收集 Zscaler 防火墙日志

支持的平台：

Google SecOps SIEM

注意 ：此功能受《Google 安全运营服务专用条款》的正式发布前产品条款约束。我们对正式发布前功能的支持可能有限，并且对正式发布前功能的更改可能与其他正式发布前版本不兼容。如需了解详情，请参阅 Google 安全运营技术支持服务准则和 Google 安全运营服务专用条款。

本文档介绍了如何通过设置 Google 安全运营 Feed 来导出 Zscaler 防火墙日志，以及日志字段如何映射到 Google SecOps 统一数据模型 (UDM) 字段。

如需了解详情，请参阅将数据提取到 Google SecOps 概览。

典型的部署包括 Zscaler 防火墙和配置为将日志发送到 Google SecOps 的 Google SecOps Webhook Feed。每个客户部署都可能不同，并且可能更复杂。

该部署包含以下组件：

• Zscaler 防火墙：您从中收集日志的平台。

• Google SecOps Feed：Google SecOps Feed 会从 Zscaler 防火墙提取日志并将日志写入 Google SecOps。

• Google SecOps：保留和分析日志。

注入标签标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档中的信息适用于具有 ZSCALER_FIREWALL 注入标签的解析器。

准备工作

• 确保您有权访问 Zscaler Internet Access 控制台。如需了解详情，请参阅 Secure Internet and SaaS Access ZIA Help。
• 确保您使用的是 Zscaler Firewall 2024 或更高版本。
• 确保部署架构中的所有系统都使用世界协调时间 (UTC) 时区进行配置。
• 确保您拥有在 Google SecOps 中完成 Feed 设置所需的 API 密钥。如需了解详情，请参阅设置 API 密钥。

在 Google SecOps 中设置提取 Feed，以提取 Zscaler 防火墙日志

1. 依次前往 SIEM 设置 > Feed。
2. 点击新增。
3. 在 Feed 名称字段中，输入 Feed 的名称（例如 Zscaler 防火墙日志）。
4. 选择 Webhook 作为来源类型。
5. 选择 ZScaler NGFW 作为日志类型。
6. 点击下一步。
7. 可选：为以下输入参数输入值：
   1. 分隔符：用于分隔日志行的分隔符。如果不使用分隔符，请留空。
   2. 资源命名空间：资源命名空间。
   3. 提取标签：要应用于此 Feed 中的事件的标签。
8. 点击下一步。
9. 检查新的 Feed 配置，然后点击提交。
10. 点击生成 Secret 密钥以生成用于对此 Feed 进行身份验证的 Secret 密钥。

设置 Zscaler 防火墙

1. 在 Zscaler Internet Access 控制台中，依次点击管理 > Nanolog 流式传输服务 > Cloud NSS Feed，然后点击 Add Cloud NSS Feed（添加 Cloud NSS Feed）。
2. 系统随即会显示 Add Cloud NSS Feed 窗口。在 Add Cloud NSS Feed 窗口中，输入详细信息。
3. 在Feed 名称字段中输入 Feed 的名称。
4. 在 NSS Type（NSS 类型）中，选择 NSS for Firewall（适用于防火墙的 NSS）。
5. 从状态列表中选择状态，以启用或停用 NSS Feed。
6. 将 SIEM 速率下拉菜单中的值保留为不受限制。如需因许可或其他限制而抑制输出流，请更改此值。
7. 在 SIEM 类型列表中，选择其他。
8. 在 OAuth 2.0 Authentication（OAuth 2.0 身份验证）列表中，选择 Disabled（已停用）。
9. 在 Max Batch Size（批量大小上限）中，输入单个 HTTP 请求载荷的大小限制，以遵循 SIEM 的最佳实践。例如，512 KB。

10. 在 API 网址中输入 Chronicle API 端点的 HTTPS 网址，格式如下：

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    

    • CHRONICLE_REGION：您的 Chronicle 实例的托管区域。例如，US。
    • GOOGLE_PROJECT_NUMBER：BYOP 项目编号。从 C4 获取此值。
    • LOCATION：Chronicle 区域。例如，US。
    • CUSTOMER_ID：Chronicle 客户 ID。从 C4 获取。
    • FEED_ID：新创建的 Webhook 的 Feed 界面上显示的 Feed ID
    • API 网址示例：

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    

11. 点击添加 HTTP 标头，以添加包含键和值的更多 HTTP 标头。

    例如，标头 1：Key1：X-goog-api-key，Value1： Google Cloud BYOP 的 API 凭据中生成的 API 密钥。

12. 在日志类型列表中选择防火墙日志。

13. 在 Feed 输出类型列表中，选择 JSON。

14. 将Feed 转义字符设置为 , \ "。

15. 如需向 Feed 输出格式添加新字段，请在 Feed 输出类型列表中选择自定义。

16. 复制并粘贴Feed 输出格式，然后添加新字段。确保键名称与实际字段名称一致。

17. 以下是默认的Feed 输出格式：

      \{ "sourcetype" : "zscalernss-fw", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","locationname":"%s{elocation}","cdport":"%d{cdport}","csport":"%d{csport}","sdport":"%d{sdport}","ssport":"%d{ssport}","csip":"%s{csip}","cdip":"%s{cdip}","ssip":"%s{ssip}","sdip":"%s{sdip}","tsip":"%s{tsip}","tunsport":"%d{tsport}","tuntype":"%s{ttype}","action":"%s{action}","dnat":"%s{dnat}","stateful":"%s{stateful}","aggregate":"%s{aggregate}","nwsvc":"%s{nwsvc}","nwapp":"%s{nwapp}","proto":"%s{ipproto}","ipcat":"%s{ipcat}","destcountry":"%s{destcountry}","avgduration":"%d{avgduration}","rulelabel":"%s{erulelabel}","inbytes":"%ld{inbytes}","outbytes":"%ld{outbytes}","duration":"%d{duration}","durationms":"%d{durationms}","numsessions":"%d{numsessions}","ipsrulelabel":"%s{ipsrulelabel}","threatcat":"%s{threatcat}","threatname":"%s{ethreatname}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\}
    

18. 在时区列表中，为输出文件中的 Time 字段选择时区。默认情况下，时区会设置为贵组织的时区。

19. 查看已配置的设置。

20. 点击保存以测试连接。如果连接成功，系统会显示一个绿色对勾标记，以及消息 Test Connectivity Successful: OK (200)。

如需详细了解 Google SecOps Feed，请参阅 Google SecOps Feed 文档。如需了解每种 Feed 类型的要求，请参阅按类型配置 Feed。

如果您在创建 Feed 时遇到问题，请与 Google SecOps 支持团队联系。

字段映射参考文档

下表列出了 ZSCALER_FIREWALL 日志类型的日志字段及其对应的 UDM 字段。

Log field	UDM mapping	Logic
fwd_gw_name	intermediary.resource.name
	intermediary.resource.resource_type	If the fwd_gw_name log field value is not empty or the ofwd_gw_name log field value is not empty, then the intermediary.resource.resource_type UDM field is set to GATEWAY.
ofwd_gw_name	intermediary.security_result.detection_fields[ofwd_gw_name]
ordr_rulename	intermediary.security_result.detection_fields[ordr_rulename]
orulelabel	intermediary.security_result.detection_fields[orulelabel]
rdr_rulename	intermediary.security_result.rule_name
rulelabel	intermediary.security_result.rule_name
erulelabel	intermediary.security_result.rule_name
bypass_etime	metadata.collected_timestamp
datetime	metadata.event_timestamp
epochtime	metadata.event_timestamp
	metadata.event_type	If the sdport log field value is equal to 80 or the sdport log field value is equal to 443 and the csip log field value is not empty or the tsip log field value is not empty or the ssip log field value is not empty and the cdip log field value is not empty or the sdip log field value is not empty, then the metadata.event_type UDM field is set to NETWORK_HTTP. Else, if the csip log field value is not empty or the tsip log field value is not empty or the ssip log field value is not empty and the cdip log field value is not empty or the sdip log field value is not empty, then the metadata.event_type UDM field is set to NETWORK_CONNECTION. Else, if the csip log field value is not empty or the tsip log field value is not empty or the ssip log field value is not empty, then the metadata.event_type UDM field is set to STATUS_UPDATE. Else, the metadata.event_type UDM field is set to GENERIC_EVENT.
recordid	metadata.product_log_id
	metadata.product_name	The metadata.product_name UDM field is set to Firewall.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Zscaler.
proto	network.ip_protocol	If the proto log field value contain one of the following values, then the proto log field is mapped to the network.ip_protocol UDM field. TCP UDP ICMP GRE IP6IN4 IGMP
inbytes	network.received_bytes
outbytes	network.sent_bytes
avgduration	network.session_duration.nanos	If the durationms log field value is empty and the avgduration log field value is not empty, then the avgduration log field is mapped to the network.session_duration.nanos UDM field.
durationms	network.session_duration.nanos	If the durationms log field value is not empty, then the durationms log field is mapped to the network.session_duration.nanos UDM field.
duration	network.session_duration.seconds
	principal.asset.asset_id	If the devicename log field value is not empty, then the Zscaler:devicename log field is mapped to the principal.asset.asset_id UDM field.
devicemodel	principal.asset.hardware.model
devicehostname	principal.asset.hostname	If the devicehostname log field value is not empty, then the devicehostname log field is mapped to the principal.asset.hostname UDM field.
	principal.asset.platform_software.platform	If the deviceostype log field value matches the regular expression pattern (?i)iOS, then the principal.asset.platform_software.platform UDM field is set to IOS. Else, if the deviceostype log field value matches the regular expression pattern (?i)Android, then the principal.asset.platform_software.platform UDM field is set to ANDROID. Else, if the deviceostype log field value matches the regular expression pattern (?i)Windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the deviceostype log field value matches the regular expression pattern (?i)MAC, then the principal.asset.platform_software.platform UDM field is set to MAC. Else, if the deviceostype log field value matches the regular expression pattern (?i)Other, then the principal.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
deviceosversion	principal.asset.platform_software.platform_version
external_deviceid	principal.asset.product_object_id
csip	principal.ip
tsip	principal.ip
srcip_country	principal.location.country_or_region
location	principal.location.name
locationname	principal.location.name
ssip	principal.nat_ip
ssport	principal.nat_port
csport	principal.port
dept	principal.user.department
department	principal.user.department
login	principal.user.email_addresses	The login field is extracted from login log field using the Grok pattern, and the login log field is mapped to the principal.user.email_addresses UDM field.
user	principal.user.email_addresses	The user field is extracted from user log field using the Grok pattern, and the user log field is mapped to the principal.user.email_addresses UDM field.
deviceowner	principal.user.userid
	security_result.action	If the action log field value matches the regular expression pattern ^Allow.*, then the security_result.action UDM field is set to ALLOW. Else, if the action log field value matches the regular expression pattern ^Drop.* or ^Block.*, then the security_result.action UDM field is set to BLOCK. Else, if the action log field value is equal to Reset, then the security_result.action UDM field is set to BLOCK.
action	security_result.action_details
	security_result.category	If the ipcat log field value is not empty or the oipcat log field value is not empty, then the security_result.category UDM field is set to NETWORK_CATEGORIZED_CONTENT.
ipcat	security_result.category_details	The ipcat log field is mapped to the security_result.category_details UDM field.
threatcat	security_result.category_details	If the threatcat log field value is not equal to None, then the threatcat log field is mapped to the security_result.category_details UDM field.
	security_result.detection_fields[bypassed_session]	If the bypassed_session log field value is equal to 0, then the security_result.detection_fields.bypassed_session UDM field is set to the traffic did not bypass Zscaler Client Connector. Else, if the bypassed_session log field value is equal to 1, then the security_result.detection_fields.bypassed_session UDM field is set to the traffic bypassed Zscaler Client Connector.
odevicehostname	security_result.detection_fields[odevicehostname]
odevicename	security_result.detection_fields[odevicename]
odeviceowner	security_result.detection_fields[odeviceowner]
oipcat	security_result.detection_fields[oipcat]
oipsrulelabel	security_result.detection_fields[oipsrulelabel]
numsessions	security_result.detection_fields[numsessions]
	security_result.rule_labels [ips_custom_signature]	If the ips_custom_signature log field value is equal to 0, then the security_result.rule_labels.ips_custom_signature UDM field is set to non-custom IPS rule. Else, if the ips_custom_signature log field value is equal to 1, then the security_result.rule_labels.ips_custom_signature UDM field is set to custom IPS rule.
ipsrulelabel	security_result.rule_name	If the ipsrulelabel log field value is not equal to None, then the ipsrulelabel log field is mapped to the security_result.rule_name UDM field.
threatname	security_result.threat_name	If the threatname log field value is not equal to None, then the threatname log field is mapped to the security_result.threat_name UDM field.
ethreatname	security_result.threat_name	If the ethreatname log field value is not equal to None, then the ethreatname log field is mapped to the security_result.threat_name UDM field.
nwapp	target.application
cdfqdn	target.domain.name
sdip	target.ip
datacentercity	target.location.city
destcountry	target.location.country_or_region
datacentercountry	target.location.country_or_region
datacenter	target.location.name
cdip	target.nat_ip
cdport	target.nat_port
sdport	target.port
odnatlabel	target.security_result.detection_fields[odnatlabel]
dnat	target.security_result.rule_labels[dnat]
dnatrulelabel	target.security_result.rule_name
aggregate	additional.fields[aggregate]
day	additional.fields[day]
dd	additional.fields[dd]
deviceappversion	additional.fields[deviceappversion]
eedone	additional.fields[eedone]
flow_type	additional.fields[flow_type]
hh	additional.fields[hh]
mm	additional.fields[mm]
mon	additional.fields[mon]
mth	additional.fields[mth]
nwsvc	additional.fields[nwsvc]
ocsip	additional.fields[ocsip]
ozpa_app_seg_name	additional.fields[ozpa_app_seg_name]
ss	additional.fields[ss]
sourcetype	additional.fields[sourcetype]
stateful	additional.fields[stateful]
tz	additional.fields[tz]
tuntype	additional.fields[traffic_forwarding_method]
tunsport	additional.fields[tunsport]
yyyy	additional.fields[yyyy]
zpa_app_seg_name	additional.fields[zpa_app_seg_name]
ztunnelversion	additional.fields[ztunnelversion]