收集 Cisco IOS 記錄

剖析器版本：23.0

支援語言：

本文說明如何使用 Bindplane 代理程式，將 Cisco IOS 記錄擷取至 Google Security Operations。

Cisco IOS 裝置會針對系統事件、介面狀態變更、ACL 比對、驗證和路由事件產生系統記錄訊息。剖析器會使用 grok 模式擷取欄位，並將這些欄位對應至統合式資料模型 (UDM)。

事前準備

請確認您已完成下列事前準備事項：

  • Google SecOps 執行個體
  • Windows Server 2016 以上版本，或搭載 systemd 的 Linux 主機
  • Bindplane 代理程式與 Cisco IOS 裝置之間的網路連線
  • 如果透過 Proxy 執行，請確保防火牆通訊埠已根據 Bindplane 代理程式需求開啟
  • 使用 SSH 或控制台取得 Cisco IOS 裝置的特殊權限

取得 Google SecOps 擷取驗證檔案

  1. 登入 Google SecOps 控制台。
  2. 依序前往「SIEM 設定」>「收集代理程式」。
  3. 下載擷取驗證檔案。

  4. 將檔案安全地儲存在要安裝 Bindplane 代理程式的系統上。

取得 Google SecOps 客戶 ID

  1. 登入 Google SecOps 控制台。
  2. 依序前往「SIEM 設定」>「設定檔」。

  3. 複製並儲存「機構詳細資料」部分中的客戶 ID。

安裝 Bindplane 代理程式

請按照下列操作說明，在 Windows 或 Linux 作業系統上安裝 Bindplane 代理程式。

Windows 安裝

  1. 以管理員身分開啟「命令提示字元」或「PowerShell」。

  2. 執行下列指令：

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. 等待安裝完成。

  4. 執行下列指令，確認安裝成功：

    sc query observiq-otel-collector

    服務應顯示為「RUNNING」。

Linux 安裝

  1. 開啟具有根層級或 sudo 權限的終端機。

  2. 執行下列指令：

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. 等待安裝完成。

  4. 執行下列指令，確認安裝成功：

    sudo systemctl status observiq-otel-collector

    服務應顯示為有效 (執行中)。

其他安裝資源

如需其他安裝選項和疑難排解資訊，請參閱 Bindplane 代理程式安裝指南。

設定 Bindplane 代理程式，擷取系統記錄檔並傳送至 Google SecOps

找出設定檔

  • Linux：

    sudo nano /etc/bindplane-agent/config.yaml

  • Windows：

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

編輯設定檔

  • 將 config.yaml 的全部內容替換為下列設定：

    receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/cisco_ios:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: CISCO_IOS
        raw_log_field: body

service:
    pipelines:
        logs/cisco_ios_to_chronicle:
            receivers:
                - udplog
            exporters:
                - chronicle/cisco_ios

設定參數

替換下列預留位置：

  • 接收器設定：

    • listen_address：要接聽的 IP 位址和通訊埠：
      • 0.0.0.0，監聽所有介面 (建議)
      • 通訊埠 514 是標準的系統記錄通訊埠 (在 Linux 上需要根層級權限；非根層級權限請使用 1514)

  • 匯出工具設定：

    • creds_file_path：擷取驗證檔案的完整路徑：
      • Linux：/etc/bindplane-agent/ingestion-auth.json
      • Windows：C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
    • customer_id：從 Google SecOps 控制台複製的客戶 ID
    • endpoint：區域端點網址：
      • 美國：malachiteingestion-pa.googleapis.com
      • 歐洲：europe-malachiteingestion-pa.googleapis.com
      • 亞洲：asia-southeast1-malachiteingestion-pa.googleapis.com
      • 如需完整清單，請參閱「區域端點」

儲存設定檔

  • 編輯完成後，請儲存檔案：
    • Linux：依序按下 Ctrl+O、Enter 和 Ctrl+X
    • Windows：依序點選「檔案」>「儲存」

重新啟動 Bindplane 代理程式，以套用變更

  • 如要在 Linux 中重新啟動 Bindplane 代理程式，請執行下列指令：

    sudo systemctl restart observiq-otel-collector

    1. 確認服務正在執行：

      ```bash
sudo systemctl status observiq-otel-collector
```

    2. 檢查記錄中是否有錯誤：

      ```bash
sudo journalctl -u observiq-otel-collector -f
```

  • 如要在 Windows 中重新啟動 Bindplane 代理程式，請選擇下列其中一個選項：

    • 以管理員身分開啟命令提示字元或 PowerShell：

      net stop observiq-otel-collector && net start observiq-otel-collector

    • 服務控制台：

      1. 按下 Win+R，輸入 services.msc，然後按下 Enter 鍵。
      2. 找出 observIQ OpenTelemetry Collector。
      3. 按一下滑鼠右鍵，然後選取「重新啟動」。

      4. 確認服務正在執行：

        sc query observiq-otel-collector

      5. 檢查記錄中是否有錯誤：

        type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

在 Cisco IOS 裝置上設定系統記錄

  1. 使用 SSH 或主控台連線登入 Cisco IOS 裝置。

  2. 進入特殊權限模式：

    enable

  3. 進入設定模式：

    conf t

  4. 設定系統記錄檔：

    logging <BINDPLANE_IP>
logging source-interface <INTERFACE>
    • 請將 <BINDPLANE_IP> 替換為實際的 Bindplane 代理程式 IP 位址。
    • 將 <INTERFACE> 替換為實際的通訊介面。

  5. 設定優先順序：

    logging trap information
logging console information

  6. 設定系統記錄設施：

    logging facility syslog

  7. 儲存設定：

    copy running-config startup-config

UDM 對應表

記錄欄位
 UDM 對應
13_Protocol_Runtime_Context additional.fields
16_AdminWebappN additional.fields
16_AdminWebappT additional.fields
16_AdminWebappU additional.fields
16_BYODN additional.fields
16_BYODT additional.fields
16_BYODU additional.fields
16_DBListenerN additional.fields
16_DBListenerT additional.fields
16_DBListenerU additional.fields
16_DBServerN additional.fields
16_DBServerT additional.fields
16_DBServerU additional.fields
16_GuestN additional.fields
16_GuestT additional.fields
16_GuestU additional.fields
16_iowait additional.fields
16_ISEIndexingEngineN additional.fields
16_ISEIndexingEngineT additional.fields
16_ISEIndexingEngineU additional.fields
16_JVMN additional.fields
16_JVMT additional.fields
16_JVMU additional.fields
16_MessageQueueN additional.fields
16_MessageQueueT additional.fields
16_MessageQueueU additional.fields
16_MisservicesN additional.fields
16_MisservicesT additional.fields
16_MisservicesU additional.fields
16_NSFN additional.fields
16_NSFT additional.fields
16_NSFU additional.fields
16_ProfilerDatabaseN additional.fields
16_ProfilerDatabaseT additional.fields
16_ProfilerDatabaseU additional.fields
16_RMIT additional.fields
16_RMIU additional.fields
16_SyslogN additional.fields
16_SyslogT additional.fields
16_SyslogU additional.fields
4_ArpCache_InsertUpdate_Received additional.fields
4_HostName_Event_Fetch_FromAD additional.fields
4_Probe_Requests_Dropped additional.fields
4_Probe_Requests_Received additional.fields
AAA_ID security_result.detection_fields
about event.idm.read_only_udm.about
Acct-Session-Id principal.resource.attribute.labels
AcctRequest-Flags security_result.summary
AcctRequest-Flags security_result.action
條件：
[AcctRequest-Flags] =~「(?i)Start」或「(?i)Stop」
AcsSessionID network.session_id
Action_number security_result.detection_fields
address_family security_result.detection_fields
admin_state security_result.detection_fields
aid security_result.detection_fields
applet_statement security_result.detection_fields
application principal.application
application_name principal.application
arp_resp additional.fields
arp_src principal.ip
principal.asset.ip
attr additional.fields
auditid network.session_id
auth_neg_dur additional.fields
Authen-Method security_result.detection_fields
Authen-Type additional.fields
authentication_protocol security_result.detection_fields
AuthenticationIdentityStore additional.fields
AuthenticationMethod additional.fields
AuthenticationStatus security_result.summary
AuthorizationPolicyMatchedRule security_result.rule_name
avg_time additional.fields
AVPair_priv-lvl security_result.detection_fields
AVPair_start_time additional.fields
AVPair_task_id additional.fields
AVPair_timezone additional.fields
band additional.fields
calledId security_result.detection_fields
calledId2 security_result.detection_fields
callID additional.fields
Calling-Station-ID additional.fields
category security_result.category
category_number security_result.detection_fields
channel additional.fields
Chassis_data additional.fields
cisco_facility_2 security_result.detection_fields
cisco_message network.application_protocol
條件：
If [cisco_message] =~ "ssh" else if [cisco_message] =~ "HTTP"
cisco_mnemonic security_result.rule_name
cisco_severity security_result.severity
條件：
[cisco_severity] ==「0」
其他詳細資料：
「security_result.severity」=>「嚴重」；「security_result.severity_details」=>「系統無法使用」
cisco_severity security_result.severity
條件：
[cisco_severity] == "1"
其他詳細資料：
「security_result.severity」=>「重大」"security_result.severity_details" =>「需要立即採取行動」
cisco_severity security_result.severity
條件：
[cisco_severity] == "2"
其他詳細資料：
「security_result.severity」=>「高」 「security_result.severity_details」=>「危急」
cisco_severity security_result.severity
條件：
[cisco_severity] == "3"
其他詳細資料：
「security_result.severity」=>「ERROR」 「security_result.severity_details」=>「Error condition」
cisco_severity security_result.severity
條件：
[cisco_severity] == "4"
其他詳細資料：
「security_result.severity」=>「MEDIUM」(中)「security_result.severity_details」=>「Warning condition」(警告條件)
cisco_severity security_result.severity
條件：
[cisco_severity] == "5"
其他詳細資料：
「security_result.severity」=>「LOW」(低)「security_result.severity_details」=>「Normal but significant condition」(正常但重大狀況)
cisco_severity security_result.severity
條件：
[cisco_severity] == "6"
其他詳細資料：
「security_result.severity」=>「INFORMATIONAL」(資訊)「security_result.severity_details」=>「Informational message only」(僅限資訊訊息)
cisco_severity security_result.severity
條件：
[cisco_severity] == "7"
其他詳細資料：
「security_result.severity」=>「INFORMATIONAL」(資訊)「security_result.severity_details」=>「Appears during debugging only」(僅在偵錯期間顯示)
cisco_severity security_result.severity >「重大」
class_type security_result.detection_fields
client_mac principal.mac
principal.asset.mac
ClientLatency additional.fields
CmdSet principal.process.command_line
CName additional.fields
code additional.fields
code_reference additional.fields
collected_timestamp metadata.collected_timestamp
collector_id additional.fields
command principal.process.command_line
command_code additional.fields
community_count additional.fields
ConfigVersionId additional.fields
context additional.fields
context2 additional.fields
CPMSessionID additional.fields
current_state security_result.detection_fields
da_vendor additional.fields
data_value additional.fields
debug_file principal.process.file.full_path
debug_line additional.fields
debug_timestamp security_result.detection_fields
desc metadata.description
description metadata.description
DestinationIPAddress target.ip
target.asset.ip
DestinationPort target.port
DetailedInfo security_result.summary
dev_type principal.platform_version
device_component additional.fields
Device_IP_Address principal.ip
principal.asset.ip
device_os additional.fields
Device_Type additional.fields
DeviceType principal.resource.resource_subtype
DeviceType principal.resource.resource_type
條件：
[DeviceType] =~ "Phone"
DIP target.ip
target.asset.ip
DMac target.resource.attribute.labels
domain principal.administrative_domain
Domain principal.administrative_domain
dp_handle additional.fields
DPort target.port
dst_ip target.ip
target.asset.ip
dst_mac target.mac
target.asset.mac
dst_port target.port
dst_user target.user.userid
duration additional.fields
dynamic_mac target.resource.attribute.labels
EnableFlag security_result.detection_fields
ephone-1 principal.resource.attribute.labels
essid security_result.detection_fields
event_id additional.fields
failure_reason security_result.description
file_path principal.file.full_path
first_bgp_community additional.fields
flapping_port_1 additional.fields
flapping_port_2 additional.fields
flowtype security_result.detection_fields
for ALG additional.fields
fqdn security_result.detection_fields
framed security_result.detection_fields
full_conn additional.fields
group principal.group.group_display_name
Hit cnt additional.fields
hmac_algorithm additional.fields
hostname principal.hostname
principal.asset.hostname
hostname (value = %PARSER-5-CFGLOG_LOGGEDCMD) metadata.product_event_type
icmp_code additional.fields
icmp_type additional.fields
IdentityGroup principal.user.group_identifiers
IdentitySelectionMatchedRule security_result.detection_fields
IEC additional.fields
input intf additional.fields
input_interface additional.fields
inter_host intermediary.ip
intermediary.hostname
interface intermediary.resource.name
interface_2 intermediary.resource.attribute.labels
intermediary_host intermediary.ip
intermediary.hostname
intermediary_ip intermediary.ip
internal_error security_result.summary
invalid_arp_count additional.fields
ip_ident additional.fields
ip_resp additional.fields
ip_sla_id additional.fields
ip_src principal.ip
principal.asset.ip
IPSEC additional.fields
is_wpa additional.fields
IsMachineAuthentication additional.fields
IsMachineIdentity security_result.detection_fields
last_auth_ago additional.fields
list security_result.detection_fields
list_id additional.fields
loc_id security_result.detection_fields
Location additional.fields
logging_attribute principal.resource.attribute.labels
mapping-id additional.fields
MatchedCommandSet additional.fields
max_threshold security_result.detection_fields
message_type additional.fields
missed_packets security_result.detection_fields
Model_Name additional.fields
module security_result.detection_fields
module_id security_result.detection_fields
Name additional.fields
nas_identity target.hostname
target.asset.hostname
nas_ip target.nat_ip
NAS_IP_Address intermediary.ip
nas_port target.nat_port
NAS-Identifier target.resource.attribute.labels
nastype target.resource.attribute.labels
nat_ip principal.nat_ip
Network_Device_Profile additional.fields
network_processor additional.fields
NetworkDeviceProfileId principal.resource.product_object_id
NetworkDeviceProfileName principal.resource.name
new_value security_result.detection_fields
new-state security_result.detection_fields
non-PATable additional.fields
Notification additional.fields
object_tracking_number additional.fields
offset additional.fields
oid additional.fields
oper_state security_result.detection_fields
peer-system-ip target.ip
target.asset.ip
peer-type additional.fields
peer-vmanage-system-ip target.ip
target.asset.ip
personality principal.resource.attribute.labels
pid principal.process.pid
PktLen additional.fields
Port principal.resource.attribute.labels
port range additional.fields
port_channel security_result.detection_fields
previous_state security_result.detection_fields
previous_value security_result.detection_fields
principal_resource principal.resource.name
principal_user_address principal.user.attribute.labels
privilege_level security_result.detection_fields
Privilege-Level security_result.detection_fields
process principal.resource.attribute.labels
process_name target.application
processing_time additional.fields
product_log_id metadata.product_log_id
prot additional.fields
Proto additional.fields
protocol network.application_protocol
network.ip_protocol
Protocol additional.fields
protocol_number security_result.detection_fields
public-ip principal.nat_ip
public-port principal.nat_port
qfp_data additional.fields
radio additional.fields
reason security_result.summary
received_packets network.received_bytes
region principal.location.country_or_region
Remote-Address target.ip
target.asset.ip
request_id additional.fields
RequestLatency security_result.detection_fields
Response additional.fields
result_action security_result.action
RSA_keypair security_result.detection_fields
rssi additional.fields
rtt additional.fields
sec_action security_result.action
security_process security_result.detection_fields
SelectedAccessService security_result.action_details
SelectedAuthenticationIdentityStores security_result.detection_fields
SelectedAuthorizationProfiles security_result.detection_fields
SelectedCommandSet additional.fields
SelectedShellProfile additional.fields
Service additional.fields
service security_result.detection_fields
Service-Argument additional.fields
session_id network.session_id
session_id2 security_result.detection_fields
session_packet network.sent_bytes
severity-level security_result.detection_fields
SIP principal.ip
principal.asset.ip
SMac principal.resource.attribute.labels
Socket principal.resource.attribute.labels
Software_Version additional.fields
source_facility principal.hostname
principal.asset.hostname
sourced_by additional.fields
spi security_result.detection_fields
SPort principal.port
Src Intf principal.resource.attribute.labels
src_ip principal.ip
principal.asset.ip
principal.hostname
principal.asset.hostname
src_ip_2 principal.ip
principal.asset.ip
src_mac principal.mac
principal.asset.mac
src_port principal.port
src_user_id principal.user.userid
src_user_name principal.user.user_display_name
src_username principal.user.user_display_name
src-color principal.resource.attribute.labels
ssid security_result.detection_fields
state security_result.detection_fields
status_code network.http.response_code
status_msg security_result.rule_name
StepData_13 security_result.summary
StepData_14 security_result.detection_fields
StepData_15 security_result.detection_fields
StepData_20 security_result.detection_fields
StepData_21 security_result.detection_fields
StepData_3 additional.fields
StepData_4 security_result.detection_fields
StepData_6 security_result.detection_fields
StepData_7 security_result.detection_fields
StepData_8 security_result.detection_fields
StepLatency additional.fields
syslog_msg_category additional.fields
syslog_msg_id additional.fields
syslog_msg_level additional.fields
syslog_msg_source additional.fields
syslog_priority additional.fields
system-ip principal.ip
principal.asset.ip
target_ip target.ip
target.asset.ip
target_mac target.mac
target.asset.mac
target_process_id target.process.pid
target_process_name target.resource.attribute.labels
target_user_address target.user.attribute.labels
thirdparty additional.fields
thread_id principal.resource.attribute.labels
timestamp metadata.event_timestamp
timestamp1 additional.fields
tls_cipher network.tls.cipher
tls_client network.tls.client.supported_ciphers
TotalAuthenLatency additional.fields
tracked_object_id additional.fields
transport_protocol additional.fields
trustpoint about.resource.name
TS additional.fields
tty_number additional.fields
tunnel_client_endpoint principal.ip
principal.asset.ip
Type security_result.category_details
uptime additional.fields
url target.url
User principal.user.userid
userName target.user.userid
條件：
if ([cisco_tag] =~ "SEC_LOGIN-4-LOGIN_FAILED" or [cisco_mnemonic] =~ "LOGIN_FAILED") [cisco_tag] =~ "SEC_LOGIN-5-LOGIN_SUCCESS" or [cisco_facility] =~ "SEC_LOGIN" or [cisco_facility] =~ "SEC LOGIN" or [cisco_mnemonic]=~ "LOGIN_SUCCESS" or [cisco_mnemonic] =~ "SSH2_USERAUTH" or [cisco_mnemonic] =~ "LOGIN"
Username principal.user.userid
username_length additional.fields
UserType additional.fields
vap additional.fields
vlan_id intermediary.resource.attribute.labels
vlan_id_2 intermediary.resource.attribute.labels
Vlan-Id additional.fields
VlanType additional.fields
vrid security_result.detection_fields
zone additional.fields
zone_pair security_result.detection_fields

版本差異

Google SecOps 發布了新版 Cisco IOS 剖析器，其中包含 Parser_Name 記錄欄位對應至 UDM 欄位的變更，以及事件類型對應的變更。

記錄欄位對應差異

下表列出 Cisco IOS 記錄到 UDM 欄位的對應差異：

記錄欄位 舊對應 目前對應
aid additional.fields security_result.detection_fields
auditid metadata.product_log_id network.session_id
cisco_severity "security_result.severity" => "LOW" "security_result.severity" => "CRITICAL"
CmdSet additional.fields principal.process.command_line
dst_user ( value=host) target.user.userid removed
fqdn principal.hostname security_result.detection_fields
hostname (value = %PARSER-5-CFGLOG_LOGGEDCMD) principal.hostname metadata.product_event_type
IdentityGroup additional.fields principal.user.group_identifiers
interface intermediary.labels intermediary.resource.name
sequence_id additional.fields metadata.product_log_id
User target.user.userid principal.user.userid

事件類型對應差異

條件經過修改的現有事件類型：

事件類型 條件 原因
STATUS_UPDATE else if([principal_mid_present] == "true" or [has_principal] == "true")and [target_mid_present] == "false" { To avoid setting up STATUS_UPDATE if principal.ip and target.ip both are present.
USER_UNCATEGORIZED else if [principal_userid_present] == "true" or [principal_display_name_present] == "true" or [target_userid_present] == "true" {

新活動類型：

新增活動類型 條件
DEVICE_CONFIG_UPDATE else if [principal_mid_present] == "true" and [cisco_tag] in ["PARSER-5-CFGLOG_LOGGEDCMD","SYS-5-CONFIG_I"] {
USER_LOGIN else if([principal_userid_present] == "true" or [principal_display_name_present] == "true" or [target_userid_present] == "true")and [process_name] != "" and([user_event] =~ "(?i)new tcp session" or [user_event] =~ "(?i)created new session"){
USER_LOGIN else if [target_mid_present] == "true" and [user_event] =~ "(?i)logging" {
USER_UNCATEGORIZED else if [principal_userid_present] == "true" or [target_userid_present] == "true" or [principal_mac_present] == "true" {
記錄欄位 UDM 對應
AcsSessionID network.session_id
AcctRequest-Flags security_result.summary
AcctRequest-Flags security_result.action
AuthenticationIdentityStore additional.fields.key = AuthenticationIdentityStore, value = AuthenticationIdentityStore
AuthenticationMethod additional.fields.key = AuthenticationMethod, value = AuthenticationMethod
AuthenticationStatus security_result.summary
Authen-Method security_result.detection_fields.key = Authen-Method, value = Authen-Method
Authen-Method extensions.auth.type
AVPair_priv-lvl security_result.detection_fields.key = AVPair_priv-lvl, value = AVPair_priv-lvl
AVPair_start_time additional.fields.key = AVPair_start_time, value = AVPair_start_time
AVPair_task_id additional.fields.key = AVPair_task_id, value = AVPair_task_id
AVPair_timezone additional.fields.key = AVPair_timezone, value = AVPair_timezone
auditid metadata.product_log_id
cisco_facility
cisco_message metadata.description
cisco_mnemonic security_result.rule_name
cisco_severity security_result.severity
cisco_severity security_result.severity_details
cisco_tag metadata.product_event_type
cisco_tag metadata.event_type
ClientLatency additional.fields.key = ClientLatency, value = ClientLatency
CmdSet additional.fields.key = CmdSet, value = CmdSet
指令 principal.process.command_line
CPMSessionID additional.fields.key = CPMSessionID, value = CPMSessionID
說明 metadata.description
DestinationIPAddress target.asset.ip
DestinationIPAddress target.ip
DestinationPort target.port
Device_IP_Address principal.asset.ip
Device_IP_Address principal.ip
Device_Type additional.fields.key = Device_Type, value = Device_Type
dst_ip target.asset.ip
dst_ip target.ip
dst_port target.port
dst_user target.user.userid
EnableFlag security_result.detection_fields.key = EnableFlag, value = EnableFlag
IdentityGroup additional.fields.key = IdentityGroup, value = IdentityGroup
IdentitySelectionMatchedRule security_result.detection_fields.key = IdentitySelectionMatchedRule, value = IdentitySelectionMatchedRule
intermediary_host intermediary.hostname
intermediary_ip intermediary.ip
IPSEC additional.fields.key = IPSEC, value = IPSEC
ISEPolicySetName extensions.auth.type
IsMachineAuthentication additional.fields.key = IsMachineAuthentication, value = IsMachineAuthentication
IsMachineIdentity security_result.detection_fields.key = IsMachineIdentity, value = IsMachineIdentity
位置 additional.fields.key = Location, value = Location
MatchedCommandSet additional.fields.key = MatchedCommandSet, value = MatchedCommandSet
訊息
metadata_event_type metadata.event_type
Model_Name additional.fields.key = Model_Name, value = Model_Name
名稱 additional.fields.key = Name, value = Name
Network_Device_Profile additional.fields.key = Network_Device_Profile, value = Network_Device_Profile
NetworkDeviceGroups additional.fields.key = NetworkDeviceGroups, value = NetworkDeviceGroups
NetworkDeviceName principal.asset.hostname
NetworkDeviceName principal.hostname
NetworkDeviceProfileId principal.resource.product_object_id
pid principal.process.pid
通訊埠 principal.resource.attribute.labels.key = Port, value = Port
權限層級 security_result.detection_fields.key = Privilege-Level, value = Privilege-Level
product_event_type metadata.product_event_type
通訊協定 additional.fields.key = Protocol, value = Protocol
通訊協定 network.application_protocol
通訊協定 network.ip_protocol
原因 security_result.summary
區域 principal.location.country_or_region
Remote-Address target.asset.ip
Remote-Address target.ip
RequestLatency security_result.detection_fields.key = RequestLatency, value = RequestLatency
回應 additional.fields.key = Response, value = Response
SelectedAccessService security_result.action_details
SelectedAuthenticationIdentityStores security_result.detection_fields.key = SelectedAuthenticationIdentityStores, value = SelectedAuthenticationIdentityStores
SelectedCommandSet additional.fields.key = SelectedCommandSet, value = SelectedCommandSet
服務 additional.fields.key = Service, value = Service
Service-Argument additional.fields.key = Service-Argument, value = Service-Argument
嚴重性 security_result.severity
Software_Version additional.fields.key = Software_Version, value = Software_Version
source_facility principal.asset.hostname
source_facility principal.hostname
src_ip principal.asset.ip
src_ip principal.ip
src_mac principal.mac
src_port principal.port
src_user_id principal.user.userid
src_user_name principal.user.user_display_name
步驟 additional.fields.key = Step, value = Step
StepData_10 principal.asset.hostname
StepData_10 principal.hostname
StepData_13 security_result.summary
StepData_14 security_result.detection_fields.key = StepData_14, value = StepData_14
StepData_15 security_result.detection_fields.key = StepData_15, value = StepData_15
StepData_20 security_result.detection_fields.key = StepData_20, value = StepData_20
StepData_21 security_result.detection_fields.key = StepData_21, value = StepData_21
StepData_3 additional.fields.key = StepData_3, value = StepData_3
StepData_4 security_result.detection_fields.key = StepData_4, value = StepData_4
StepData_6 security_result.detection_fields.key = StepData_6, value = StepData_6
StepData_7 security_result.detection_fields.key = StepData_7, value = StepData_7
StepData_8 security_result.detection_fields.key = StepData_8, value = StepData_8
StepData_9 principal.user.userid
target_host target.asset.hostname
target_host target.hostname
時間戳記 metadata.event_timestamp
TotalAuthenLatency additional.fields.key = TotalAuthenLatency, value = TotalAuthenLatency
ts metadata.event_timestamp
類型 security_result.category_details
使用者 principal.user.userid
UserType additional.fields.key = UserType, value = UserType
metadata.vendor_name
metadata.product_name
metadata.log_type
hostname event.idm.read_only_udm.principal.hostname 和 event.idm.read_only_udm.principal.asset.hostname
description event.idm.read_only_udm.metadata.description
application event.idm.read_only_udm.principal.application
userName event.idm.read_only_udm.target.user.userid
intermediary_host event.idm.read_only_udm.intermediary.ip
target_mac event.idm.read_only_udm.target.mac
target_mac event.idm.read_only_udm.target.asset.mac
fqdn event.idm.read_only_udm.principal.hostname 和 event.idm.read_only_udm.principal.asset.hostname
sec_action event.idm.read_only_udm.security_result.action
session_packet event.idm.read_only_udm.network.sent_bytes
missed_packets event.idm.read_only_udm.additional.fields
inter_host event.idm.read_only_udm.intermediary.ip
target_host event.idm.read_only_udm.intermediary.ip
inter_host event.idm.read_only_udm.intermediary.hostname
tls_cipher network.tls.cipher
tls_client network.tls.client.supported_ciphers
Chassis_data additional.fields
extensions.auth.type AUTHTYPE_UNSPECIFIED
client_mac principal.mac
sequence_id","vap", "band", "channel", "rssi", "aid" and "radio additional.fields

變更記錄

查看這個剖析器的變更記錄

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求解答。