보안 조사를 지원하기 위해 Google Security Operations는 다양한 소스의 문맥 데이터를 수집하고 수집된 데이터를 분석하며 고객 환경의 아티팩트에 대한 추가 컨텍스트를 제공합니다. 이 문서에서는 분석가가 대시보드와 BigQuery의 Google SecOps 스키마에서 컨텍스트 보강 데이터를 사용하는 방법의 예시를 제공합니다.
UDM 이벤트에는 조사 중에 추가 컨텍스트를 제공하기 위해 위치정보가 보강된 데이터가 포함될 수 있습니다. UDM 이벤트를 BigQuery로 내보내면 이러한 필드도 내보냅니다. 이 섹션에서는 보고서를 만들 때 위치정보가 강화된 필드를 사용하는 방법을 설명합니다.
events 스키마에서 데이터 쿼리
BigQuery에서 Google SecOps events 스키마를 사용하여 위치정보 데이터를 쿼리할 수 있습니다.
다음 예시는 사용자, 국가, 처음 관측된 시간 및 마지막 관측 시간을 기준으로 모든 USER_LOGIN 이벤트에 대한 집계 결과를 반환하는 SQL 쿼리입니다.
SELECT
ip_geo_artifact.location.country_or_region,
COUNT(ip_geo_artifact.location.country_or_region) AS count_country,
ip_geo_artifact.location.state,
COUNT(ip_geo_artifact.location.state) AS count_state,
target.user.email_addresses[ORDINAL(1)] AS principal_user,
TIMESTAMP_SECONDS(MIN(metadata.event_timestamp.seconds)) AS first_observed,
TIMESTAMP_SECONDS(MAX(metadata.event_timestamp.seconds)) AS last_observed,
FROM `datalake.events`,
UNNEST (principal.ip_geo_artifact) as ip_geo_artifact
WHERE DATE(hour_time_bucket) = "2023-01-11"
AND metadata.event_type = 15001
AND metadata.vendor_name IN ("Google Cloud Platform","Google Workspace")
GROUP BY 1,3,5
HAVING count_country > 0
ORDER BY count_country DESC
다음 표에는 반환될 수 있는 결과 예시가 포함됩니다.
country_or_region
count_country
state
count_state
principal_user
first_observed
last_observed
Netherlands
5
North Holland
5
admin@acme.com
2023-01-11 14:32:51 UTC
2023-01-11 14:32:51 UTC
Israel
1
Tel Aviv District
1
omri@acme.com
2023-01-11 10:09:32 UTC
2023-01-11 15:26:38 UTC
다음 SQL 쿼리에서는 두 위치 사이의 거리를 감지하는 방법을 보여줍니다.
SELECT
DISTINCT principal_user,
(ST_DISTANCE(north_pole,user_location)/1000) AS distance_to_north_pole_km
FROM (
SELECT
ST_GeogPoint(135.00,90.00) AS north_pole,
ST_GeogPoint(ip_geo_artifact.location.region_coordinates.longitude, ip_geo_artifact.location.region_coordinates.latitude) AS user_location,
target.user.email_addresses[ORDINAL(1)] AS principal_user
FROM `datalake.events`,
UNNEST (principal.ip_geo_artifact) as ip_geo_artifact
WHERE DATE(hour_time_bucket) = "2023-01-11"
AND metadata.event_type = 15001
AND metadata.vendor_name IN ("Google Cloud Platform","Google Workspace")
AND ip_geo_artifact.location.country_or_region != ""
)
ORDER BY 2 DESC
다음 표에는 반환될 수 있는 결과 예시가 포함됩니다.
principal_user
distance_to_north_pole_km
omri@acme.com
6438.98507
admin@acme.com
4167.527018
영역 다각형을 활용해서 지정된 간격으로 특정 위치에서 이동할 합리적 영역을 계산하는 방식으로 약간 더 유용한 쿼리를 얻을 수 있습니다.
또한 불가능한 이동 감지를 식별하기 위해 여러 지역 값이 일치하는지 여부를 확인할 수 있습니다. 이러한 솔루션은 정확하고 일관적인 위치정보 데이터 소스가 필요합니다.
대시보드에서 보강된 필드 보기
또한 위치정보가 보강된 UDM 필드를 사용해서 대시보드를 빌드할 수 있습니다. 차트에는 각 UDM 이벤트의 도시가 표시됩니다. 차트 유형을 변경하여 데이터를 다른 형식으로 볼 수 있습니다.
다음 단계
다른 Google SecOps 기능과 함께 보강된 데이터를 사용하는 방법은 다음을 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eGoogle Security Operations enhances security investigations by ingesting and analyzing contextual data from various sources.\u003c/p\u003e\n"],["\u003cp\u003eGeolocation-enriched data within UDM events is available for creating reports and provides additional context.\u003c/p\u003e\n"],["\u003cp\u003eAnalysts can use the Google Security Operations \u003ccode\u003eevents\u003c/code\u003e schema in BigQuery to query geolocation data for security events.\u003c/p\u003e\n"],["\u003cp\u003eBigQuery queries can be used to detect the distance between two locations or to identify impossible travel by comparing multiple geography values.\u003c/p\u003e\n"],["\u003cp\u003eDashboards can display geolocation-enriched UDM fields, offering a visual representation of the data, like the city of each UDM event.\u003c/p\u003e\n"]]],[],null,["# Use context-enriched data in reports\n====================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nTo support security investigations, Google Security Operations ingests contextual\ndata from different sources, performs analysis on the ingested data, and\nprovides additional context about artifacts in a customer environment. This\ndocument provides examples of how analysts can use contextual enriched data\nin dashboards and in Google SecOps schemas in BigQuery.\n\nFor more information about data enrichment, see [How Google SecOps enriches event and entity data](/chronicle/docs/event-processing/data-enrichment).\n\nUse geolocation-enriched data\n-----------------------------\n\nUDM events may include geolocation-enriched data to provide additional context\nduring an investigation. When UDM events are exported to BigQuery,\nthese fields are also exported. This section explains how to use geolocation-enriched fields when creating reports.\n\n### Query data in the `events` schema\n\nGeolocation data can be queried using the Google SecOps `events` schema in BigQuery.\nThe following example is a SQL query that returns aggregate results for all\n`USER_LOGIN` events by user, country, and with the first and last observed times. \n\n SELECT\n ip_geo_artifact.location.country_or_region,\n COUNT(ip_geo_artifact.location.country_or_region) AS count_country,\n ip_geo_artifact.location.state,\n COUNT(ip_geo_artifact.location.state) AS count_state,\n target.user.email_addresses[ORDINAL(1)] AS principal_user,\n TIMESTAMP_SECONDS(MIN(metadata.event_timestamp.seconds)) AS first_observed,\n TIMESTAMP_SECONDS(MAX(metadata.event_timestamp.seconds)) AS last_observed,\n FROM `datalake.events`,\n UNNEST (principal.ip_geo_artifact) as ip_geo_artifact\n WHERE DATE(hour_time_bucket) = \"2023-01-11\"\n AND metadata.event_type = 15001\n AND metadata.vendor_name IN (\"Google Cloud Platform\",\"Google Workspace\")\n GROUP BY 1,3,5\n HAVING count_country \u003e 0\n ORDER BY count_country DESC\n\nThe following table contains an example of the results that might be returned. \n\nThe following SQL query illustrates how to detect the distance between two locations. \n\n SELECT\n DISTINCT principal_user,\n (ST_DISTANCE(north_pole,user_location)/1000) AS distance_to_north_pole_km\n FROM (\n SELECT\n ST_GeogPoint(135.00,90.00) AS north_pole,\n ST_GeogPoint(ip_geo_artifact.location.region_coordinates.longitude, ip_geo_artifact.location.region_coordinates.latitude) AS user_location,\n target.user.email_addresses[ORDINAL(1)] AS principal_user\n FROM `datalake.events`,\n UNNEST (principal.ip_geo_artifact) as ip_geo_artifact\n WHERE DATE(hour_time_bucket) = \"2023-01-11\"\n AND metadata.event_type = 15001\n AND metadata.vendor_name IN (\"Google Cloud Platform\",\"Google Workspace\")\n AND ip_geo_artifact.location.country_or_region != \"\"\n )\n ORDER BY 2 DESC\n\nThe following table contains an example of the results that might be returned. \n\nYou can achieve slightly more useful queries by leveraging area polygons to\ncalculate a reasonable area for travel from a location in a given interval.\nYou can also check whether multiple geography values match to identify impossible\ntravel detections. These solutions require having an accurate and consistent geolocation data source.\n\n### View enriched fields in dashboards\n\nYou can also build a dashboard using geolocation-enriched UDM fields. The chart\ndisplays the city of each UDM event. You can change the chart type to see the\ndata in a different format.\n\nWhat's next\n-----------\n\nFor information about how to use enriched data with other Google SecOps\nfeatures, see the following:\n\n- [Use context-enriched data in rules](/chronicle/docs/detection/use-enriched-data-in-rules).\n- [Use context-enriched data in UDM Search](/chronicle/docs/investigation/use-enriched-data-in-search).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
