이 파서는 로그 형식의 변형을 처리하여 RSA Authentication Manager CSV 로그에서 필드를 추출합니다. grok을 사용하여 로그 행을 초기 파싱한 다음 CSV 필터링을 활용하여 개별 필드를 추출하고 UDM 호환성을 위해 username, clientip, operation_status와 같은 표준화된 이름에 매핑합니다.
UDM 매핑 테이블
로그 필드
UDM 매핑
논리
clientip
principal.asset.ip
원시 로그의 column8 값입니다.
clientip
principal.ip
원시 로그의 column8 값입니다.
column1
metadata.event_timestamp.seconds
'yyyy-MM-dd HH:mm:ss' 및 'yyyy-MM-dd HH: mm:ss' 형식을 사용하여 원시 로그의 time 필드 (column1)에서 파싱됩니다.
column12
security_result.action
operation_status 필드 (column12)를 기반으로 매핑됩니다. 'SUCCESS' 및 'ACCEPT' 값은 ALLOW에 매핑되고, 'FAIL', 'REJECT', 'DROP', 'DENY', 'NOT_ALLOWED' 값은 BLOCK에 매핑되며, 기타 값은 UNKNOWN_ACTION에 매핑됩니다.
column18
principal.user.userid
원시 로그의 column18 값입니다.
column19
principal.user.first_name
원시 로그의 column19 값입니다.
column20
principal.user.last_name
원시 로그의 column20 값입니다.
column25
principal.hostname
원시 로그의 column25 값입니다.
column26
principal.asset.hostname
원시 로그의 column26 값입니다.
column27
metadata.product_name
원시 로그의 column27 값입니다.
column3
target.administrative_domain
원시 로그의 column3 값입니다.
column32
principal.user.group_identifiers
원시 로그의 column32 값입니다.
column5
security_result.severity
severity 필드 (column5)를 기반으로 매핑됩니다. 'INFO', 'INFORMATIONAL' 값은 INFORMATIONAL에 매핑되고, 'WARN', 'WARNING'은 WARNING에 매핑되고, 'ERROR', 'CRITICAL', 'FATAL', 'SEVERE', 'EMERGENCY', 'ALERT'는 ERROR에 매핑되고, 'NOTICE', 'DEBUG', 'TRACE'는 DEBUG에 매핑되고, 기타 값은 UNKNOWN_SEVERITY에 매핑됩니다.
column8
target.asset.ip
원시 로그의 column8 값입니다.
column8
target.ip
원시 로그의 column8 값입니다.
event_name
security_result.rule_name
원시 로그의 column10 값입니다.
host_name
intermediary.hostname
그로크 패턴을 사용하여 원시 로그의 <DATA> 부분에서 추출됩니다.
process_data
principal.process.command_line
그로크 패턴을 사용하여 원시 로그의 <DATA> 부분에서 추출됩니다.
summary
security_result.summary
원시 로그의 column13 값입니다.
time_stamp
metadata.event_timestamp.seconds
그로크 패턴을 사용하여 원시 로그의 <DATA> 부분에서 추출됩니다. 찾을 수 없는 경우 타임스탬프는 원시 로그의 timestamp 필드에서 추출됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis document details the process of collecting RSA Authentication Manager logs using a Google Security Operations forwarder, supporting ingestion through the \u003ccode\u003eRSA_AUTH_MANAGER\u003c/code\u003e parser label.\u003c/p\u003e\n"],["\u003cp\u003eConfiguration steps for RSA Authentication Manager include adjusting log levels, setting data destinations to a remote syslog, and masking sensitive token serial numbers.\u003c/p\u003e\n"],["\u003cp\u003eSetting up a Google Security Operations forwarder involves creating a new forwarder, adding a collector configured for RSA logs via syslog, and specifying necessary connection parameters like protocol, address, and port.\u003c/p\u003e\n"],["\u003cp\u003eThe parser extracts fields from RSA Authentication Manager logs using grok patterns and CSV filtering, mapping them to UDM format fields like \u003ccode\u003eusername\u003c/code\u003e, \u003ccode\u003eclientip\u003c/code\u003e, and \u003ccode\u003eoperation_status\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe UDM mapping table outlines how specific log fields from RSA Authentication Manager are transformed into UDM fields within Google Security Operations, including data like timestamps, severity, and user details.\u003c/p\u003e\n"]]],[],null,["# Collect RSA Authentication Manager logs\n=======================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect RSA Authentication Manager logs by using a Google Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser which normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the `RSA_AUTH_MANAGER`\ningestion label.\n\nConfigure RSA Authentication Manager\n------------------------------------\n\n1. Sign in to the **RSA Authentication Manager Security** console using administrator credentials.\n2. In the **Setup** menu, click **System settings**.\n3. In the **System settings** window, in the **Basic settings** section, select **Logging**.\n4. In the **Select instance** section, select the **Primary** instance type configured in your environment, and then click **Next** to continue.\n5. In the **Configure settings** section, configure the logs for the following sections that are displayed:\n - **Log levels**\n - **Log data destination**\n - **Log data masking**\n6. In the **Log levels** section, configure the following logs:\n - Set **Trace log** to **Fatal**.\n - Set **Administrative audit log** to **Success**.\n - Set **Runtime audit log** to **Success**.\n - Set **System log** to **Warning**.\n7. In the **Log data destination** section, for the following log level data, select\n **Save to internal database and remote syslog for the following hostname or IP address**,\n and then enter the IP address of Google Security Operations:\n\n - **Administrative audit log data**\n - **Runtime audit log data**\n - **System log data**\n\n Syslog messages are transmitted over higher port number for UDP.\n8. In the **Log data masking** section, in the **Mask token serial number: number of digits of the token serial number to display** field, enter the maximum value, which is equal to the number of digits that\n appear in available tokens, such as 12.\n\n For more information, see [Log data masking](https://community.rsa.com/s/article/Mask-Token-Serial-Numbers-in-Logs-4b7e844c).\n9. Click **Save**.\n\nConfigure Google Security Operations forwarder and syslog to ingest RSA Authentication Manager logs\n---------------------------------------------------------------------------------------------------\n\n1. Select **SIEM Settings** \\\u003e **Forwarders**.\n2. Click **Add new forwarder**.\n3. In the **Forwarder name** field, enter a unique name for the forwarder.\n4. Click **Submit** and then click **Confirm** . The forwarder is added and the **Add collector configuration** window appears.\n5. In the **Collector name** field, type a unique name for the collector.\n6. Select **RSA** as the **Log type**.\n7. Select **Syslog** as the **Collector type**.\n8. Configure the following mandatory input parameters:\n - **Protocol**: specify the connection protocol the collector will use to listen for syslog data.\n - **Address**: specify the target IP address or hostname where the collector resides and listens for syslog data.\n - **Port**: specify the target port where the collector resides and listens for syslog data.\n9. Click **Submit**.\n\nFor more information about Google Security Operations forwarders, see [Google Security Operations forwarders documentation](/chronicle/docs/install/forwarder-management-configurations). For information about requirements for each forwarder type, see [Forwarder configuration by type](/chronicle/docs/install/forwarder-management-api). If you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/support).\n\nField mapping reference\n-----------------------\n\nThis parser extracts fields from RSA Authentication Manager CSV logs, handling variations in the log format. It uses grok to initially parse the log lines, then leverages CSV filtering to extract individual fields, mapping them to standardized names like `username`, `clientip`, and `operation_status` for UDM compatibility.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
