为日志类型。
6. 点击下一步。
7. 可选：为以下输入参数输入值：
   1. 分隔符：用于分隔日志行的分隔符。如果不使用分隔符，请留空。
   2. 资源命名空间：资源命名空间。
   3. 提取标签：要应用于此 Feed 中的事件的标签。
8. 点击下一步。
9. 检查新的 Feed 配置，然后点击提交。
10. 点击生成 Secret 密钥以生成用于对此 Feed 进行身份验证的 Secret 密钥。

设置 Zscaler DNS

1. 在 Zscaler Internet Access 控制台中，依次点击管理 > Nanolog 流式传输服务 > Cloud NSS Feed，然后点击 Add Cloud NSS Feed（添加 Cloud NSS Feed）。
2. 系统随即会显示 Add Cloud NSS Feed 窗口。在 Add Cloud NSS Feed 窗口中，输入详细信息。
3. 在Feed 名称字段中输入 Feed 的名称。
4. 在 NSS Type（NSS 类型）中，选择 NSS for DNS（适用于 DNS 的 NSS）。
5. 从状态列表中选择状态，以启用或停用 NSS Feed。
6. 将 SIEM 速率下拉菜单中的值保留为不受限制。如需因许可或其他限制而抑制输出流，请更改此值。
7. 在 SIEM 类型列表中，选择其他。
8. 在 OAuth 2.0 Authentication（OAuth 2.0 身份验证）列表中，选择 Disabled（已停用）。
9. 在 Max Batch Size（批量大小上限）中，输入单个 HTTP 请求载荷的大小限制，以遵循 SIEM 的最佳实践。例如，512 KB。

10. 在 API 网址中输入 Chronicle API 端点的 HTTPS 网址，格式如下：

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    

    • CHRONICLE_REGION：您的 Chronicle 实例的托管区域。例如，US。
    • GOOGLE_PROJECT_NUMBER：BYOP 项目编号。从 C4 获取此值。
    • LOCATION：Chronicle 区域。例如，US。
    • CUSTOMER_ID：Chronicle 客户 ID。从 C4 获取。
    • FEED_ID：新创建的 Webhook 的 Feed 界面上显示的 Feed ID
    • API 网址示例：

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    

11. 点击添加 HTTP 标头，以添加包含键和值的更多 HTTP 标头。

    例如，标头 1：Key1：X-goog-api-key，Value1： Google Cloud BYOP 的 API 凭据中生成的 API 密钥。

12. 在日志类型列表中，选择 DNS 日志。

13. 在 Feed 输出类型列表中，选择 JSON。

14. 将Feed 转义字符设置为 , \ "。

15. 如需向 Feed 输出格式添加新字段，请在 Feed 输出类型列表中选择自定义。

16. 复制并粘贴Feed 输出格式，然后添加新字段。确保键名称与实际字段名称一致。

17. 以下是默认的Feed 输出格式：

      \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","respipcategory":"%s{respipcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\}
    

18. 在时区列表中，为输出文件中的 Time 字段选择时区。默认情况下，时区会设置为贵组织的时区。

19. 查看已配置的设置。

20. 点击保存以测试连接。如果连接成功，系统会显示一个绿色对勾标记，以及消息 Test Connectivity Successful: OK (200)。

如需详细了解 Google SecOps Feed，请参阅 Google SecOps Feed 文档。如需了解每种 Feed 类型的要求，请参阅按类型配置 Feed。

如果您在创建 Feed 时遇到问题，请与 Google SecOps 支持团队联系。

字段映射参考文档

字段映射参考信息：ZSCALER_DNS

下表列出了 ZSCALER_DNS 日志类型的日志字段及其对应的 UDM 字段。

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to NETWORK_DNS.
	metadata.product_name	The metadata.product_name UDM field is set to DNS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Zscaler.
	metadata.description	If the category log field value is not empty and the durationms log field value is not empty, then the NSSDNSLog | Duration: durationms ms | Category: category log field is mapped to the metadata.description UDM field. Else, if the category log field value is not empty, then the DNS request to \category\ log field is mapped to the metadata.description UDM field.
recordid	metadata.product_log_id
datetime	metadata.event_timestamp
epochtime	metadata.event_timestamp
	network.application_protocol	The network.application_protocol UDM field is set to DNS.
	network.dns.response_code	If the dns_resp log field value is equal to NOERROR, then the network.dns.response_code UDM field is set to 0. Else, if the dns_resp log field value is equal to FORMERR, then the network.dns.response_code UDM field is set to 1. Else, if the dns_resp log field value is equal to SERVFAIL, then the network.dns.response_code UDM field is set to 2. Else, if the dns_resp log field value is equal to NXDOMAIN, then the network.dns.response_code UDM field is set to 3. Else, if the dns_resp log field value is equal to NOTIMP, then the network.dns.response_code UDM field is set to 4. Else, if the dns_resp log field value is equal to REFUSED, then the network.dns.response_code UDM field is set to 5. Else, if the dns_resp log field value is equal to YXDOMAIN, then the network.dns.response_code UDM field is set to 6. Else, if the dns_resp log field value is equal to YXRRSET, then the network.dns.response_code UDM field is set to 7. Else, if the dns_resp log field value is equal to NXRRSET, then the network.dns.response_code UDM field is set to 8. Else, if the dns_resp log field value is equal to NOTAUTH, then the network.dns.response_code UDM field is set to 9. Else, if the dns_resp log field value is equal to NOTZONE, then the network.dns.response_code UDM field is set to 10.
dns_resp	network.dns.answers.data
	network.dns.answers.type	If the restype log field value matches the regular expression pattern ipv4, then the network.dns.answers.type UDM field is set to 1. Else, if the restype log field value matches the regular expression pattern ipv6, then the network.dns.answers.type UDM field is set to 28.
dns_req	network.dns.questions.name
	network.dns.questions.type	If the record_type log field value is equal to A, then the network.dns.questions.type UDM field is set to 1. Else, if the record_type log field value is equal to NS, then the network.dns.questions.type UDM field is set to 2. Else, if the record_type log field value is equal to MD, then the network.dns.questions.type UDM field is set to 3. Else, if the record_type log field value is equal to MF, then the network.dns.questions.type UDM field is set to 4. Else, if the record_type log field value is equal to CNAME, then the network.dns.questions.type UDM field is set to 5. Else, if the record_type log field value is equal to SOA, then the network.dns.questions.type UDM field is set to 6. Else, if the record_type log field value is equal to MB, then the network.dns.questions.type UDM field is set to 7. Else, if the record_type log field value is equal to MG, then the network.dns.questions.type UDM field is set to 8. Else, if the record_type log field value is equal to MR, then the network.dns.questions.type UDM field is set to 9. Else, if the record_type log field value is equal to NULL, then the network.dns.questions.type UDM field is set to 10. Else, if the record_type log field value is equal to WKS, then the network.dns.questions.type UDM field is set to 11. Else, if the record_type log field value is equal to PTR, then the network.dns.questions.type UDM field is set to 12. Else, if the record_type log field value is equal to HINFO, then the network.dns.questions.type UDM field is set to 13. Else, if the record_type log field value is equal to MINFO, then the network.dns.questions.type UDM field is set to 14. Else, if the record_type log field value is equal to MX, then the network.dns.questions.type UDM field is set to 15. Else, if the record_type log field value is equal to TXT, then the network.dns.questions.type UDM field is set to 16. Else, if the record_type log field value is equal to RP, then the network.dns.questions.type UDM field is set to 17. Else, if the record_type log field value is equal to AFSDB, then the network.dns.questions.type UDM field is set to 18. Else, if the record_type log field value is equal to X25, then the network.dns.questions.type UDM field is set to 19. Else, if the record_type log field value is equal to ISDN, then the network.dns.questions.type UDM field is set to 20. Else, if the record_type log field value is equal to RT, then the network.dns.questions.type UDM field is set to 21. Else, if the record_type log field value is equal to NSAP, then the network.dns.questions.type UDM field is set to 22. Else, if the record_type log field value is equal to NSAP-PTR, then the network.dns.questions.type UDM field is set to 23. Else, if the record_type log field value is equal to SIG, then the network.dns.questions.type UDM field is set to 24. Else, if the record_type log field value is equal to KEY, then the network.dns.questions.type UDM field is set to 25. Else, if the record_type log field value is equal to PX, then the network.dns.questions.type UDM field is set to 26. Else, if the record_type log field value is equal to GPOS, then the network.dns.questions.type UDM field is set to 27. Else, if the record_type log field value is equal to AAAA, then the network.dns.questions.type UDM field is set to 28. Else, if the record_type log field value is equal to LOC, then the network.dns.questions.type UDM field is set to 29. Else, if the record_type log field value is equal to NXT, then the network.dns.questions.type UDM field is set to 30. Else, if the record_type log field value is equal to EID, then the network.dns.questions.type UDM field is set to 31. Else, if the record_type log field value is equal to NIMLOC, then the network.dns.questions.type UDM field is set to 32. Else, if the record_type log field value is equal to SRV, then the network.dns.questions.type UDM field is set to 33. Else, if the record_type log field value is equal to ATMA, then the network.dns.questions.type UDM field is set to 34. Else, if the record_type log field value is equal to NAPTR, then the network.dns.questions.type UDM field is set to 35. Else, if the record_type log field value is equal to KX, then the network.dns.questions.type UDM field is set to 36. Else, if the record_type log field value is equal to CERT, then the network.dns.questions.type UDM field is set to 37. Else, if the record_type log field value is equal to A6, then the network.dns.questions.type UDM field is set to 38. Else, if the record_type log field value is equal to DNAME, then the network.dns.questions.type UDM field is set to 39. Else, if the record_type log field value is equal to SINK, then the network.dns.questions.type UDM field is set to 40. Else, if the record_type log field value is equal to OPT, then the network.dns.questions.type UDM field is set to 41. Else, if the record_type log field value is equal to APL, then the network.dns.questions.type UDM field is set to 42. Else, if the record_type log field value is equal to DS, then the network.dns.questions.type UDM field is set to 43. Else, if the record_type log field value is equal to SSHFP, then the network.dns.questions.type UDM field is set to 44. Else, if the record_type log field value is equal to IPSECKEY, then the network.dns.questions.type UDM field is set to 45. Else, if the record_type log field value is equal to RRSIG, then the network.dns.questions.type UDM field is set to 46. Else, if the record_type log field value is equal to NSEC, then the network.dns.questions.type UDM field is set to 47. Else, if the record_type log field value is equal to DNSKEY, then the network.dns.questions.type UDM field is set to 48. Else, if the record_type log field value is equal to DHCID, then the network.dns.questions.type UDM field is set to 49. Else, if the record_type log field value is equal to NSEC3, then the network.dns.questions.type UDM field is set to 50. Else, if the record_type log field value is equal to NSEC3PARAM, then the network.dns.questions.type UDM field is set to 51. Else, if the record_type log field value is equal to TLSA, then the network.dns.questions.type UDM field is set to 52. Else, if the record_type log field value is equal to SMIMEA, then the network.dns.questions.type UDM field is set to 53. Else, if the record_type log field value is equal to UNASSIGNED, then the network.dns.questions.type UDM field is set to 54. Else, if the record_type log field value is equal to HIP, then the network.dns.questions.type UDM field is set to 55. Else, if the record_type log field value is equal to NINFO, then the network.dns.questions.type UDM field is set to 56. Else, if the record_type log field value is equal to RKEY, then the network.dns.questions.type UDM field is set to 57. Else, if the record_type log field value is equal to TALINK, then the network.dns.questions.type UDM field is set to 58. Else, if the record_type log field value is equal to CDS, then the network.dns.questions.type UDM field is set to 59. Else, if the record_type log field value is equal to CDNSKEY, then the network.dns.questions.type UDM field is set to 60. Else, if the record_type log field value is equal to OPENPGPKEY, then the network.dns.questions.type UDM field is set to 61. Else, if the record_type log field value is equal to CSYNC, then the network.dns.questions.type UDM field is set to 62. Else, if the record_type log field value is equal to ZONEMD, then the network.dns.questions.type UDM field is set to 63. Else, if the record_type log field value is equal to SVCB, then the network.dns.questions.type UDM field is set to 64. Else, if the record_type log field value is equal to HTTPS, then the network.dns.questions.type UDM field is set to 65. Else, if the record_type log field value is equal to SPF, then the network.dns.questions.type UDM field is set to 99. Else, if the record_type log field value is equal to UINFO, then the network.dns.questions.type UDM field is set to 100. Else, if the record_type log field value is equal to UID, then the network.dns.questions.type UDM field is set to 101. Else, if the record_type log field value is equal to GID, then the network.dns.questions.type UDM field is set to 102. Else, if the record_type log field value is equal to UNSPEC, then the network.dns.questions.type UDM field is set to 103. Else, if the record_type log field value is equal to NID, then the network.dns.questions.type UDM field is set to 104. Else, if the record_type log field value is equal to L32, then the network.dns.questions.type UDM field is set to 105. Else, if the record_type log field value is equal to L64, then the network.dns.questions.type UDM field is set to 106. Else, if the record_type log field value is equal to LP, then the network.dns.questions.type UDM field is set to 107. Else, if the record_type log field value is equal to EUI48, then the network.dns.questions.type UDM field is set to 108. Else, if the record_type log field value is equal to EUI64, then the network.dns.questions.type UDM field is set to 109. Else, if the record_type log field value is equal to TKEY, then the network.dns.questions.type UDM field is set to 249. Else, if the record_type log field value is equal to TSIG, then the network.dns.questions.type UDM field is set to 250. Else, if the record_type log field value is equal to IXFR, then the network.dns.questions.type UDM field is set to 251. Else, if the record_type log field value is equal to AXFR, then the network.dns.questions.type UDM field is set to 252. Else, if the record_type log field value is equal to MAILB, then the network.dns.questions.type UDM field is set to 253. Else, if the record_type log field value is equal to MAILA, then the network.dns.questions.type UDM field is set to 254. Else, if the record_type log field value is equal to ALL, then the network.dns.questions.type UDM field is set to 255. Else, if the record_type log field value is equal to URI, then the network.dns.questions.type UDM field is set to 256. Else, if the record_type log field value is equal to CAA, then the network.dns.questions.type UDM field is set to 257. Else, if the record_type log field value is equal to AVC, then the network.dns.questions.type UDM field is set to 258. Else, if the record_type log field value is equal to DOA, then the network.dns.questions.type UDM field is set to 259. Else, if the record_type log field value is equal to AMTRELAY, then the network.dns.questions.type UDM field is set to 260. Else, if the record_type log field value is equal to TA, then the network.dns.questions.type UDM field is set to 32768. Else, if the record_type log field value is equal to DLV, then the network.dns.questions.type UDM field is set to 32769.
dns_reqtype	additional.fields [dns_reqtype]
http_code	network.http.response_code
protocol	network.ip_protocol	If the protocol log field value contain one of the following values, then the protocol log field is mapped to the network.ip_protocol UDM field. TCP EIGRP ESP ETHERIP GRE ICMP IGMP IP6IN4 PIM UDP VRRP .
durationms	network.session_duration.seconds
devicemodel	principal.asset.hardware.model
devicename	principal.asset.asset_id
devicehostname	principal.asset.hostname
	principal.asset.platform_software.platform	If the deviceostype log field value matches the regular expression pattern (?i)win, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the deviceostype log field value matches the regular expression pattern (?i)lin, then the principal.asset.platform_software.platform UDM field is set to LINUX.
deviceosversion	principal.asset.platform_software.platform_version
company	principal.user.company_name
department	principal.user.department
user	principal.user.email_addresses	If the user log field value matches the regular expression pattern (^.@.$) or the login log field value matches the regular expression pattern (^.@.$), then if the user log field value is not empty, then the user log field is mapped to the principal.user.email_addresses UDM field.
login	principal.user.email_addresses	If the user log field value matches the regular expression pattern (^.@.$) or the login log field value matches the regular expression pattern (^.@.$), then if the user log field value is not empty, then else, the login log field is mapped to the principal.user.email_addresses UDM field.
deviceowner	principal.user.userid
clt_sip	principal.ip
location	principal.location.name
reqrulelabel	security_result.rule_name
rule	security_result.rule_name
	security_result.action	If the reqaction log field value matches the regular expression pattern (?i)BLOCK, then the security_result.action UDM field is set to BLOCK. Else, if the reqaction log field value matches the regular expression pattern (?i)ALLOW, then the security_result.action UDM field is set to ALLOW.
reqaction	security_result.action_details
	security_result.category	If the category log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
category	security_result.category_details
resrulelabel	security_result.rule_name
	security_result.action	If the resaction log field value matches the regular expression pattern (?i)BLOCK, then the security_result.action UDM field is set to BLOCK. Else, if the resaction log field value matches the regular expression pattern (?i)ALLOW, then the security_result.action UDM field is set to ALLOW.
resaction	security_result.action_details
	security_result.category	If the respipcategory log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
respipcategory	security_result.category_details
ecs_slot	security_result.rule_labels [ecs_slot]	If the dnsgw_slot log field value is empty, then the ecs_slot log field is mapped to the security_result.rule_name UDM field.
dnsgw_slot	security_result.rule_name	If the dnsgw_slot log field value is not empty, then the dnsgw_slot log field is mapped to the security_result.rule_name UDM field.
ecs_slot	security_result.rule_name	If the dnsgw_slot log field value is not empty, then the ecs_slot log field is mapped to the security_result.rule_labels UDM field.
dnsapp	target.application
srv_dip	target.ip
srv_dport	target.port
datacentercity	target.location.city
datacentercountry	target.location.country_or_region
datacenter	target.location.name
cloudname	security_result.detection_fields [cloudname]
dnsappcat	security_result.detection_fields [dnsappcat]
ecs_prefix	security_result.detection_fields [ecs_prefix]
error	security_result.detection_fields [error]
istcp	security_result.detection_fields [istcp]
ocip	security_result.detection_fields [ocip]
odevicehostname	security_result.detection_fields [odevicehostname]
odeviceowner	security_result.detection_fields [odeviceowner]
odevicename	security_result.detection_fields [odevicename]
odomcat	security_result.detection_fields [odomcat]
dnsgw_flags	security_result.detection_fields[dnsgw_flags]
dnsgw_srv_proto	security_result.detection_fields[dnsgw_srv_proto]
erulelabel	security_result.rule_labels [erulelabel]
ethreatname	security_result.threat_name
durationms	additional.fields [durationms]	If the durationms log field value is equal to 1, then the durationms log field is mapped to the additional.fields.durationms UDM field.
sourcetype	additional.fields[sourcetype]
deviceappversion	additional.fields [deviceappversion]
devicetype	additional.fields [devicetype]
eedone	additional.fields [eedone]
tz	additional.fields [tz]
ss	additional.fields [ss]
mm	additional.fields [mm]
hh	additional.fields [hh]
dd	additional.fields [dd]
mth	additional.fields [mth]
yyyy	additional.fields [yyyy]
mon	additional.fields [mon]
day	additional.fields [day]