Coletar registros de eventos de abuso do Google Cloud

Compatível com:

Neste documento, descrevemos como coletar registros de eventos de abuso do Google Cloud ativando a ingestão de telemetria no Google SecOps e como os campos de registro de eventos de abuso do Google Cloud são mapeados para os campos do modelo unificado de dados (UDM) do Google SecOps. Google Cloud

Para mais informações, consulte Ingestão de dados no Google Security Operations.

A implantação contém os seguintes componentes:

  • Google Cloud: os serviços e produtos do Google Cloud que você coleta registros.

  • Registros de eventos de abuso do Google Cloud: os registros de eventos de abuso do Google Cloud ativados para ingestão no Google SecOps.

  • Google SecOps: o Google SecOps retém e analisa os registros de eventos de abuso do Google Cloud.

Um rótulo de ingestão identifica o analisador que normaliza dados de registro brutos para o formato UDM estruturado. As informações neste documento se aplicam ao analisador com o rótulo de ingestão GCP_ABUSE_EVENTS.

Antes de começar

Verifique se todos os sistemas na arquitetura de implantação estão configurados no fuso horário UTC.

Configurar Google Cloud para ingerir registros de eventos de abuso do Google Cloud

Para ingerir registros de eventos de abuso do Google Cloud no Google SecOps, siga as etapas em Ingerir registros Google Cloud no Google SecOps.

Uma implantação típica consiste em registros de eventos de abuso do Google Cloud ativados para ingestão no Google SecOps. Cada implantação do cliente pode ser diferente dessa representação e ser mais complexa.

Se você tiver problemas ao ingerir registros de eventos de abuso do Google Cloud, entre em contato com o suporte do Google SecOps.

Formato e exemplo de registros de eventos de abuso do Google Cloud compatíveis

O analisador de eventos de abuso do Google Cloud é compatível com registros no formato JSON. Confira o seguinte exemplo:

    {
        "insertId": "dummy-insert-id",
        "jsonPayload": {
            "action": "NOTIFY",
            "@type": "type.googleapis.com/google.cloud.abuseevent.logging.v1.AbuseEvent",
            "cryptoMiningEvent": {
                "detectedMiningEndTime": "2048-03-18T07: 10: 00Z",
                "detectedMiningStartTime": "2016-07-10T05: 24: 00Z",
                "vmIp": [
                    "dummy.ip.address.1",
                    "dummy.ip.address.2",
                    "dummy.ip.address.3"
                ],
                "vmResource": [
                    "projects/dummy-project-id/zones/dummy-zone/instances/dummy-instance-id"
                ]
            },
            "detectionType": "CRYPTO_MINING",
            "reason": "The monitored resource is mining cryptocurrencies",
            "remediationLink": "https://dummy-remediation-link"
        },
        "resource": {
            "type": "abuseevent.googleapis.com/Location",
            "labels": {
                "location": "global",
                "resource_container": "projects/dummy-resource-container-id"
            }
        },
        "timestamp": "2025-07-10T17:31:53.966189618Z",
        "severity": "NOTICE",
        "labels": {
            "abuseevent.googleapis.com/vm_resource": "projects/dummy-project-id/zones/dummy-zone/instances/dummy-instance-id"
        },
        "logName": "projects/dummy-project-id/logs/abuseevent.googleapis.com%2Fabuse_events",
        "receiveTimestamp": "2025-07-10T17:31:54.754890208Z"
    }

Referência de mapeamento de campos

Referência de mapeamento de campo: GCP_ABUSE_EVENTS

A tabela a seguir lista os campos de registro e os campos correspondentes da UDM.

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to SCAN_UNCATEGORIZED.
metadata.vendor_name The metadata.vendor_name UDM field is set to Google Cloud Platform.
metadata.product_name The metadata.product_name UDM field is set to GCP Abuse Events.
insertId metadata.product_log_id
resource.type target.resource.resource_subtype
resource.labels.location target.location.name
timestamp metadata.event_timestamp
security_result.severity If the severity log field value is equal to CRITICAL then, the security_result.severity UDM field is set to CRITICAL.
Else, if severity log field value is equal to ERROR then, the security_result.severity UDM field is set to ERROR.
Else, if severity log field value contain one of the following values
  • ALERT
  • EMERGENCY
then, the security_result.severity UDM field is set to HIGH.
Else, if severity log field value contain one of the following values
  • INFO
  • NOTICE
then, the security_result.severity UDM field is set to INFORMATIONAL.
Else, if severity log field value is equal to DEBUG then, the security_result.severity UDM field is set to LOW.
Else, if severity log field value is equal to WARNING then, the security_result.severity UDM field is set to MEDIUM.
Else, the security_result.severity UDM field is set to UNKNOWN_SEVERITY.
severity security_result.severity_details
logName metadata.url_back_to_product
receiveTimestamp metadata.collected_timestamp
jsonPayload.detectionType security_result.category_details
security_result.category If the security_result.category_mapping log field value is equal to DETECTION_TYPE_UNSPECIFIED then, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
Else, if security_result.category_mapping log field value is equal to CRYPTO_MINING then, the security_result.category UDM field is set to EXPLOIT.
Else, if security_result.category_mapping log field value is equal to LEAKED_CREDENTIALS then, the security_result.category UDM field is set to PHISHING.
Else, if security_result.category_mapping log field value is equal to PHISHING then, the security_result.category UDM field is set to PHISHING.
Else, if security_result.category_mapping log field value is equal to MALWARE then, the security_result.category UDM field is set to SOFTWARE_MALICIOUS.
Else, if security_result.category_mapping log field value is equal to NO_ABUSE then, the security_result.category UDM field is set to POLICY_VIOLATION.
jsonPayload.reason security_result.description
security_result.action If the jsonPayload.action log field value is equal to ACTION_TYPE_UNSPECIFIED then, the security_result.action UDM field is set to UNKNOWN_ACTION.
Else, if the jsonPayload.action log field value is equal to NOTIFY then, the security_result.action UDM field is set to ALLOW.
Else, if the jsonPayload.action log field value is equal to PROJECT_SUSPENSION then, the security_result.action UDM field is set to BLOCK.
Else, if the jsonPayload.action log field value is equal to REINSTATE then, the security_result.action UDM field is set to ALLOW.
Else, if the jsonPayload.action log field value is equal to WARN then, the security_result.action UDM field is set to ALLOW.
Else, if the jsonPayload.action log field value is equal to RESOURCE_SUSPENSION then, the security_result.action UDM field is set to BLOCK.
labels.abuseevent.googleapis.com/vm_resource principal.resource.name
principal.resource.resource_type If the event_type.crypto_mining_event.vm_resource log field value is not empty then, the target.resource.resource_type UDM field is set to VIRTUAL_MACHINE.
jsonPayload.cryptoMiningEvent.detectedMiningStartTime security_result.detection_fields[detected_mining_start_time]
jsonPayload.cryptoMiningEvent.detectedMiningEndTime security_result.detection_fields[detected_mining_end_time]
jsonPayload.cryptoMiningEvent.vmIp principal.ip
jsonPayload.leaked_credential_event.credential_type.service_account_credential.service_account.service_account principal.user.userid
jsonPayload.leaked_credential_event.credential_type.service_account_credential.service_account.key_id principal.user.attribute.labels[service_account_key_id]
jsonPayload.leakedCredentialEvent.apiKeyCredential.apiKey principal.user.attribute.labels[api_key_credential_api_key]
jsonPayload.leakedCredentialEvent.detectedUri security_result.about.url
jsonPayload.harmfulContentEvent.uri security_result.detection_fields[harmful_content_event_uri]
jsonPayload.remediationLink security_result.detection_fields[remediation_link]
jsonPayload.@type security_result.detection_fields[jsonPayload_type]
resource.labels.resource_container principal.resource.attribute.labels[resource_container]

A seguir

Precisa de mais ajuda? Receba respostas de membros da comunidade e profissionais do Google SecOps.