이 문서에서는 Syslog를 통해 NetApp ONTAP 로그를 수집하는 방법을 설명합니다. 파서는 정규 표현식을 사용하여 syslog 메시지에서 필드를 추출합니다. 그런 다음 추출된 필드를 해당 UDM (통합 데이터 모델) 필드에 매핑하여 원시 로그 데이터를 보안 분석을 위한 구조화된 형식으로 효과적으로 변환합니다.
시작하기 전에
Google Security Operations 인스턴스가 있는지 확인합니다.
Windows 2016 이상 또는 systemd가 설치된 Linux 호스트를 사용하고 있는지 확인합니다.
Syslog를 수집하여 Google SecOps로 전송하도록 BindPlane 에이전트 구성
구성 파일에 액세스합니다.
config.yaml 파일을 찾습니다. 일반적으로 Linux에서는 /etc/bindplane-agent/ 디렉터리에 있고 Windows에서는 설치 디렉터리에 있습니다.
텍스트 편집기 (예: nano, vi, 메모장)를 사용하여 파일을 엽니다.
다음과 같이 config.yaml 파일을 수정합니다.
receivers:udplog:# Replace the below port <54525> and IP <0.0.0.0> with your specific valueslisten_address:"0.0.0.0:54525"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the creds location below according the placement of the credentials file you downloadedcreds:'{jsonfileforcreds}'# Replace <customer_id> below with your actual ID that you copiedcustomer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# You can apply ingestion labels below as preferredingestion_labels:log_type:SYSLOGnamespace:netapp_ontapraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-udplogexporters:-chronicle/chronicle_w_labels
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide explains how to collect NetApp ONTAP logs via Syslog and integrate them with Google Security Operations (SecOps) for security analysis.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves installing and configuring the Bindplane Agent to ingest Syslog data, and setting up a Syslog destination within the ONTAP cluster.\u003c/p\u003e\n"],["\u003cp\u003eCollected logs are parsed, and fields are extracted using regular expressions before being mapped to Unified Data Model (UDM) fields for structured security analysis.\u003c/p\u003e\n"],["\u003cp\u003eSpecific steps include downloading an ingestion authentication file and customer ID from the SecOps console, alongside instructions to install the agent on Windows or Linux.\u003c/p\u003e\n"],["\u003cp\u003eThe guide also provides instructions on setting up event filters within ONTAP to capture various types of logs, including authentication events and security-related fields.\u003c/p\u003e\n"]]],[],null,["# Collect NetApp ONTAP logs\n=========================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the NetApp ONTAP logs through Syslog. The parser extracts fields from syslog messages using regular expressions. It then maps the extracted fields to the corresponding UDM (Unified Data Model) fields, effectively converting raw log data into a structured format for security analysis.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have administrative access to NetApp ONTAP cluster.\n- Ensure that ONTAP can communicate with the Syslog server (Bindplane).\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane Agent will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall Bindplane Agent\n-----------------------\n\n### Windows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux Installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional Installation Resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure BindPlane Agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the configuration file:\n\n - Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n - Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n udplog:\n # Replace the below port \u003c54525\u003e and IP \u003c0.0.0.0\u003e with your specific values\n listen_address: \"0.0.0.0:54525\" \n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the creds location below according the placement of the credentials file you downloaded\n creds: '{ json file for creds }'\n # Replace \u003ccustomer_id\u003e below with your actual ID that you copied\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # You can apply ingestion labels below as preferred\n ingestion_labels:\n log_type: SYSLOG\n namespace: netapp_ontap\n raw_log_field: body\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - udplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/netapp-ontap#get-auth-file) section.\n\nRestart Bindplane Agent to apply the changes\n--------------------------------------------\n\n- In Linux, to restart the Bindplane Agent, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- In Windows, to restart the Bindplane Agent, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure a Syslog Destination in ONTAP\n---------------------------------------\n\n1. Access the ONTAP Cluster using SSH, and replace `\u003contap-cluster-ip\u003e` with the management IP of your ONTAP cluster:\n\n ssh admin@\u003contap-cluster-ip\u003e\n\n2. Check **existing** event **filters and notifications**:\n\n event filter show\n event notification show\n\n3. Create a **Syslog Destination** , replace `\u003csyslog-server-ip\u003e` and `\u003csyslog-server-port\u003e` with your Syslog server details (Bindplane):\n\n event notification destination create -name syslog-ems -syslog \u003csyslog-server-ip\u003e -syslog-port \u003csyslog-server-port\u003e -syslog-transport udp-unencrypted\n\n4. Other options for -syslog-transport:\n\n - udp-unencrypted (default)\n - tcp-unencrypted\n - tcp-encrypted (for TLS).\n5. **Verify** the Syslog **Destination**:\n\n event notification destination show\n\nConfigure Existing Event Filters\n--------------------------------\n\n- Link **default filters** to the Syslog destination:\n\n event notification create -filter-name no-info-debug-events -destinations syslog-ems\n event notification create -filter-name default-trap-events -destinations syslog-ems\n\nOptional: Create and configure custom filters\n---------------------------------------------\n\n1. Authentication Events Filter (Logins/Logouts): Captures logs where description matches \"Logging in\" or \"Logging out\":\n\n event filter create -filter-name auth_events\n event filter rule add -filter-name auth_events -type include -message-name *login* -severity info\n event filter rule add -filter-name auth_events -type include -message-name *logout* -severity info\n\n2. Security Detection Fields Filter: Captures logs related to nmsdk_language, nmsdk_platform, nmsdk_version, and netapp_version:\n\n event filter create -filter-name security_fields\n event filter rule add -filter-name security_fields -type include -message-name *nmsdk_language* -severity info\n event filter rule add -filter-name security_fields -type include -message-name *nmsdk_platform* -severity info\n event filter rule add -filter-name security_fields -type include -message-name *nmsdk_version* -severity info\n event filter rule add -filter-name security_fields -type include -message-name *netapp_version* -severity info\n\n3. Severity-Based Logs Filter: Captures logs where severity is informational:\n\n event filter create -filter-name severity_info\n event filter rule add -filter-name severity_info -type include -message-name * -severity info\n\n4. Network Activity Filter: Captures logs with src_ip and src_port:\n\n event filter create -filter-name network_activity\n event filter rule add -filter-name network_activity -type include -message-name *src_ip* -severity info\n event filter rule add -filter-name network_activity -type include -message-name *src_port* -severity info\n\n5. URL Target Logs Filter: Captures logs with URL information:\n\n event filter create -filter-name url_target\n event filter rule add -filter-name url_target -type include -message-name *url* -severity info\n\n6. Apply Each Filter to the Syslog Destination:\n\n event notification create -filter-name auth_events -destinations syslog-ems\n event notification create -filter-name security_fields -destinations syslog-ems\n event notification create -filter-name severity_info -destinations syslog-ems\n event notification create -filter-name network_activity -destinations syslog-ems\n event notification create -filter-name url_target -destinations syslog-ems\n\n7. Verify Notifications:\n\n event notification show\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
