Jamf Protect 로그 수집

다음에서 지원:

Google SecOps SIEM

이 문서에서는 Google Security Operations 피드를 설정하여 Jamf Protect 로그를 수집하는 방법과 로그 필드가 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑되는 방식을 설명합니다. 또한 이 문서에는 지원되는 Jamf Protect 버전도 나와 있습니다.

자세한 내용은 Google Security Operations에 데이터 수집을 참조하세요.

일반적인 배포는 Google Security Operations에 로그를 전송하도록 구성된 Google Security Operations 피드와 Jamf Protect로 구성됩니다. 고객 배포마다 다를 수 있으며 더 복잡할 수도 있습니다.

배포에는 다음 구성요소가 포함됩니다.

• Jamf Protect. 로그를 수집하는 Jamf Protect 플랫폼입니다.

• Google Security Operations 피드. Jamf Protect에서 로그를 가져오고 로그를 Google Security Operations에 작성하는 Google Security Operations 피드입니다.

• Google Security Operations. Google Security Operations는 Jamf Protect의 로그를 보관하고 분석합니다.

수집 라벨은 원시 로그 데이터를 구조화된 UDM 형식으로 정규화하는 파서를 식별합니다. 이 문서의 정보는 JAMF_PROTECT 수집 라벨이 있는 파서에 적용됩니다.

시작하기 전에

다음 기본 요건이 충족되었는지 확인합니다.

• Jamf Protect 설정
• Jamf Protect 버전 4.0.0 이상
• 배포 아키텍처의 모든 시스템은 UTC 시간대로 구성됩니다.

피드 설정

Amazon S3 또는 웹훅을 사용하여 Google SecOps에서 수집 피드를 설정할 수 있습니다.

이 로그 유형을 구성하려면 다음 단계를 따르세요.

1. SIEM 설정> 피드로 이동합니다.
2. 새 피드 추가를 클릭합니다.
3. JAMF 피드 팩을 클릭합니다.
4. 다음 필드의 값을 지정합니다.
   • 소스 유형: 웹훅 (권장)
   • 분할 구분 기호: 로그 줄을 구분하는 데 사용되는 구분 기호입니다(예: \n).

고급 옵션

• 피드 이름: 피드를 식별하는 미리 채워진 값입니다.
• 애셋 네임스페이스: 피드와 연결된 네임스페이스입니다.
• 수집 라벨: 이 피드의 모든 이벤트에 적용되는 라벨입니다.
• 피드 만들기를 클릭합니다.

이 제품군 내에서 다양한 로그 유형에 대해 여러 피드를 구성하는 방법에 관한 자세한 내용은 제품별 피드 구성을 참고하세요.

웹훅 피드에 대한 API 키 만들기

1. Google Cloud 콘솔 > 사용자 인증 정보로 이동합니다.

   사용자 인증 정보로 이동

2. 사용자 인증 정보 만들기를 클릭한 후 API 키를 선택합니다.

3. Google Security Operations API에 대한 API 키 액세스를 제한합니다.

웹훅 피드용 Jamf Protect 설정

1. Jamf Protect 애플리케이션에서 관련 작업 구성으로 이동합니다.
2. 새 데이터 엔드포인트를 추가하려면 작업 만들기를 클릭합니다.
3. HTTP를 프로토콜로 선택합니다.
4. URL 필드에 Google Security Operations API 엔드포인트의 HTTPS URL을 입력합니다. (웹훅 피드 설정에서 복사한 엔드포인트 정보 필드입니다. 이미 필요한 형식입니다.)

5. 다음 형식의 커스텀 헤더의 일부로 API 키와 보안 비밀 키를 지정하여 인증을 사용 설정합니다.

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   권장사항: URL에 지정하는 대신 API 키를 헤더로 지정하세요. 웹훅 클라이언트가 커스텀 헤더를 지원하지 않는 경우 쿼리 파라미터를 다음 형식으로 사용하여 API 키와 보안 비밀 키를 지정할 수 있습니다.

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

   다음을 바꿉니다.

   • ENDPOINT_URL: 피드 엔드포인트 URL입니다.
   • API_KEY: Google Security Operations에 인증하기 위한 API 키입니다.
   • SECRET: 피드를 인증하기 위해 생성한 보안 비밀 키입니다.

6. 로그 수집 섹션에서 알림 및 통합 로그를 선택합니다.

7. 제출을 클릭합니다.

Google Security Operations 피드에 대한 자세한 내용은 Google Security Operations 피드 문서를 참조하세요. 각 피드 유형의 요구사항은 유형별 피드 구성을 참조하세요.

피드를 만들 때 문제가 발생하면 Google Security Operations 지원팀에 문의하세요.

지원되는 Jamf Protect 로그 유형

다음 표에는 Jamf Protect 파서에서 지원하는 로그 유형이 나와 있습니다.

이벤트 유형	표시 이름
GPClickEvent	합성 클릭 이벤트
GPDownloadEvent	다운로드 이벤트
GPFSEvent	파일 시스템 이벤트
GPGatekeeperEvent	게이트키퍼 이벤트
GPKeylogRegisterEvent	키로거 이벤트
GPMRTEvent	모니터링 이벤트
GPPreventedExecutionEvent	커스텀 방지 목록 이벤트
GPProcessEvent	처리 이벤트
GPThreatMatchExecEvent	위협 방지 이벤트
GPUSBEvent	USB 이벤트
GPUnifiedLogEvent	통합 로그 이벤트
Auth-mount	기기 제어 이벤트

지원되는 Jamf Protect 로그 형식

Jamf Protect 파서는 JSON 형식의 로그를 지원합니다.

지원되는 Jamf Protect 샘플 로그

• JSON

  {
    "input": {
      "match": {
        "custom": false,
        "facts": [
          {
            "actions": [
              {
                "name": "CacheFile",
                "parameters": {}
              },
              {
                "name": "Report",
                "parameters": {}
              }
            ],
            "human": "Login Hook created for persistence",
            "context": [
              {
                "name": "ItemBinary",
                "value": "\\/path\\/to\\/suspiciousfile.sh",
                "valueType": "Binary"
              },
              {
                "name": "Itemname",
                "value": "\\/path\\/to\\/suspiciousfile.sh",
                "valueType": "String"
              }
            ],
            "uuid": "dummyuuid",
            "version": 2,
            "severity": 0,
            "tags": [
              "MITREattack",
              "T1037.002",
              "BootOrLogonAutostartExecution",
              "Persistence"
            ],
            "name": "LoginHook"
          }
        ],
        "event": {
          "timestamp": 1676994504.698714,
          "uid": 0,
          "eventID": 9141,
          "prevFile": "\\/private\\/var\\/folders\\/zz\\/zyxvpxvq6csfxvn_n0000000000000\\/T\\/TemporaryItems\\/com.apple.loginwindow.plist.X0YcxtR",
          "iNode": 62898,
          "dev": 16777220,
          "uuid": "AE7F101A-09AA-4CD6-940F-15EC2073E476",
          "path": "\\/var\\/root\\/Library\\/Preferences\\/com.dummy.path.plist",
          "type": 3,
          "gid": 0,
          "pid": 148
        },
        "uuid": "1263F6F0-6891-4105-993F-6889AB3A3555",
        "context": [
          {
            "name": "ItemBinary",
            "value": "\\/path\\/to\\/suspiciousfile.sh",
            "valueType": "Binary"
          },
          {
            "name": "Itemname",
            "value": "\\/path\\/to\\/suspiciousfile.sh",
            "valueType": "String"
          }
        ],
        "severity": 0,
        "tags": [
          "T1037.002",
          "Persistence",
          "BootOrLogonAutostartExecution",
          "MITREattack"
        ],
        "actions": [
          {
            "name": "CacheFile",
            "parameters": {}
          },
          {
            "name": "Report",
            "parameters": {}
          }
        ]
      },
      "host": {
        "ips": [
          "192.51.100.1"
        ],
        "provisioningUDID": "8AD54CA5-F0DC-5434-8147-26D1D8A426CD",
        "hostname": "dummy-hostname",
        "serial": "dummyserial"
      },
      "eventType": "GPFSEvent",
      "related": {
        "users": [
          {
            "uid": 0,
            "name": "root",
            "uuid": "dummyuid"
          }
        ],
        "files": [
          {
            "xattrs": [],
            "sha256hex": "67fc9bde97641361d3b521a01f8b907269a4d6434f2db10e163a71b70178b3d1",
            "modified": 1676985886,
            "uid": 0,
            "changed": 1676985886,
            "sha1hex": "e3bc8f9c241f86e7138ba6cfb0e0e206b131a7e3",
            "isAppBundle": false,
            "isScreenShot": false,
            "path": "\\/var\\/root\\/Library\\/Preferences\\/com.apple.loginwindow.plist",
            "size": 42,
            "gid": 0,
            "inode": 62898,
            "mode": 33152,
            "isDownload": false,
            "created": 1676985886,
            "accessed": 1676985886,
            "fsid": 16777220,
            "signingInfo": {
              "status": -67062,
              "authorities": [],
              "teamid": "",
              "signerType": 4,
              "statusMessage": "code object is not signed at all",
              "entitlements": [],
              "appid": ""
            },
            "isDirectory": false
          }
        ],
        "binaries": [
          {
            "xattrs": [],
            "sha256hex": "9a282c0623110b57953bb74238f02704f729eb9779381eef851b2ebe7626f890",
            "modified": 1675935593,
            "uid": 0,
            "changed": 1675935593,
            "sha1hex": "454634df6b7cd32a4dcca9d346eb3efb34dc780d",
            "isAppBundle": false,
            "isScreenShot": false,
            "path": "\\/usr\\/sbin\\/cfprefsd",
            "size": 200608,
            "gid": 0,
            "inode": 1152921500312430765,
            "mode": 33261,
            "isDownload": false,
            "created": 1675935593,
            "accessed": 1675935593,
            "fsid": 16777220,
            "signingInfo": {
              "status": 0,
              "cdhash": "SXboWMc7MOtMM0K3pOxRjqR59w0=",
              "authorities": [
                "Software Signing",
                "Apple Code Signing Certification Authority",
                "Apple Root CA"
              ],
              "teamid": "",
              "signerType": 0,
              "statusMessage": "No error.",
              "entitlements": [],
              "appid": "com.dummy.domain"
            },
            "isDirectory": false
          }
        ],
        "groups": [
          {
            "gid": 0,
            "name": "wheel",
            "uuid": "FVFZQ5FDLYWG0"
          }
        ],
        "processes": [
          {
            "originalParentPID": 1,
            "uuid": "06D1425D-082A-4E11-81E4-75A9E3F2B8EF",
            "ruid": 0,
            "uid": 0,
            "startTimestamp": 1676976036,
            "ppid": 1,
            "path": "\\/usr\\/sbin\\/cfprefsd",
            "gid": 0,
            "rgid": 0,
            "args": [
              "\\/usr\\/sbin\\/cfprefsd",
              "daemon"
            ],
            "signingInfo": {
              "status": 0,
              "cdhash": "SXboWMc7MOtMM0K3pOxRjqR59w0=",
              "authorities": [
                "Software Signing",
                "Apple Code Signing Certification Authority",
                "Apple Root CA"
              ],
              "teamid": "",
              "signerType": 0,
              "statusMessage": "No error.",
              "entitlements": [],
              "appid": "com.dummy.domain"
            },
            "pid": 148,
            "name": "dummyhostname",
            "pgid": 148
          }
        ]
      }
    },
    "caid": "a2afe04d1360c01a0758ad3319c9af305f794801917b0c04648e4d7a9d7d746b",
    "certid": "05f5b0fa822a2f5e9a29f018853e8f2d99b94c8af38f40268a9479f2e6038e6b"
  }
  

필드 매핑 참조

이 섹션에서는 Google Security Operations 파서에서 Jamf Protect 필드를 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑하는 방법을 설명합니다.

필드 매핑 참조: 이벤트 식별자에서 이벤트 유형으로

다음 표에는 JAMF_PROTECT 로그 유형과 해당 UDM 이벤트 유형이 나와 있습니다.

Event Identifier	Event Type
GPClickEvent	SCAN_UNCATEGORIZED
GPDownloadEvent	SCAN_FILE
GPFSEvent	SCAN_FILE
GPGatekeeperEvent	SCAN_UNCATEGORIZED
GPKeylogRegisterEvent	SCAN_UNCATEGORIZED
GPMRTEvent	SCAN_UNCATEGORIZED
GPPreventedExecutionEvent	SCAN_UNCATEGORIZED
GPProcessEvent	SCAN_PROCESS
GPThreatMatchExecEvent	SCAN_UNCATEGORIZED
GPUSBEvent	SCAN_UNCATEGORIZED
GPUnifiedLogEvent	SCAN_UNCATEGORIZED
GPScreenshotEvent	SCAN_UNCATEGORIZED
Auth-mount	SCAN_UNCATEGORIZED

필드 매핑 참조: JAMF_PROTECT

다음 표에는 JAMF_PROTECT 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

지원 중단됨:

UDM 명사의 labels 필드인 about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels, target.labels가 지원 중단되었습니다. 기존 파서의 경우 이러한 UDM 필드 외에도 로그 필드가 키/값 additional.fields UDM 필드에 매핑됩니다. 새 파서의 경우 지원 중단된 labels UDM 필드 대신 additional.fields UDM 필드의 키-값 설정이 사용됩니다. 지원 중단된 labels UDM 필드 대신 additional.fields UDM 필드에서 키-값 설정을 사용하도록 기존 규칙을 업데이트하는 것이 좋습니다.

Log field	UDM mapping	Logic
	about.platform	The about.platform UDM field is set to MAC.
caid	about.labels[caid] (deprecated)
caid	additional.fields[caid]
certid	principal.asset.attribute.labels [certid]
context.identity.claims.certid	principal.user.attribute.permissions.description
context.identity.claims.clientid	principal.user.attribute.labels [context_identity_claims_clientid]
input.eventType	metadata.product_event_type
input.host.hostname	principal.hostname
input.host.ips	principal.ip
input.host.os	principal.platform_version
input.host.protectVersion	principal.asset.attribute.labels [input_host_protectversion]
input.match.version	additional.fields [input_match_version]
input.match.facts.matchReason	security_result.detection_fields [input_match_facts_matchreason]
input.related.files.objectType	additional.fields [input_related_files_objecttype]
input.host.provisioningUDID	principal.asset.product_object_id
input.host.serial	principal.asset.hardware.serial_number
input.match.actions.name	security_result.outcomes [input_match_actions_name]
input.match.actions.parameters.message	security_result.summary	If the index value is equal to 0, then the input.match.actions.parameters.message log field is mapped to the security_result.summary UDM field. Else, the input.match.actions.parameters.message log field is mapped to the security_result.detection_fields.value UDM field.
input.match.actions.parameters.title	security_result.description	If the index value is equal to 0, then the input.match.actions.parameters.title log field is mapped to the security_result.description UDM field. Else, the input.match.actions.parameters.title log field is mapped to the security_result.detection_fields.value UDM field.
input.match.context.name	security_result.detection_fields.key
input.match.context.value	security_result.detection_fields.value [Name]
input.match.context.valueType
input.match.custom	security_result.detection_fields [input_match_custom]
input.match.event.blocked	security_result.action	If the input.match.event.blocked log field value is not empty, then the security_result.action UDM field is set to BLOCK.
context.identity.claims.hd, input.match.uuid	security_result.url_back_to_product	The security_result.url_back_to_product UDM field is set to https://context.identity.claims.hd.jamfcloud.com/Alerts/input.match.uuid.
input.match.event.category	security_result.category_details
input.match.event.clickType	principal.labels[input_match_event_click_type] (deprecated)	If the input.match.event.clickType log field value is equal to 0, then the principal.labels.value UDM field is set to 0 - Other. Else, if the input.match.event.clickType log field value is equal to 1, then the principal.labels.value UDM field is set to 1 - Left Down. Else, if the input.match.event.clickType log field value is equal to 2, then the principal.labels.value UDM field is set to 2 - Left Up. Else, if the input.match.event.clickType log field value is equal to 3, then the principal.labels.value UDM field is set to 3 - Right Down. Else, if the input.match.event.clickType log field value is equal to 4, then the principal.labels.value UDM field is set to 4 - Right Up.
input.match.event.clickType	additional.fields[input_match_event_click_type]	If the input.match.event.clickType log field value is equal to 0, then the additional.fields.value.string_value UDM field is set to 0 - Other. Else, if the input.match.event.clickType log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Left Down. Else, if the input.match.event.clickType log field value is equal to 2, then the additional.fields.value.string_value UDM field is set to 2 - Left Up. Else, if the input.match.event.clickType log field value is equal to 3, then the additional.fields.value.string_value UDM field is set to 3 - Right Down. Else, if the input.match.event.clickType log field value is equal to 4, then the additional.fields.value.string_value UDM field is set to 4 - Right Up.
input.match.event.composedMessage	principal.labels[input_match_event_composed_message] (deprecated)
input.match.event.composedMessage	additional.fields[input_match_event_composed_message]
input.match.event.dev	principal.labels[input_match_event_dev] (deprecated)
input.match.event.dev	additional.fields[input_match_event_dev]
input.match.event.eventID	principal.labels[input_match_event_eventID] (deprecated)
input.match.event.eventID	additional.fields[input_match_event_eventID]
input.match.event.gid	principal.user.group_identifiers
input.match.event.iNode	target.file.stat_inode
input.match.event.matchType	principal.labels[input_match_event_match_type] (deprecated)
input.match.event.matchType	additional.fields[input_match_event_match_type]
input.match.event.matchValue	security_result.threat_name	If the input.match.event.matchType log field value is not empty, then the input.match.event.matchValue log field is mapped to the security_result.threat_name UDM field.
input.match.event.name	about.labels[input_match_event_name] (deprecated)
input.match.event.name	additional.fields[input_match_event_name]
input.match.facts.name	metadata.description	If the index value is equal to 0, then the input.match.facts.name log field is mapped to the metadata.description UDM field.
input.match.event.path	target.process.file.full_path
input.match.event.pid	principal.process.pid
input.match.event.prevFile	src.file.full_path	If the input.match.event.prevFile log field value is not empty, then the input.match.event.prevFile log field is mapped to the src.file.full_path UDM field.
input.match.event.process	principal.process.file.names
input.match.event.process.args	target.process.command_line_history
input.match.event.process.gid	target.group.product_object_id
input.match.event.process.name	target.process.file.names
input.match.event.process.originalParentPID	target.process.parent_process.pid
input.match.event.process.path	target.process.file.full_path
input.match.event.process.pgid	target.labels[input_match_event_processes_pgid] (deprecated)
input.match.event.process.pgid	additional.fields[input_match_event_processes_pgid]
input.match.event.process.pid	target.process.pid
input.match.event.process.ppid	target.labels[input_match_event_process_ppid] (deprecated)
input.match.event.process.ppid	additional.fields[input_match_event_process_ppid]
input.match.event.process.responsiblePID	target.labels[input_match_event_process_responsible_pid] (deprecated)
input.match.event.process.responsiblePID	additional.fields[input_match_event_process_responsible_pid]
input.match.event.process.rgid	target.labels[input_match_event_process_rgid] (deprecated)
input.match.event.process.rgid	additional.fields[input_match_event_process_rgid]
input.match.event.process.ruid	target.labels[input_match_event_process_ruid] (deprecated)
input.match.event.process.ruid	additional.fields[input_match_event_process_ruid]
input.match.event.process.signingInfo.appid	target.user.attribute.labels [input_match_event_process_sign_appid]
input.match.event.process.signingInfo.authorities	target.user.attribute.permissions
input.match.event.process.signingInfo.cdhash	target.user.attribute.labels [input_match_event_process_sign_cdhash]
input.match.event.process.signingInfo.entitlements	target.user.attributes.permissions
input.match.event.process.signingInfo.signerType	target.user.attribute.labels [input_match_event_process_sign_signer_type]	If the input.related.process.signingInfo.signerType log field value is equal to 0, then the target.user.attribute.labels.value UDM field is set to 0 - Apple. Else, if the input.related.process.signingInfo.signerType log field value is equal to 1, then the target.user.attribute.labels.value UDM field is set to 1 - App Store. Else, if the input.related.process.signingInfo.signerType log field value is equal to 2, then the target.user.attribute.labels.value UDM field is set to 2 - Developer. Else, if the input.related.process.signingInfo.signerType log field value is equal to 3, then the target.user.attribute.labels.value UDM field is set to 3 - Ad Hoc. Else, if the input.related.process.signingInfo.signerType log field value is equal to 4, then the target.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.match.event.process.signingInfo.status	target.user.attribute.labels [input_match_event_process_sign_status]
input.match.event.process.signingInfo.statusMessage	target.labels[input_match_event_process_sign_status_message] (deprecated)
input.match.event.process.signingInfo.statusMessage	additional.fields[input_match_event_process_sign_status_message]
input.match.event.process.signingInfo.teamid	target.user.group_identifiers
input.match.event.process.startTimestamp	target.labels[input_match_event_process_start_time_stamp] (deprecated)
input.match.event.process.startTimestamp	additional.fields[input_match_event_process_start_time_stamp]
input.match.event.process.uid	target.labels[input_match_event_process_uid] (deprecated)
input.match.event.process.uid	additional.fields[input_match_event_process_uid]
input.match.event.process.uuid	target.process.product_specific_process_id	The Process Uuid: input.match.event.process.uuid log field is mapped to the target.process.product_specific_process_id UDM field.
input.match.event.processIdentifier	target.process.pid
input.match.event.processImagePath	target.process.file.full_path
input.match.event.rateLimitingSecs	principal.labels[input_match_event_rate_limiting_secs] (deprecated)
input.match.event.rateLimitingSecs	additional.fields[input_match_event_rate_limiting_secs]
input.match.event.scriptPath	principal.labels[input_match_event_script_path] (deprecated)
input.match.event.scriptPath	additional.fields[input_match_event_script_path]
input.match.event.sender	principal.labels[input_match_event_sender] (deprecated)
input.match.event.sender	additional.fields[input_match_event_sender]
input.match.event.senderImagePath	principal.labels[input_match_event_sender_image_path] (deprecated)
input.match.event.senderImagePath	additional.fields[input_match_event_sender_image_path]
input.match.event.subsystem	principal.labels[input_match_event_subsystem] (deprecated)
input.match.event.subsystem	additional.fields[input_match_event_subsystem]
input.match.event.subType	principal.labels[input_match_event_sub_type] (deprecated)	If the input.match.event.subType log field value is equal to 7, then the principal.labels.value UDM field is set to 7 - Exec. Else, if the input.match.event.subType log field value is equal to 2, then the principal.labels.value UDM field is set to 2 - Fork. Else, if the input.match.event.subType log field value is equal to 1, then the principal.labels.value UDM field is set to 1 - Exit. Else, if the input.match.event.subType log field value is equal to 23, then the principal.labels.value UDM field is set to 23 - Execve. Else, if the input.match.event.subType log field value is equal to 43190, then the principal.labels.value UDM field is set to 43190 - Posix Spawn.
input.match.event.subType	additional.fields[input_match_event_sub_type]	If the input.match.event.subType log field value is equal to 7, then the additional.fields.value.string_value UDM field is set to 7 - Exec. Else, if the input.match.event.subType log field value is equal to 2, then the additional.fields.value.string_value UDM field is set to 2 - Fork. Else, if the input.match.event.subType log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Exit. Else, if the input.match.event.subType log field value is equal to 23, then the additional.fields.value.string_value UDM field is set to 23 - Execve. Else, if the input.match.event.subType log field value is equal to 43190, then the additional.fields.value.string_value UDM field is set to 43190 - Posix Spawn.
input.match.event.tags	security_result.rule_labels [input_match_event_tags]
input.match.event.targetpid	target.process.pid
input.match.event.timestamp	metadata.event_timestamp
input.match.event.type	target.labels[input_match_event_type] (deprecated)	If the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 0, then the target.labels.value UDM field is set to 0 - Created. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 1, then the target.labels.value UDM field is set to 1 - Deleted. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 3, then the target.labels.value UDM field is set to 3 - Renamed. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 4, then the target.labels.value UDM field is set to 4 - Modified. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 7, then the target.labels.value UDM field is set to 7 - Created Dir. Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 0, then the target.labels.value UDM field is set to 0 - None. Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 1, then the target.labels.value UDM field is set to 1 - Create. Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 2, then the target.labels.value UDM field is set to 0 - Exit.
input.match.event.type	additional.fields[input_match_event_type]	If the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 0, then the additional.fields.value.string_value UDM field is set to 0 - Created. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Deleted. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 3, then the additional.fields.value.string_value UDM field is set to 3 - Renamed. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 4, then the additional.fields.value.string_value UDM field is set to 4 - Modified. Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 7, then the additional.fields.value.string_value UDM field is set to 7 - Created Dir. Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 0, then the additional.fields.value.string_value UDM field is set to 0 - None. Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Create. Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 2, then the additional.fields.value.string_value UDM field is set to 0 - Exit.
input.match.event.uid	principal.user.userid
input.match.event.uuid	about.labels[input_match_event_uuid] (deprecated)
input.match.event.uuid	additional.fields[input_match_event_uuid]
input.match.facts.actions.name	security_result.action_details	If the index value is equal to 0, then the input.match.facts.actions.name log field is mapped to the security_result.action_details UDM field. Else, the input.match.facts.actions.name log field is mapped to the security_result.about.labels.value UDM field.
input.match.facts.actions.parameters.id	security_result.detection_fields [input_match_facts_actions_parameters_id]
input.match.facts.actions.parameters.message	security_result.detection_fields [input_match_facts_actions_parameters_message]
input.match.facts.actions.parameters.title	security_result.detection_fields [input_match_facts_actions_parameters_title]
input.match.facts.context.name	security_result.detection_fields.key
input.match.facts.context.value	security_result.detection_fields.value [Name]
input.match.facts.context.valueType
input.match.facts.human	security_result.action	If the input.match.facts.human log field value is matched with regex (?i)blocked, then the security_result.action UDM field is set to BLOCK.
input.match.facts.human	security_result.description	If the index value is equal to 0, then the input.match.facts.human log field is mapped to the security_result.description UDM field. Else, the input.match.facts.human log field is mapped to the security_result.detection_fields.value UDM field.
input.match.facts.name	security_result.summary	If the index value is equal to 0, then the input.match.facts.name log field is mapped to the security_result.summary UDM field. Else, the input.match.facts.name log field is mapped to the security_result.detection_fields.value UDM field.
input.match.facts.severity	security_result.detection_fields [input_match_facts_severity]
input.match.facts.tags	security_result.rule_labels [input_match_facts_tags]
input.match.facts.uuid	about.labels [input_match_facts_uuid]
input.match.facts.version	about.labels [input_match_facts_version]
input.match.severity	security_result.severity	If the severity log field value is equal to 0, then the security_result.severity UDM field is set to INFORMATIONAL. Else, if the severity log field value is equal to 1, then the security_result.severity UDM field is set to LOW. Else, if the severity log field value is equal to 2, then the security_result.severity UDM field is set to MEDIUM. Else, if the severity log field value is equal to 3, then the security_result.severity UDM field is set to HIGH.
input.match.tags	security_result.rule_labels [input_match_tags]
input.match.uuid	metadata.product_log_id
input.related.binaries.accessed	security_result.about.labels [input_related_binaries_accessed]
input.related.binaries.changed	security_result.about.labels [input_related_binaries_changed]
input.related.binaries.created	security_result.about.file.first_seen_time	If the index value is equal to 0, then the input.related.binaries.created log field is mapped to the security_result.about.file.first_seen_time UDM field. Else, the input.related.binaries.created log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.fsid	security_result.about.labels [input_related_binaries_fsid]
input.related.binaries.gid	security_result.about.labels [input_related_binaries_gid]
input.related.binaries.inode	security_result.about.file.stat_inode	If the index value is equal to 0, then the input.related.binaries.inode log field is mapped to the security_result.about.file.stat_inode UDM field. Else, the input.related.binaries.inode log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.isAppBundle	security_result.about.labels [isAppBundle]
input.related.binaries.isDirectory	security_result.about.labels [isDirectory]
input.related.binaries.isDownload	security_result.about.labels [isDownload]
input.related.binaries.isScreenShot	security_result.about.labels [isScreenShot]
input.related.binaries.mode	security_result.about.file.stat_mode	If the index value is equal to 0, then the input.related.binaries.mode log field is mapped to the security_result.about.file.stat_mode UDM field. Else, the input.related.binaries.mode log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.modified	security_result.about.file.last_modification_time	If the index value is equal to 0, then the input.related.binaries.modified log field is mapped to the security_result.about.file.last_modification_time UDM field. Else, the input.related.binaries.modified log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.path	security_result.about.file.full_path	If the index value is equal to 0, then the input.related.binaries.path log field is mapped to the security_result.about.file.full_path UDM field. Else, the input.related.binaries.path log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.sha1hex	security_result.about.file.sha1	If the index value is equal to 0, then the input.related.binaries.sha1hex log field is mapped to the security_result.about.file.sha1 UDM field. Else, the input.related.binaries.sha1hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.sha256hex	security_result.about.file.sha256	If the index value is equal to 0, then the input.related.binaries.sha256hex log field is mapped to the security_result.about.file.sha256 UDM field. Else, the input.related.binaries.sha256hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.signingInfo.appid	security_result.about.application	If the index value is equal to 0, then the input.related.binaries.signingInfo.appid log field is mapped to the security_result.about.application UDM field. Else, the input.related.binaries.signingInfo.appid log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.signingInfo.authorities	security_result.about.user.attribute.permissions
input.related.binaries.signingInfo.cdhash	security_result.about.labels [input_related_binaries_sign_cdhash]
input.related.binaries.signingInfo.entitlements	security_result.about.user.attribute.permisisons
input.related.binaries.signingInfo.signerType	security_result.about.user.attribute.labels [input_related_binaries_sign_signer_type]	If the input.related.binaries.signingInfo.signerType log field value is equal to 0, then the security_result.about.user.attribute.labels.value UDM field is set to 0 - Apple. Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 1, then the security_result.about.user.attribute.labels.value UDM field is set to 1 - App Store. Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 2, then the security_result.about.user.attribute.labels.value UDM field is set to 2 - Developer. Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 3, then the security_result.about.user.attribute.labels.value UDM field is set to 3 - Ad Hoc. Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 4, then the security_result.about.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.related.binaries.signingInfo.status	security_result.about.user.attribute.labels [input_related_binaries_sign_status]
input.related.binaries.signingInfo.statusMessage	security_result.about.user.attribute.labels [input_related_processes_sign_status_message]
input.related.binaries.signingInfo.teamid	security_result.about.user.group_identifiers	If the index value is equal to 0, then the input.related.binaries.signingInfo.teamid log field is mapped to the security_result.about.user.group_identifiers UDM field. Else, the input.related.binaries.signingInfo.teamid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.binaries.size	security_result.about.file.size	If the index value is equal to 0, then the input.related.binaries.size log field is mapped to the security_result.about.file.size UDM field. Else, the input.related.binaries.size log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.uid	security_result.about.user.userid	If the index value is equal to 0, then the input.related.binaries.uid log field is mapped to the security_result.about.user.userid UDM field. Else, the input.related.binaries.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.binaries.xattrs	security_result.about.user.attribute.labels [input_related_binaries_xattrs]
input.related.files.accessed	security_result.about.labels [input_related_files_accessed]
input.related.files.changed	security_result.about.labels [input_related_files_changed]
input.related.files.created	security_result.about.labels [input_related_files_created]
input.related.files.downloadedFrom	security_result.about.labels [input_related_files_downloaded_from]
input.related.files.fsid	security_result.about.labels [input_related_files_downloaded_fsid]
input.related.files.gid	security_result.about.group.product_object_id	If the index value is equal to 0, then the input.related.files.gid log field is mapped to the security_result.about.group.product_object_id UDM field. Else, the input.related.files.gid log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.inode	security_result.about.file.stat_inode	If the index value is equal to 0, then the input.related.files.inode log field is mapped to the security_result.about.file.stat_inode UDM field. Else, the input.related.files.inode log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.isAppBundle	security_result.about.labels [input_related_files_downloaded_is_app_bundle]
input.related.files.isDirectory	security_result.about.labels [input_related_files_is_directory]
input.related.files.isDownload	security_result.about.labels [input_related_files_is_download]
input.related.files.isScreenShot	security_result.about.labels [input_related_files_is_screenshot]
input.related.files.mode	security_result.about.file.stat_mode	If the index value is equal to 0, then the input.related.files.mode log field is mapped to the security_result.about.file.stat_mode UDM field. Else, the input.related.files.mode log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.modified	security_result.about.file.last_modification_time	If the index value is equal to 0, then the input.related.files.modified log field is mapped to the security_result.about.file.last_modification_time UDM field. Else, the input.related.files.modified log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.path	security_result.about.file.full_path	If the index value is equal to 0, then the input.related.files.path log field is mapped to the security_result.about.file.full_path UDM field. Else, the input.related.files.path log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.sha1hex	security_result.about.file.sha1	If the index value is equal to 0, then the input.related.files.sha1hex log field is mapped to the security_result.about.file.sha1 UDM field. Else, the input.related.files.sha1hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.sha256hex	security_result.about.file.sha256	If the index value is equal to 0, then the input.related.files.sha256hex log field is mapped to the security_result.about.file.sha256 UDM field. Else, the input.related.files.sha256hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.signingInfo.appid	security_result.about.application	If the index value is equal to 0, then the input.related.files.signingInfo.appid log field is mapped to the security_result.about.application UDM field. Else, the input.related.files.signingInfo.appid log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.signingInfo.authorities	security_result.about.user.attribute.permissions
input.related.files.signingInfo.cdhash	security_result.about.labels [[input_related_files_sign_cdhash]
input.related.files.signingInfo.entitlements	security_result.about.user.attribute.permissions
input.related.files.signingInfo.signerType	security_result.about.user.attribute.labels [input_related_files_signing_info_signer_type]	If the input.related.files.signingInfo.signerType log field value is equal to 0, then the security_result.about.user.attribute.labels.value UDM field is set to 0 - Apple. Else, if the input.related.files.signingInfo.signerType log field value is equal to 1, then the security_result.about.user.attribute.labels.value UDM field is set to 1 - App Store. Else, if the input.related.files.signingInfo.signerType log field value is equal to 2, then the security_result.about.user.attribute.labels.value UDM field is set to 2 - Developer. Else, if the input.related.files.signingInfo.signerType log field value is equal to 3, then the security_result.about.user.attribute.labels.value UDM field is set to 3 - Ad Hoc. Else, if the input.related.files.signingInfo.signerType log field value is equal to 4, then the security_result.about.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.related.files.signingInfo.status	security_result.about.user.attribute.labels [input_related_files_signing_info_status]
input.related.files.signingInfo.statusMessage	security_result.about.user.attribute.labels [input_related_files_signing_info_status_message]
input.related.files.signingInfo.teamid	security_result.about.user.group_identifiers	If the index value is equal to 0, then the input.related.files.signingInfo.teamid log field is mapped to the security_result.about.user.group_identifiers UDM field. Else, the input.related.files.signingInfo.teamid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.files.size	security_result.about.file.size	If the index value is equal to 0, then if the input.related.files.size log field value is not equal to 0, then the input.related.files.size log field is mapped to the security_result.about.file.size UDM field. Else, the input.related.files.size log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.uid	security_result.about.user.userid	If the index value is equal to 0, then the input.related.files.uid log field is mapped to the security_result.about.user.userid UDM field. Else, the input.related.files.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.files.xattrs	security_result.about.labels [input_related_files_xattrs]
input.related.groups.gid	security_result.about.group.attribute.labels [input_related_groups_gid]
input.related.groups.name	security_result.about.group.group_display_name	If the index value is equal to 0, then the input.related.groups.name log field is mapped to the security_result.about.group.group_display_name UDM field. Else, the input.related.groups.name log field is mapped to the security_result.about.group.attribute.labels.value UDM field.
input.related.groups.uuid	security_result.about.group.product_object_id	If the index value is equal to 0, then the input.related.groups.uuid log field is mapped to the security_result.about.group.product_object_id UDM field. Else, the input.related.groups.uuid log field is mapped to the security_result.about.group.attribute.labels.value UDM field.
input.related.processes.appPath	security_result.about.labels [input_related_processes_app_path]
input.related.processes.args	security_result.about.process.command_line_history
input.related.processes.exitCode	security_result.about.labels [input_related_processes_exit_code]
input.related.processes.gid	security_result.about.group.product_object_id	If the index value is equal to 0, then the input.related.processes.gid log field is mapped to the security_result.about.group.product_object_id UDM field. Else, the input.related.processes.gid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.name	security_result.about.process.file.names
input.related.processes.originalParentPID	security_result.about.process.parent_process.pid	If the index value is equal to 0, then the input.related.processes.originalParentPID log field is mapped to the security_result.about.process.parent_process.pid UDM field. Else, the input.related.processes.originalParentPID log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.path	security_result.about.process.file.full_path	If the index value is equal to 0, then the input.related.processes.path log field is mapped to the security_result.about.process.file.full_path UDM field. Else, the input.related.processes.path log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.pgid	security_result.about.labels [input_related_process_pgid]
input.related.processes.pid	security_result.about.process.pid	If the index value is equal to 0, then the input.related.processes.pid log field is mapped to the security_result.about.process.pid UDM field. Else, the input.related.processes.pid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.ppid	security_result.about.labels [input_related_processes_ppid]
input.related.processes.responsiblePID	security_result.about.labels [input_related_processes_responsible_pid]
input.related.processes.rgid	security_result.about.labels [input_related_processes_rgid]
input.related.processes.ruid	security_result.about.labels [input_related_processes_ruid]
input.related.processes.signingInfo.appid	security_result.about.application	If the index value is equal to 0, then the input.related.processes.signingInfo.appid log field is mapped to the security_result.about.application UDM field. Else, the input.related.processes.signingInfo.appid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.signingInfo.authorities	security_result.about.user.attributes.permission
input.related.processes.signingInfo.cdhash	security_result.about.user.attribute.labels [input_related_processes_sign_cdhash]
input.related.processes.signingInfo.entitlements	security_result.about.user.attributes.permission
input.related.processes.signingInfo.signerType	security_result.about.user.attribute.labels [input_related_processes_sign_signer_type]	If the input.related.processes.signingInfo.signerType log field value is equal to 0, then the security_result.about.user.attribute.labels.value UDM field is set to 0 - Apple. Else, if the input.related.processes.signingInfo.signerType log field value is equal to 1, then the security_result.about.user.attribute.labels.value UDM field is set to 1 - App Store. Else, if the input.related.processes.signingInfo.signerType log field value is equal to 2, then the security_result.about.user.attribute.labels.value UDM field is set to 2 - Developer. Else, if the input.related.processes.signingInfo.signerType log field value is equal to 3, then the security_result.about.user.attribute.labels.value UDM field is set to 3 - Ad Hoc. Else, if the input.related.processes .signingInfo.signerType log field value is equal to 4, then the security_result.about.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.related.processes.signingInfo.status	security_result.about.user.attribute.labels [input_related_processes_sign_status]
input.related.processes.signingInfo.statusMessage	security_result.about.user.attribute.labels [input_related_processes_sign_status_message]
input.related.processes.signingInfo.teamid	security_result.about.user.group_identifiers	If the index value is equal to 0, then the input.related.processes.signingInfo.teamid log field is mapped to the security_result.about.user.group_identifiers UDM field. Else, the input.related.processes.signingInfo.teamid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.startTimestamp	security_result.about.labels [input_related_processes_start_time_stamp]
input.related.processes.tty	security_result.about.labels [input_related_processes_tty]
input.related.processes.uid	security_result.about.user.userid	If the index value is equal to 0, then the input.related.processes.uid log field is mapped to the security_result.about.user.userid UDM field. Else, the input.related.processes.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.processes.uuid	security_result.about.process.product_specific_process_id	If the index value is equal to 0, then the Process Uuid: input.related.processes.uuid log field is mapped to the security_result.about.process.product_specific_process_id UDM field. Else, the input.related.processes.uuid log field is mapped to the security_result.about.labels.value UDM field.
input.related.users.name	security_result.about.user.user_display_name	If the index value is equal to 0, then the input.related.users.name log field is mapped to the security_result.about.user.user_display_name UDM field. Else, the input.related.users.name log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.users.uid	security_result.about.user.userid	If the index value is equal to 0, then the input.related.users.uid log field is mapped to the security_result.about.user.userid UDM field. Else, the input.related.users.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.users.uuid	security_result.about.user.product_object_id	If the index value is equal to 0, then the input.related.users.uuid log field is mapped to the security_result.about.user.product_object_id UDM field. Else, the input.related.users.uuid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
key	about.labels[key] (deprecated)
key	additional.fields[key]
path	target.file.full_path	If the index value is equal to 0, then the path log field is mapped to the target.file.full_path UDM field. Else, the path log field is mapped to the target.labels.value UDM field.
queue	principal.labels[queue] (deprecated)
queue	additional.fields[queue]
region	principal.location.name
timestamp	metadata.creation_timestamp
topic	about.labels[topic] (deprecated)
topic	additional.fields[topic]
topicType	about.labels[topicType] (deprecated)
topicType	additional.fields[topicType]
version	metadata.product_version
input.eventType	metadata.event_type
	metadata.product_name	The metadata.product_name UDM field is set to JAMF_PROTECT.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to JAMF.
	principal.resource.resource_type	The principal.resource.resource_type UDM field is set to STORAGE_BUCKET.
	target.resource.resource_type	The target.resource.resource_type UDM field is set to STORAGE_BUCKET.
input.match.event.options	about.labels[input_match_event_options] (deprecated)
input.match.event.options	additional.fields[input_match_event_options]
input.match.event.sourcePID	principal.process.pid
input.match.event.destinationPID	target.process.pid
image.match.event.detection	security_result.detection_fields [image_match_event_detection]
input.match.type	target.asset.attribute.labels [input_match_type]	If the input.match.type log field value is equal to 0, then the target.asset.attribute.labels.value UDM field is set to 0 - Device Inserted. Else, if the input.match.type log field value is equal to 1, then the target.asset.attribute.labels.value UDM field is set to 1 - Device Removed.
input.match.usbAddress	target.asset.attribute.labels [input_match_usb_address]
input.match.event.device.mediaPath	target.asset.attribute.labels [input_match_device_media_path]
input.match.event.device.protocol	target.asset.attribute.labels [input_match_device_protocol]
input.match.event.device.deviceModel	target.asset.hardware.model
input.match.event.device.isRemovable	target.asset.attribute.labels [input_match_device_is_removable]
input.match.event.device.mediaName	target.asset.attribute.labels [input_match_device_media_name]
input.match.event.device.bsdMinor	target.asset.attribute.labels [input_match_device_bsd_minor]
input.match.event.device.vendorName	target.asset.software.vendor_name
input.match.event.device.isWhole	target.asset.attribute.labels [input_match_device_is_whole]
input.match.event.device.unit	target.asset.attribute.labels [input_match_device_unit]
input.match.event.device.deviceSubclass	target.asset.attribute.labels [input_match_device_subclass]
input.match.event.device.serialNumber	target.asset.hardware.serial
input.match.event.device.bsdUnit	target.asset.attribute.labels [input_match_device_bsd_unit]
input.match.event.device.busPath	target.asset.attribute.labels [input_match_device_bus_path]
input.match.event.device.isLeaf	target.asset.attribute.labels [input_match_device_is_leaf]
input.match.event.device.isInternal	target.asset.attribute.labels [input_match_device_is_internal]
input.match.event.device.busName	target.asset.attribute.labels [input_match_device_bus_name]
input.match.event.device.bsdMajor	target.asset.attribute.labels [input_match_device_bsd_major]
input.match.event.device.isEjectable	target.asset.attribute.labels [input_match_device_is_ejectable]
input.match.event.device.isEncrypted	target.asset.attribute.labels [input_match_device_is_encrypted]
input.match.event.device.isEncryptable	target.asset.attribute.labels [input_match_device_is_encryptable]
input.match.event.device.devicePath	target.asset.attribute.labels [input_match_device_path]
input.match.event.device.bsdName	target.asset.attribute.labels [input_match_device_bsd_name]
input.match.event.device.vendorId	target.asset.attribute.labels [input_match_device_vendor_id]
input.match.event.device.content	target.asset.attribute.labels [input_match_device_content]
input.match.event.device.revision	target.asset.attribute.labels [input_match_device_revision]
input.match.event.device.size	target.asset.attribute.labels [input_match_device_size]
input.match.event.device.isNetworkVolume	target.asset.attribute.labels [input_match_device_is_network_volume]
input.match.event.device.blocksize	target.asset.attribute.labels [input_match_device_block_size]
input.match.event.device.productName	target.asset.attribute.labels [input_match_device_product_name]
input.match.event.device.mediaKind	target.asset.attribute.labels [input_match_device_media_kind]
input.match.event.device.isWritable	target.asset.attribute.labels [input_match_device_is_writable]
input.match.event.device.productId	target.asset.product_object_id
input.match.event.device.productId	target.asset.asset_id	The Asset Id: input.match.event.device.productId log field is mapped to the target.asset.asset_id UDM field.
input.match.event.device.deviceClass	target.asset.category
input.match.event.device.encryptionDetail	target.asset.attribute.labels [input_match_device_encryption_detail]
input.match.event.device.volumeKind	target.asset.attribute.labels [input_match_event_device_volume_kind]
input.match.event.device.volumeName	target.asset.attribute.labels [input_match_event_device_volume_name]
input.match.event.device.volumeType	target.asset.attribute.labels [input_match_event_device_volume_type]
input.match.event.device.isMountable	target.asset.attribute.labels [input_match_event_device_is_mountable]
input.match.event.device.encryptionDetail	target.asset.attribute.labels [input_match_event_device_encryption_detail]
input.match.event.fsid	principal.labels [input_match_event_fsid]
input.match.event.bfree	principal.labels[input_match_event_bfree] (deprecated)
input.match.event.bfree	additional.fields[input_match_event_bfree]
input.match.event.bsize	principal.labels[input_match_event_bsize] (deprecated)
input.match.event.bsize	additional.fields[input_match_event_bsize]
input.match.event.ffree	principal.labels[input_match_event_ffree] (deprecated)
input.match.event.ffree	additional.fields[input_match_event_ffree]
input.match.event.files	principal.labels[input_match_event_files] (deprecated)
input.match.event.files	additional.fields[input_match_event_files]
input.match.event.flags	principal.labels[input_match_event_flags] (deprecated)
input.match.event.flags	additional.fields[input_match_event_flags]
input.match.event.owner	principal.user.user_display_name
input.match.event.bavail	principal.labels[input_match_event_bvail] (deprecated)
input.match.event.bavail	additional.fields[input_match_event_bvail]
input.match.event.blocks	principal.labels[input_match_event_blocks] (deprecated)
input.match.event.blocks	additional.fields[input_match_event_blocks]
input.match.event.iosize	principal.labels[input_match_event_iosize] (deprecated)
input.match.event.iosize	additional.fields[input_match_event_iosize]
input.match.event.version	principal.labels[input_match_event_version] (deprecated)
input.match.event.version	additional.fields[input_match_event_version]
input.match.event.deadline	principal.labels[input_match_event_deadline] (deprecated)
input.match.event.deadline	additional.fields[input_match_event_deadline]
input.match.event.flagsExt	principal.labels[input_match_event_flags_ext] (deprecated)
input.match.event.flagsExt	additional.fields[input_match_event_flags_ext]
input.match.event.fsSubType	principal.labels[input_match_event_fs_subtype] (deprecated)
input.match.event.fsSubType	additional.fields[input_match_event_fs_subtype]
input.match.event.mntOnName	principal.labels[input_match_event_mnt_on_name] (deprecated)
input.match.event.mntOnName	additional.fields[input_match_event_mnt_on_name]
input.match.event.fsTypeName	principal.labels[input_match_event_fs_type_name] (deprecated)
input.match.event.fsTypeName	additional.fields[input_match_event_fs_type_name]
input.match.event.isReadOnly	principal.labels[input_match_event_is_read_only] (deprecated)
input.match.event.isReadOnly	additional.fields[input_match_event_is_read_only]
input.match.event.mntFromName	principal.labels[input_match_event_mnt_from_name] (deprecated)
input.match.event.mntFromName	additional.fields[input_match_event_mnt_from_name]
input.match.event.machTimestamp	principal.labels[input_match_event_mach_timestamp] (deprecated)
input.match.event.machTimestamp	additional.fields[input_match_event_mach_timestamp]
input.match.event.sequenceNumber	principal.labels[input_match_event_seq_number] (deprecated)
input.match.event.sequenceNumber	additional.fields[input_match_event_seq_number]
input.match.event.globalSequenceNumber	principal.labels[input_match_event_global_seq_number] (deprecated)
input.match.event.globalSequenceNumber	additional.fields[input_match_event_global_seq_number]

다음 단계

• Google Security Operations에 데이터 수집

도움이 더 필요하신가요? 커뮤니티 회원 및 Google SecOps 전문가로부터 답변을 받으세요.