我們重新調整了說明文件的導覽結構，直接對應您的作業工作流程。詳情請參閱版本資訊和逐步解說影片。

Google 會運用 AI 技術將內容翻譯成你偏好的語言，但可能會出錯。

收集 Check Point 防火牆記錄

剖析器版本：34.0

支援的國家/地區：

Google SecOps SIEM

本文說明如何使用 Bindplane 代理程式，將 Check Point 防火牆記錄檔擷取至 Google Security Operations。

Check Point 防火牆會產生網路連線、安全性事件、VPN 活動、威脅防範和管理作業的記錄。剖析器會擷取鍵/值和 CEF 欄位，並將其對應至統合式資料模型 (UDM)。

事前準備

請確認您已完成下列事前準備事項：

Google SecOps 執行個體
Windows Server 2016 以上版本，或搭載 systemd 的 Linux 主機
Bindplane 代理程式與 Check Point 防火牆之間的網路連線
如果透過 Proxy 執行，請確保防火牆通訊埠已根據 Bindplane 代理程式需求開啟
Check Point 防火牆使用者介面的特殊存取權

取得 Google SecOps 擷取驗證檔案

登入 Google SecOps 控制台。
依序前往「SIEM 設定」>「收集代理程式」。
下載擷取驗證檔案
將檔案安全地儲存在要安裝 Bindplane 代理程式的系統上。

注意： 這個 JSON 檔案包含驗證 Bindplane 代理程式與 Google SecOps 的憑證。

取得 Google SecOps 客戶 ID

登入 Google SecOps 控制台。
依序前往「SIEM 設定」>「設定檔」。
複製並儲存「機構詳細資料」部分中的客戶 ID。

注意： 設定 Bindplane 代理程式匯出工具時，必須提供客戶 ID。

安裝 Bindplane 代理程式

請按照下列操作說明，在 Windows 或 Linux 作業系統上安裝 Bindplane 代理程式。

Windows 安裝

以管理員身分開啟「命令提示字元」或「PowerShell」。

執行下列指令：

msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

等待安裝完成。
執行下列指令，確認安裝成功：
```
sc query observiq-otel-collector
```
服務應顯示為「RUNNING」。

Linux 安裝

開啟具有根層級或 sudo 權限的終端機。

執行下列指令：

sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

等待安裝完成。
執行下列指令，確認安裝成功：
```
sudo systemctl status observiq-otel-collector
```
服務應顯示為有效 (執行中)。

其他安裝資源

如需其他安裝選項和疑難排解資訊，請參閱 Bindplane 代理程式安裝指南。

設定 Bindplane 代理程式，擷取系統記錄檔並傳送至 Google SecOps

找出設定檔

Linux：

sudo nano /etc/bindplane-agent/config.yaml

Windows：

notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

編輯設定檔

將 config.yaml 的所有內容替換為下列設定：

receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/checkpoint_firewall:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: CHECKPOINT_FIREWALL
        raw_log_field: body

service:
    pipelines:
        logs/checkpoint_firewall_to_chronicle:
            receivers:
                - udplog
            exporters:
                - chronicle/checkpoint_firewall

設定參數

替換下列預留位置：

接收器設定：
- listen_address：要接聽的 IP 位址和通訊埠：
  - 0.0.0.0，監聽所有介面 (建議)
  - 通訊埠 514 是標準的系統記錄通訊埠 (在 Linux 上需要根層級權限；非根層級權限請使用 1514)
匯出工具設定：
- creds_file_path：擷取驗證檔案的完整路徑：
  - Linux：/etc/bindplane-agent/ingestion-auth.json
  - Windows：C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
- customer_id：從 Google SecOps 控制台複製的客戶 ID
- endpoint：區域端點網址：
  - 美國：malachiteingestion-pa.googleapis.com
  - 歐洲：europe-malachiteingestion-pa.googleapis.com
  - 亞洲：asia-southeast1-malachiteingestion-pa.googleapis.com
  - 如需完整清單，請參閱「區域端點」

儲存設定檔

編輯完成後，請儲存檔案：
- Linux：依序按下 Ctrl+O、Enter 和 Ctrl+X
- Windows：依序點選「檔案」>「儲存」

重新啟動 Bindplane 代理程式，以套用變更

如要在 Linux 中重新啟動 Bindplane 代理程式，請執行下列指令：

sudo systemctl restart observiq-otel-collector

確認服務正在執行：

```bash
sudo systemctl status observiq-otel-collector
```

檢查記錄中是否有錯誤：

```bash
sudo journalctl -u observiq-otel-collector -f
```

如要在 Windows 中重新啟動 Bindplane 代理程式，請選擇下列其中一個選項：
- 以管理員身分開啟命令提示字元或 PowerShell：
```
net stop observiq-otel-collector && net start observiq-otel-collector
```
- 服務控制台：
  1. 按下 Win+R，輸入 services.msc，然後按下 Enter 鍵。
  2. 找出 observIQ OpenTelemetry Collector。
  3. 按一下滑鼠右鍵，然後選取「重新啟動」。
  4. 確認服務正在執行：
```
sc query observiq-otel-collector
```
  5. 檢查記錄中是否有錯誤：
```
type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
```

在 Check Point 防火牆中設定系統記錄匯出功能

使用具備權限的帳戶登入 Check Point 防火牆使用者介面。
依序前往「記錄和監控」>「記錄伺服器」。
前往「Syslog Servers」。
按一下「設定」，並設定下列值：
- 「通訊協定」：選取「UDP」，即可傳送安全性記錄和/或系統記錄。
- 名稱：輸入不重複的名稱 (例如 Bindplane_Server)。
- IP 位址：提供系統記錄伺服器 IP 位址 (Bindplane IP)。
- 「Port」(通訊埠)：提供系統記錄檔伺服器通訊埠 (Bindplane 通訊埠)。
選取「啟用記錄伺服器」。
選取要轉送的記錄：系統記錄和安全性記錄。
按一下「套用」。

UDM 對應表

記錄欄位	UDM 對應
`@timestamp`	`metadata.event_timestamp`
`__id`	`additional.fields`
`__nsons`	`additional.fields`
`__p_dport`	`additional.fields`
`__pos`	`additional.fields`
`_action`	`security_result.action_id`
`access_method`	`metadata.product_event_type`
`acks_total`	`additional.fields`
`act`	`security_result.action_details`
`Action`	`additional.fields`
`action_details`	`additional.fields`
`action_reason`	`security_result.detection_fields`
`Activity`	`security_result.summary`
`additional_info`	`security_result.description`、 `security_result.detection_fields`
`administrator`	`target.user.userid`
`aggregated_log_count`	`security_result.detection_fields`
`alert`	`security_result.detection_fields`
`answer_rdata`	`additional.fields`
`app`	`principal.application`
`app_activity`	`security_result.description`
`app_category`	`security_result.category_details`
`app_desc`	`additional.fields`
`app_id`	`additional.fields`
`app_properties`	`additional.fields`、 `security_result.detection_fields`
`app_risk`	`security_result.detection_fields`
`app_session_id`	`network.session_id`
`app_sig_id`	`additional.fields`
`appcategory`	`additional.fields`
`appi_name`	`security_result.detection_fields`
`application`	`principal.application`
`application_version`	`additional.fields`
`arrival_time`	`additional.fields`
`attachment_link`	`additional.fields`
`attachments_num`	`additional.fields`
`attack`	`security_result.threat_name`
`attack_info`	`security_result.description`
`attack_status`	`additional.fields`
`attack_traffic_bps`	`additional.fields`
`attackStatus`	`security_result.detection_fields`
`audit_status`	`additional.fields`
`auth_method`	`additional.fields`
`auth_status`	`security_result.summary`
`authentication_trial`	`additional.fields`
`authority_rdata`	`principal.resource.attribute.labels`
`authorization`	`security_result.detection_fields`
`bandwidth`	`security_result.detection_fields`
`best_practice_id`	`security_result.detection_fields`
`blade_name`	`security_result.detection_fields`
`browse_time`	`additional.fields`
`browser`	`network.http.user_agent`
`bytes`	`additional.fields`
`c_bytes`	`additional.fields`
`calc_desc`	`security_result.description`
`calc_service`	`additional.fields`
`cat`	`security_result.detection_fields`
`category`	`security_result.category_details`
`cb_bp_blade`	`additional.fields`
`cb_rate`	`additional.fields`
`cb_recommendation`	`additional.fields`
`cb_relevantobjectname`	`additional.fields`
`cb_relevantobjectstatus`	`additional.fields`
`cb_scan_id`	`security_result.detection_fields`
`cb_status`	`additional.fields`
`certificate_validity`	`additional.fields`
`client_inbound_bytes`	`principal.network.received_bytes`
`client_inbound_interface`	`additional.fields`
`client_inbound_packets`	`principal.network.received_packets`
`client_ip`	`principal.ip`、 `principal.asset.ip`
`client_name`	`security_result.detection_fields`
`client_outbound_bytes`	`principal.network.sent_bytes`
`client_outbound_interface`	`additional.fields`
`client_outbound_packets`	`principal.network.sent_packets`
`client_to_gateway_ciphers`	`additional.fields`
`client_type_os`	`principal.platform`
`client_version.0`	`intermediary.platform_version`
`cloud_hourly_quota`	`additional.fields`
`cloud_hourly_quota_exceeded`	`additional.fields`
`cloud_hourly_quota_usage_for_quota_id`	`additional.fields`
`cloud_hourly_quota_usage_for_this_gw`	`additional.fields`
`cloud_hourly_remaining_quota`	`additional.fields`
`cloud_last_quota_update_gmt_time`	`additional.fields`
`cloud_monthly_quota`	`additional.fields`
`cloud_monthly_quota_exceeded`	`additional.fields`
`cloud_monthly_quota_period_end`	`additional.fields`
`cloud_monthly_quota_period_start`	`additional.fields`
`cloud_monthly_quota_usage_for_quota_id`	`additional.fields`
`cloud_monthly_quota_usage_for_this_gw`	`additional.fields`
`cloud_quota_description`	`additional.fields`
`cloud_quota_identifier`	`additional.fields`
`cloud_quota_status`	`additional.fields`
`cloud_remaining_quota`	`additional.fields`
`cluster_info`	`additional.fields`
`cn2`	`additional.fields`
`cn3`	`additional.fields`
`comment`	`security_result.description`
`community`	`additional.fields`
`condition`	`additional.fields`
`confidence_level`	`security_result.confidence`
`conn_direction`	`network.direction`、 `additional.fields`
`connection_count`	`security_result.detection_fields`
`connection_luuid`	`additional.fields`
`connection_uid`	`additional.fields`
`consent_flag_status`	`additional.fields`
`consent_flag_value`	`additional.fields`
`content_disposition`	`target.file.names`
`content_length`	`target.file.size`
`content_risk`	`additional.fields`
`content_type`	`target.file.mime_type`
`context_num`	`additional.fields`
`contextnum`	`additional.fields`
`contract_name`	`security_result.detection_fields`
`control_log_type`	`additional.fields`
`controller`	`additional.fields`
`cookiei`	`additional.fields`
`cookier`	`additional.fields`
`cp_component_name`	`additional.fields`
`cp_component_version`	`additional.fields`
`creation_time`	`principal.asset.attribute.creation_time`
`cs2_second`	`intermediary.ip`、 `intermediary.asset.ip`
`cu_detected_by`	`additional.fields`
`cu_detection_time`	`additional.fields`
`cu_log_count`	`additional.fields`
`cu_rule_category`	`security_result.rule_name`
`cu_rule_id`	`security_result.rule_id`
`current_value`	`additional.fields`
`d_name`	`security_result.detection_fields`
`data_type_name`	`security_result.detection_fields`
`date_value`	`additional.fields`
`datetime`	`metadata.event_timestamp`
`db_tag`	`security_result.detection_fields`
`db_ver`	`additional.fields`
`DCE_RPC_Interface_UID`	`additional.fields`
`dce-rpc_interface_uuid`	`additional.fields`
`dce-rpc_interface_uuid-1`	`additional.fields`
`dce-rpc_interface_uuid-2`	`additional.fields`
`dce-rpc_interface_uuid-3`	`additional.fields`
`dedup_time`	`additional.fields`
`default_device_message`	`additional.fields`
`delivery_time`	`additional.fields`
`desc`	`security_result.summary`
`description`	`security_result.detection_fields`
`description_url`	`additional.fields`
`Destination`	`additional.fields`
`destination_dns_hostname`	`target.hostname`、 `target.asset.hostname`
`destinationAddress`	`target.ip`、 `target.asset.ip`
`destinationDnsDomain`	`target.url`
`destinationPort`	`target.port`
`destinationTranslatedAddress`	`target.ip`、 `target.asset.ip`、 `target.nat_ip`
`destinationTranslatedPort`	`target.port`、 `target.nat_port`
`detected_by`	`security_result.detection_fields`
`device`	`intermediary.ip`、 `intermediary.asset.ip`
`device_identification`	`additional.fields`
`device_message`	`security_result.description`
`device_name`	`target.hostname`、 `target.asset.hostname`
`device_type`	`target.resource.resource_subtype`
`deviceCustomNumber2`	`additional.fields`
`deviceCustomString2`	`security_result.rule_name`
`deviceDirection`	`network.direction`
`devTime`	`metadata.event_timestamp`
`direction`	`additional.fields`
`discard_traffic_bps`	`additional.fields`
`discard_traffic_pps`	`additional.fields`
`dlp_data_type_name`	`additional.fields`
`dlp_relevant_data_types`	`additional.fields`
`dlp_rule_name`	`additional.fields`
`dlp_transport`	`additional.fields`
`dn`	`additional.fields`
`dns_domain_name`	`target.hostname`、 `target.asset.hostname`
`dns_message_type`	`security_result.detection_fields`
`dns_query_type`	`additional.fields`
`dns_query.queries`	`network.dns.questions.name`
`dns_type`	`additional.fields`
`domain`	`principal.administrative_domain`
`domain_name`	`principal.administrative_domain`
`dpt`	`target.port`
`drop_reason`	`security_result.summary`
`dst`	`target.ip`、 `target.asset.ip`
`dst_country`	`target.location.country_or_region`
`dst_domain_name`	`target.hostname`、 `target.asset.hostname`
`dst_ip`	`target.ip`、 `target.asset.ip`
`dst_machine_name`	`target.user.email_addresses`
`dst_phone_number`	`target.user.phone_numbers`
`dst_port`	`target.port`
`dst_uo_icon`	`additional.fields`
`dst_uo_name`	`target.location.country_or_region`
`dst_user_dn`	`target.resource.attribute.labels`
`dst_user_name`	`target.user.user_display_name`
`dstBytes`	`additional.fields`
`dstkeyid`	`additional.fields`
`dstPostNAT`	`target.nat_ip`
`dstPostNATPort`	`target.nat_port`
`duration`	`network.session_duration.seconds`
`during_sec`	`additional.fields`
`dvc`	`target.ip`、 `intermediary.ip`
`elapsed`	`additional.fields`
`email_content`	`security_result.description`
`email_control`	`additional.fields`
`email_queue_id`	`security_result.detection_fields`
`email_queue_name`	`security_result.detection_fields`
`email_session_id`	`additional.fields`
`email_status`	`security_result.detection_fields`
`email_subject`	`network.email.subject`
`emailSubject`	`network.email.subject`
`emulated_on`	`additional.fields`
`encryption_fail_reason`	`additional.fields`
`encryption_failure`	`security_result.description`
`environment_id`	`target.resource.product_object_id`
`Errors`	`security_result.description`
`euid`	`additional.fields`
`event_kind`	`additional.fields`
`event_name`	`metadata.description`
`event_start_time`	`additional.fields`
`extraction_download_time`	`additional.fields`
`extraction_time`	`additional.fields`
`extraction_total_time`	`additional.fields`
`failure_impact`	`additional.fields`
`failure_reason`	`additional.fields`
`feature_name`	`additional.fields`
`fg-1_client_in_rule_name`	`additional.fields`
`fg-1_client_out_rule_name`	`additional.fields`
`fieldschanges`	`security_result.detection_fields`
`file_count`	`additional.fields`
`file_direction`	`additional.fields`
`file_md5`	`target.file.md5`
`file_name`	`target.file.names`
`file_sha1`	`target.file.sha1`
`file_sha256`	`target.file.sha256`
`file_size`	`target.file.size`
`file_status`	`target.resource.attribute.labels`
`file_type`	`additional.fields`
`Firewall management node`	`security_result.detection_fields`
`firstname`	`principal.user.first_name`
`flags`	`additional.fields`
`flexString2`	`security_result.detection_fields`
`FollowUp`	`security_result.detection_fields`
`fragments_dropped`	`additional.fields`
`from`	`network.email.from`、 `additional.fields`
`from_user`	`principal.user.userid`
`fservice`	`security_result.detection_fields`
`fw_message`	`additional.fields`
`fw_subproduct`	`metadata.product_name`
`gateway_to_server_ciphers`	`additional.fields`
`geoip_dst.country_name`	`target.location.country_or_region`
`h_version`	`security_result.detection_fields`
`has_accounting`	`additional.fields`
`header_ip_`	`intermediary.ip`、 `intermediary.asset.ip`
`hll_key`	`additional.fields`
`host`	`target.hostname`、 `target.asset.hostname`
`hostname`	`target.hostname`、 `target.asset.hostname`
`http_host`	`target.ip`、 `target.asset.ip` (如果是 IP 位址)、 `target.hostname` (如果是主機名稱)
`http_server`	`target.application`
`http_status`	`network.http.response_code`
`https_inspection_action`	`additional.fields`
`https_inspection_rule_id`	`security_result.detection_fields`
`https_inspection_rule_name`	`security_result.detection_fields`
`https_validation`	`security_result.detection_fields`
`i_ip`	`intermediary.ip`、 `intermediary.asset.ip`
`icmp`	`additional.fields`
`ICMP`	`additional.fields`
`icmp_code`	`additional.fields`
`ICMP_Code`	`additional.fields`
`icmp_type`	`additional.fields`
`ICMP_Type`	`additional.fields`
`id`	`metadata.product_log_id`
`identity_src`	`target.application`
`identity_type`	`additional.fields`、 `extensions.auth.type`
`if_direction`	`network.direction`
`if_name`	`additional.fields`
`ifdir`	`network.direction`
`ifname`	`security_result.detection_fields`
`ike`	`security_result.description`
`ike_ids`	`additional.fields`
`Impact`	`additional.fields`
`indicator_name`	`security_result.detection_fields`
`indicator_uuid`	`security_result.detection_fields`
`industry_reference`	`additional.fields`
`Info`	`security_result.description`
`information`	`metadata.description`
`inspection_category`	`additional.fields`
`inspection_information`	`additional.fields`
`inspection_item`	`additional.fields`
`inspection_profile`	`additional.fields`
`install_policy_acceleration`	`additional.fields`
`instance_id`	`principal.hostname`、 `principal.asset.hostname`
`instruction`	`additional.fields`
`inter_host`	`intermediary.ip`
`inter_host1`	`intermediary.hostname`
`inter_hostname_`	`intermediary.hostname`
`intermediary_application`	`intermediary.application`
`intermediary_hostname_`	`intermediary.ip`、 `_intermediary.hostname`
`intermediary_ip`	`intermediary.ip`
`inzone`	`security_result.detection_fields`
`ip_address`	`target.resource.attribute.labels`
`ip_address` (衍生自封包)	`principal.ip`
`ip_address2` (衍生自封包)	`principal.ip`、 `principal.asset.ip`
`ip_host`	`intermediary.ip`、 `intermediary.asset.ip` (如果是 IP 位址)、 `intermediary.hostname` (如果是主機名稱)
`ip_id`	`additional.fields`
`ip_len`	`additional.fields`
`ip_offset`	`additional.fields`
`ipv6_dst`	`target.ip`、 `target.asset.ip`
`ipv6_src`	`principal.ip`、 `principal.asset.ip`
`is_correlated`	`additional.fields`
`is_last`	`additional.fields`
`last_hit_time`	`security_result.last_discovered_time`
`last_rematch_time`	`additional.fields`
`lastchg`	`additional.fields`
`lastname`	`principal.user.last_name`
`lastupdatetime`	`security_result.last_updated_time`
`layer_name`	`security_result.rule_set_display_name`、 `security_result.detection_fields`
`layer_name_match_table`	`additional.fields` (清單)
`layer_name_TP_match_table`	`additional.fields` (清單)
`layer_names`	`additional.fields.list`
`layer_uuid`	`security_result.rule_set`、 `security_result.detection_fields`
`layer_uuid_match_table`	`additional.fields` (清單)
`layer_uuid_rule_uuid.0`	`security_result.rule_id`
`layer_uuids`	`additional.fields.list`
`level`	`security_result.detection_fields`
`Level`	`security_result.confidence_details`
`local_value`	`additional.fields`
`localhost`	`target.hostname`、 `target.asset.hostname`
`log_attachment_uid`	`additional.fields`
`log_delay`	`additional.fields`
`log_id`	`metadata.product_log_id`
`log_link`	`additional.fields`
`log_sys_message`	`metadata.description`
`log_uid`	`additional.fields`
`log_version`	`metadata.product_version`
`logic_changes`	`security_result.detection_fields`
`logicchanges.FollowUp`	`security_result.detection_fields`
`logicchanges.Protection`	`security_result.detection_fields`
`logicchanges.Srcs_srcs`	`target.resource.product_object_id`
`logid`	`security_result.detection_fields`
`loguid`	`metadata.product_log_id`
`mac_address`	`principal.mac`
`machine`	`target.ip`
`maestro_gw`	`additional.fields`
`malware`	`security_result.detection_fields`
`malware_action`	`security_result.detection_fields`
`malware_family`	`security_result.detection_fields`、 `security_result.about.resource.attribute.labels`
`malware_rule_id`	`security_result.detection_fields`
`malware_rule_id_TP_match_table`	`additional.fields` (清單)
`malware_rule_name`	`security_result.detection_fields`
`match_id`	`additional.fields` (清單)
`match_id_match_table`	`additional.fields` (清單)
`match_ids`	`security_result.detection_fields`
`matched_category`	`security_result.detection_fields`
`max_num_count_detected`	`additional.fields`
`max_vms_num`	`additional.fields`
`media_type`	`additional.fields`
`member_id`	`additional.fields`
`message_info`	`metadata.description`
`metadata.product_log_id_insertion_epoch_timestamp`	`metadata.collected_timestamp`
`method`	`network.http.method`
`methods`	`additional.fields`
`mgmt_value`	`additional.fields`
`mitre_collection`	`additional.fields`
`mitre_command_and_control`	`additional.fields`
`mitre_credential_access`	`additional.fields`
`mitre_defense_evasion`	`additional.fields`
`mitre_discovery`	`additional.fields`
`mitre_execution`	`additional.fields`
`mitre_exfiltration`	`additional.fields`
`mitre_impact`	`additional.fields`
`mitre_initial_access`	`security_result.detection_fields`
`mitre_lateral_movement`	`additional.fields`
`mitre_persistence`	`additional.fields`
`mitre_privilege_escalation`	`additional.fields`
`more_sources`	`principal.ip`
`msg`	`security_result.description`
`msgid`	`additional.fields`
`Name`	`security_result.detection_fields`、 `security_result.about.resource.attribute.labels`
`nat_addtnl_rulenum`	`additional.fields`
`NAT_addtnl_rulenum`	`security_result.detection_fields`
`nat_rule_uid`	`additional.fields`
`nat_rulenum`	`security_result.detection_fields`
`NAT_rulenum`	`security_result.detection_fields`
`needs_browse_time`	`additional.fields`
`next_update_desc`	`additional.fields`
`num_of_updates`	`additional.fields`
`object`	`target.ip`
`objectname`	`additional.fields`
`objecttype`	`security_result.detection_fields`
`observable_comment`	`security_result.detection_fields`
`observable_id`	`security_result.detection_fields`
`observable_name`	`security_result.detection_fields`
`oid_prefix`	`additional.fields`
`operation`	`additional.fields`
`operation_number`	`security_result.detection_fields`
`operation_results`	`additional.fields`
`orig`	`principal.hostname`、 `principal.asset.hostname`
`orig_log_server`	`principal.resource.product_object_id`
`orig_log_server_ip`	`principal.ip`、 `principal.asset.ip`
`origin`	`intermediary.ip`、 `target.ip`、 `target.asset.ip` (當主機和目標機器的詳細資料皆為空值時)。
`origin_repetitions`	`additional.fields`
`origin_sic_name`	`intermediary.asset_id`
`originsicname`	`security_result.detection_fields`
`os`	`principal.platform`
`os_name`	`principal.asset.platform_software.platform`
`os_version`	`principal.asset.platform_software.platform_patch_level`
`outzone`	`security_result.detection_fields`
`p_hostname`	`principal.hostname`
`p_ip`	`principal.ip`、 `principal.asset.ip`
`p_userid`	`principal.user.userid`
`p_username`	`principal.user.user_display_name`
`package_action`	`additional.fields`
`packet_amount`	`additional.fields`
`packet_capture_name`	`additional.fields`
`packet_capture_time`	`additional.fields`
`packet_capture_unique_id`	`additional.fields`
`packets`	`additional.fields`
`parameter`	`additional.fields`
`parent_rule`	`additional.fields` (清單)
`parent_rule_match_table`	`additional.fields` (清單)
`parent_rules`	`additional.fields.list`
`password_field`	`additional.fields`
`path`	`target.file.full_path`
`peer_gateway`	`target.ip`、 `target.asset.ip`
`performance_impact`	`additional.fields`
`performanceImpAction`	`security_result.detection_fields`
`pid`	`principal.process.pid`
`platform_patch_level`	`principal.asset.platform_software.platform_patch_level`
`policy`	`additional.fields`
`policy_name`	`security_result.detection_fields`
`policy_time`	`security_result.detection_fields`
`policyNames`	`security_result.rule_set_display_name`
`port`	`additional.fields`
`port` (衍生自封包)	`principal.port`
`port2` (衍生自封包)	`target.port`
`portal_message`	`security_result.description`
`ppid`	`principal.process.parent_pid`
`precise_error`	`security_result.detection_fields`
`principal_hostname`	`principal.ip` 和 `principal.asset.ip` (當 `principal_hostname` 是有效 IP 時)、 `principal.hostname`、 `principal.asset.hostname` 和 `intermediary.hostname` (所有其他情況)
`principal_ip`	`principal.ip`、 `principal.asset.ip`
`product`	`metadata.product_name`
`product_event_type`	`metadata.product_event_type`
`product_family`	`additional.fields`
`product_log_id`	`metadata.product_log_id`
`ProductFamily`	`additional.fields`
`profile`	`security_result.detection_fields`
`Protection`	`security_result.detection_fields`
`protection_id`	`security_result.detection_fields`
`protection_name`	`security_result.detection_fields`、 `security_result.about.resource.attribute.labels`
`protection_type`	`security_result.detection_fields`、 `security_result.about.resource.attribute.labels`
`proto`	`additional.fields`
`protocol`	`network.application_protocol`
`proxy`	`security_resultc_ipprincipal.nat_ip`
`query`	`additional.fields`
`question_rdata`	`security_result.detection_fields`
`reason`	`security_result.summary`
`received_bytes`	`network.received_bytes`
`Reference`	`security_result.detection_fields`、 `security_result.about.resource.attribute.labels`
`registered_ip_phones`	`additional.fields`
`reject_category`	`security_result.summary`
`reject_id_kid`	`security_result.detection_fields`
`resource`	`additional.fields.list_value`
`resource_name`	`target.resource.name`
`resource1`	`target.url`
`result`	`security_result.summary`
`roles`	`additional.fields`
`ROW_END`	`additional.fields`
`ROW_START`	`additional.fields`
`rt`	`metadata.event_timestamp`
`rule`	`security_result.rule_name`、 `security_result.detection_fields`
`rule_action`	`security_result.action`、 `security_result.detection_fields`
`rule_action_match_table`	`additional.fields` (清單)
`rule_actions`	`security_result.detection_fields`
`rule_id`	`security_result.rule_id`
`rule_name`	`security_result.rule_name`
`rule_name_match_table`	`additional.fields` (清單)
`rule_names`	`additional.fields`
`rule_uid"	`security_result.rule_id`
`rule_uid_match_table`	`additional.fields` (清單)
`rule_uids`	`security_result.detection_fields`、 `additional.fields`
`s_port`	`additional.fields`
`scheme`	`additional.fields`
`scope`	`principal.ip` (如果是 IP 位址)、 `additional.fields` (如果不是 IP 位址)
`scrub_activity`	`additional.fields`
`securexl_message`	`additional.fields`
`security_inzone`	`security_result.detection_fields`
`security_outzone`	`security_result.detection_fields`
`segment_time`	`additional.fields`
`sendtotrackerasadvancedauditlog`	`security_result.detection_fields`
`sensor_alert_blade`	`additional.fields`
`sensor_alert_category`	`additional.fields`
`sensor_alert_duration`	`additional.fields`
`sensor_alert_id`	`additional.fields`
`sensor_alert_message`	`additional.fields`
`sensor_alert_module`	`additional.fields`
`sensor_alert_solution`	`additional.fields`
`sensor_alert_solution_sk`	`additional.fields`
`sensor_alert_title`	`additional.fields`
`sensor_alert_type`	`additional.fields`
`sensor_test_name`	`additional.fields`
`sent_bytes`	`network.sent_bytes`
`sequencenum`	`additional.fields`
`ser_agent_kid`	`security_result.detection_fields`
`server_inbound_bytes`	`network.sent_bytes`
`server_inbound_interface`	`additional.fields`
`server_inbound_packets`	`network.sent_bytes`
`server_kid`	`additional.fields`
`server_outbound_bytes`	`network.received_bytes`
`server_outbound_interface`	`target.resource.attribute.labels`
`server_outbound_packets`	`network.received_bytes`
`service`	`target.port`
`service_id`	`additional.fields`
`session_description`	`security_result.detection_fields`
`session_id`	`network.session_id`
`session_name`	`security_result.detection_fields`
`session_uid`	`network.session_id`
`sev`	`security_result.severity`
`severity`	`security_result.detection_fields`
`Severity`	`security_result.severity`
`sig_id`	`additional.fields`
`signature`	`security_result.threat_name`
`site`	`network.http.user_agent`
`smartdefense_profile`	`security_result.detection_fields`
`smartdefense_profile_TP_match_table`	`additional.fields` (清單)
`sni`	`additional.fields`
`snid`	`network.session_id`
`Source`	`target.resource.attribute.labels`
`source_os`	`additional.fields`
`sourceAddress`	`principal.ip`、 `principal.asset.ip`
`sourcePort`	`principal.port`
`sourceTranslatedAddress`	`principal.ip`、 `principal.asset.ip`、 `principal.nat_ip`
`sourceTranslatedPort`	`principal.port`、 `principal.nat_port`
`sourceUserName`	`match => { "sourceUserName" => [ "%{DATA:firstname}( %{DATA:lastname})? \\\(%{DATA:userid}\\\)"]}`
`special_attack`	`additional.fields`
`spt`	`principal.port`
`sr_url`	`security_result.about.url`
`src`	`principal.ip`、 `principal.hostname`、 `principal.asset.ip`、 `principal.asset.hostname`
`src_domain_name`	`principal.hostname`、 `principal.asset.hostname`
`src_ip`	`principal.ip`、 `principal.asset.ip`
`src_localhost`	`principal.hostname`、 `principal.asset.hostname`
`src_machine_group`	`principal.resource.attribute.labels`
`src_machine_name`	`principal.user.email_addresses`
`src_port`	`principal.port`
`src_uo_icon`	`additional.fields`
`src_uo_name`	`principal.location.country_or_region`
`src_user`	`principal.user.userid`
`src_user_dn`	`principal.resource.attribute.labels`
`src_user_group`	`principal.resource.attribute.labels`
`src_user_name`	`principal.user.userid`
`srcBytes`	`additional.fields`
`srcip`	`additional.fields`
`srcPort`	`principal.port`
`srcPostNAT`	`principal.nat_ip`
`srcPostNATPort`	`principal.nat_port`
`Srcs`	`security_resultcstarget.resource.attribute.labels`
`srv_ip`	`target.ip`
`ssh_connection_stage`	`additional.fields`
`sshd_function`	`additional.fields`
`start_time`	`metadata.collected_timestamp`
`status`	`security_result.action_details`、 `security_result.detection_fields`、 `security_result.action`
`stormagentaction`	`additional.fields`
`stormagentname`	`additional.fields`
`sub_policy_name`	`security_result.detection_fields`
`sub_policy_uid`	`security_result.detection_fields`
`subject`	`metadata.description`
`subscription_description`	`additional.fields`
`subscription_stat`	`security_result.detection_fields`
`subscription_stat_desc`	`security_result.summary`
`subscription_status`	`security_result.detection_fields`
`suppressed_logs`	`security_result.detection_fields`
`svc`	`target.port`
`sys_message`	`additional.fields`
`syslog_date`	`additional.fields`
`syslog_facility_code`	`additional.fields`
`syslog_pri`	`additional.fields`
`system_alert_message`	`additional.fields`
`system_application`	`additional.fields`
`tags`	`security_result.detection_fields`
`tar_user`	`target.user.userid`
`tar_userid`	`target.user.userid`
`tar_username`	`target.user.user_display_name`
`target_port`	`target.port`
`tcp_flags`	`additional.fields`
`tcp_packet_out_of_state`	`security_result.detection_fields`
`te_verdict_determined_by`	`additional.fields`
`temp_duser`	`target.user.email_addresses`
`tid`	`security_result.detection_fields`
`time`	`metadata.event_timestamp`
`time_interval`	`additional.fields`
`tls_server_host_name`	`additional.fields`
`to`	`network.email.to`、 `additional.fields`
`TP_match_table`	`additional.fields`
`Track`	`additional.fields`
`two-factor_authentication`	`security_result.detection_fields`
`type`	`security_result.rule_type`
`uid`	`additional.fields`
`UP_match_table`	`additional.fields`
`update_count`	`additional.fields`
`update_service`	`additional.fields`
`update_status`	`security_result.action`、 `security_result.action_details`
`url`	`principal.url`
`url_count`	`additional.fields`
`user`	`principal.user.user_display_name`
`user_agent`	`network.http.user_agent`、 `network.http.parsed_user_agent`
`usercheck_interaction_name`	`security_result.rule_name`
`userid`	`principal.user.userid`
`userip`	`principal.ip`、 `principal.asset.ip`
`UUid`	`metadata.product_log_id`
`validation_log`	`additional.fields`
`vendor_list`	`security_result.detection_fields`
`vendor_name`	`metadata.vendor_name`
`verdict`	`security_result.verdict_info.verdict_response`
`version`	`metadata.product_version`
`version_`	`additional.fields`
`via`	`additional.fields`
`voip_call_dir`	`additional.fields`
`voip_call_id`	`network.session_id`
`voip_call_state`	`additional.fields`
`voip_duration`	`additional.fields`
`voip_log_type`	`additional.fields`
`voip_media_ipp`	`additional.fields`
`voip_media_port`	`additional.fields`
`voip_method`	`additional.fields`
`voip_reason_info`	`additional.fields`
`voip_reg_ip`	`additional.fields`
`voip_reg_ipp`	`additional.fields`
`voip_reg_period`	`additional.fields`
`voip_reg_port`	`additional.fields`
`voip_reg_server`	`additional.fields`
`voip_reject_reason`	`additional.fields`
`VPN`	`additional.fields`
`vpn_feature_name`	`additional.fields`
`watermark`	`additional.fields`
`web_client_type`	`network.useragent`
`web_client_type.0`	`network.http.user_agent`、 `network.http.parsed_user_agent`
`xlatedport`	`target.nat_port`
`xlatedst`	`target.nat_ip`
`xlatesport`	`principal.nat_port`
`xlatesrc`	`principal.nat_ip`

版本差異

Google SecOps 於 2026 年 3 月 1 日發布新版 Check Point 防火牆剖析器，其中包含 Parser_Name 記錄欄位到 UDM 欄位的對應重大變更，以及事件類型對應變更。

記錄欄位對應差異

下表列出 2026 年 3 月 1 日前後，Check Point 防火牆記錄與 UDM 欄位之間的對應差異 (分別列於「舊版對應」和「目前對應」欄位)：

記錄欄位	舊對應	目前對應
`client_inbound_bytes`	`princiapal.resource.attribute_labels`	`principal.network.received_bytes`
`client_outbound_bytes`	`princiapal.resource.attribute_labels`	`principal.network.sent_bytes`
`lastupdatetime`	`additional.fields`	`security_result.last_updated_time`
`layer_names`	`security_result.detection_fields`	`additional.fields.list`
`layer_uuids`	`security_result.detection_fields`、`additional.fields`	`additional.fields.list`
`operation`	`security_result.detection_fields`	`additional.fields`
`originsicname`	`intermediary.labels`	`security_resul.detection_fields`
`parent_rules`	`additional.fields`	`additional.fields.list`
`pid`	`additional.fields`	`principal.process.pid`
`scope`	`additional.fields`	`principal.ip` (如果是 IP 位址)、 `additional.fields` (如果不是 IP 位址)
`server_inbound_bytes`	`target.resource.attribute.labels`、`network.sent_bytes`	`network.sent_bytes`
`server_inbound_packets`	`target.resource.attribute.labels`、`network.sent_packets`	`network.sent_packets`
`server_outbound_bytes`	`target.resource.attribute.labels`、`network.received_bytes`	`network.received_bytes`
`server_outbound_packets`	`target.resource.attribute.labels`、`network.received_packets`	`network.received_packets`
`src_machine_name`	`additional.fields`	`principal.user.email_addresses`
`src_user_dn`	`sr.detection_fields`	`principal.resource.attribute.labels`
`suppressed_logs`	`additional.fields`	`security_result.detection_fields`
`web_client_type`	`additional.fields`	`network.useragent`

事件類型對應差異

系統現在會以有意義的事件類型，正確分類先前以一般方式分類的多個事件。

下表列出 2026 年 3 月 1 日前後，處理 Check Point 防火牆事件類型時的差異 (分別列於「舊 event_type」和「目前 event_type」欄中)：

格式	記錄中的事件 ID	舊 event_type	目前的 event_type
SYSLOG+KV	記錄包含 `sourceAddress` 和 `host`	`GENERIC_EVENT`	`NETWORK_CONNECTION`
SYSLOG+JSON	記錄包含 `sourceAddress` 和 `host`	`NETWORK_HTTP`	`NETWORK_CONNECTION`
SYSLOG+JSON	記錄包含 `sourceAddress` 和 `host`	`NETWORK_HTTP`	`NETWORK_CONNECTION`

變更記錄

查看這個剖析器的變更記錄

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。