이 파서는 log_number 필드를 기반으로 Kemp Load Balancer syslog 메시지에서 필드를 추출하여 UDM에 매핑합니다. grok 패턴과 조건부 로직을 사용하여 다양한 로그 형식을 처리하고, 데이터 유형을 변환하고, 이벤트 유형, 애플리케이션 프로토콜, 보안 결과와 같은 메타데이터로 이벤트를 보강합니다.
UDM 매핑 테이블
로그 필드
UDM 매핑
논리
collection_time.seconds
metadata.event_timestamp.seconds
timestamp이 없으면 로그 수집 시간이 이벤트 타임스탬프로 사용됩니다. 나노초가 잘립니다.
로그 타임스탬프입니다. Chronicle 형식으로 변환되어 이벤트 타임스탬프로 사용됩니다. 나노초가 잘립니다.
msg/message
data 보기
기본 로그 메시지가 포함됩니다. UDM 매핑 세부정보는 data를 참고하세요.
pid
target.process.pid
처리 ID입니다.
리소스
target.url
액세스된 리소스입니다.
srcip
principal.ip
소스 IP 주소입니다.
src_ip
principal.ip
소스 IP 주소입니다.
srcport
principal.port
소스 포트.
src_port
principal.port
소스 포트.
sshd
target.application
SSH 데몬 이름입니다.
요약
security_result.summary
보안 결과 요약입니다.
timestamp.seconds
events.timestamp.seconds
로그 항목 타임스탬프입니다. 있는 경우 이벤트 타임스탬프로 사용됩니다.
사용자
target.user.userid
사용자 이름입니다.
vs
target.ip | target.port
가상 서버 IP 및 포트입니다. IP가 target.ip에 매핑됩니다. dstport이 없는 경우 포트가 target.port에 매핑됩니다.
vs_port
target.port
가상 서버 포트입니다. log_number, dest_port, login_status, log_event에 기반한 논리에 따라 결정됩니다. 가능한 값은 GENERIC_EVENT, NETWORK_HTTP, NETWORK_CONNECTION, USER_LOGIN, USER_UNCATEGORIZED입니다. 'KEMP_LOADBALANCER'로 하드코딩됩니다. 'KEMP_LOADBALANCER'로 하드코딩됩니다. 'KEMP'로 하드코딩됩니다. dest_port에 의해 결정됩니다. 가능한 값은 HTTP (포트 80) 및 HTTPS (포트 443)입니다. login_status 및 audit_msg에 의해 결정됩니다. 가능한 값은 ALLOW 및 BLOCK입니다. audit_msg에 의해 결정됩니다. 가능한 값은 ERROR입니다. USER_LOGIN 이벤트의 경우 'AUTHTYPE_UNSPECIFIED'로 설정됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis document explains how to collect Kemp Load Balancer logs using a Google Security Operations forwarder, which supports parsing logs with the \u003ccode\u003eKEMP_LOADBALANCER\u003c/code\u003e ingestion label.\u003c/p\u003e\n"],["\u003cp\u003eTo configure Kemp Load Balancer, you must specify the IP address of the Google Security Operations forwarder in the Syslog options, and then add a new forwarder and collector in SIEM Settings with specific details including protocol, address, and port.\u003c/p\u003e\n"],["\u003cp\u003eThe parser extracts various fields from Kemp Load Balancer syslog messages, based on the log number, mapping them to the UDM, and includes fields such as \u003ccode\u003eprincipal.ip\u003c/code\u003e, \u003ccode\u003etarget.ip\u003c/code\u003e, \u003ccode\u003enetwork.http.method\u003c/code\u003e, and \u003ccode\u003esecurity_result.summary\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe document provides a detailed UDM mapping table showing how Kemp Load Balancer log fields are mapped to UDM fields, along with the logic used for data conversion and enrichment.\u003c/p\u003e\n"],["\u003cp\u003eRecent updates include improvements to the parsers that now includes events like "connected", "slave accept", and "block access to host", alongside mapping of additional fields like source and destination IPs and ports.\u003c/p\u003e\n"]]],[],null,["# Collect Kemp Load Balancer logs\n===============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect Kemp Load Balancer logs by using a\nGoogle Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser which normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the\n`KEMP_LOADBALANCER` ingestion label.\n\nConfigure Kemp Load Balancer\n----------------------------\n\n1. Sign in to the **Kemp Load Balancer** console.\n2. Select **Logging options** \\\u003e **Syslog options**.\n3. In the **Syslog options** section, in any of the available fields specify the\n IP address of the Google Security Operations forwarder.\n\n It is recommended to specify the IP address in the **Info host** field.\n4. Click **Change syslog parameters**.\n\nConfigure Google Security Operations forwarder to ingest Kemp Load Balancer logs\n--------------------------------------------------------------------------------\n\n1. Select **SIEM Settings** \\\u003e **Forwarders**.\n2. Click **Add new forwarder**.\n3. In the **Forwarder name** field, enter a unique name for the forwarder.\n4. Click **Submit** and then click **Confirm** . The forwarder is added and the **Add collector configuration** window appears.\n5. In the **Collector name** field, type a unique name for the collector.\n6. Select **Kemp Load Balancer** as the **Log type**.\n7. Select **Syslog** as the **Collector type**.\n8. Configure the following mandatory input parameters:\n - **Protocol**: specify the connection protocol that the collector uses to listen to syslog data.\n - **Address**: specify the target IP address or hostname where the collector resides and listens to syslog data.\n - **Port**: specify the target port where the collector resides and listens to syslog data.\n9. Click **Submit**.\n\nFor more information about the Google Security Operations forwarders, see [Manage forwarder configurations through the Google Security Operations UI](/chronicle/docs/install/forwarder-management-configurations).\n\nIf you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/getting-support).\n\nField mapping reference\n-----------------------\n\nThis parser extracts fields from Kemp Load Balancer syslog messages based on the `log_number` field, mapping them to the UDM. It handles various log formats using `grok` patterns and conditional logic, converting data types and enriching events with metadata like event type, application protocol, and security results.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
