收集 F5 ASM 記錄

剖析器版本：33.0

支援語言：

本文說明如何使用 Bindplane 代理程式，將 F5 Application Security Manager (ASM) 記錄擷取至 Google Security Operations。

F5 BIG-IP ASM 是一種網頁應用程式防火牆 (WAF)，可針對 HTTP 要求違規、政策強制執行動作和安全性事件產生系統記錄訊息。剖析器支援多種記錄格式 (CEF、syslog、CSV、Splunk、JSON)，並將這些格式對應至統合式資料模型 (UDM)。

事前準備

請確認您已完成下列事前準備事項：

  • Google SecOps 執行個體
  • Windows Server 2016 以上版本，或搭載 systemd 的 Linux 主機
  • Bindplane 代理程式與 F5 BIG-IP 設備之間的網路連線
  • 如果透過 Proxy 執行，請確保防火牆通訊埠已根據 Bindplane 代理程式需求開啟
  • F5 BIG-IP tmsh 的特殊存取權

取得 Google SecOps 擷取驗證檔案

  1. 登入 Google SecOps 控制台。
  2. 依序前往「SIEM 設定」>「收集代理程式」。
  3. 下載擷取驗證檔案。

  4. 將檔案安全地儲存在要安裝 Bindplane 代理程式的系統上。

取得 Google SecOps 客戶 ID

  1. 登入 Google SecOps 控制台。
  2. 依序前往「SIEM 設定」>「設定檔」。

  3. 複製並儲存「機構詳細資料」部分中的客戶 ID。

安裝 Bindplane 代理程式

請按照下列操作說明，在 Windows 或 Linux 作業系統上安裝 Bindplane 代理程式。

Windows 安裝

  1. 以管理員身分開啟「命令提示字元」或「PowerShell」。

  2. 執行下列指令：

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. 等待安裝完成。

  4. 執行下列指令，確認安裝成功：

    sc query observiq-otel-collector

    服務應顯示為「RUNNING」(執行中)。

Linux 安裝

  1. 開啟具有根層級或 sudo 權限的終端機。

  2. 執行下列指令：

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. 等待安裝完成。

  4. 執行下列指令，確認安裝成功：

    sudo systemctl status observiq-otel-collector

    服務應顯示為有效 (執行中)。

其他安裝資源

如需其他安裝選項和疑難排解資訊，請參閱 Bindplane 代理程式安裝指南。

設定 Bindplane 代理程式，擷取系統記錄檔並傳送至 Google SecOps

找出設定檔

  • Linux：

    sudo nano /etc/bindplane-agent/config.yaml

  • Windows：

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

編輯設定檔

  • 將 config.yaml 的全部內容替換為下列設定：

    receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/f5_asm:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: F5_ASM
        raw_log_field: body

service:
    pipelines:
        logs/f5_asm_to_chronicle:
            receivers:
                - udplog
            exporters:
                - chronicle/f5_asm

設定參數

替換下列預留位置：

  • 接收器設定：

    • listen_address：要接聽的 IP 位址和通訊埠：
      • 0.0.0.0，監聽所有介面 (建議)
      • 通訊埠 514 是標準的系統記錄通訊埠 (在 Linux 上需要根層級權限；非根層級權限請使用 1514)

  • 匯出工具設定：

    • creds_file_path：擷取驗證檔案的完整路徑：
      • Linux：/etc/bindplane-agent/ingestion-auth.json
      • Windows：C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
    • customer_id：從 Google SecOps 控制台複製的客戶 ID
    • endpoint：區域端點網址：
      • 美國：malachiteingestion-pa.googleapis.com
      • 歐洲：europe-malachiteingestion-pa.googleapis.com
      • 亞洲：asia-southeast1-malachiteingestion-pa.googleapis.com
      • 如需完整清單，請參閱「區域端點」

儲存設定檔

  • 編輯完成後，請儲存檔案：
    • Linux：依序按下 Ctrl+O、Enter 和 Ctrl+X
    • Windows：依序點選「檔案」>「儲存」

重新啟動 Bindplane 代理程式，以套用變更

  • 如要在 Linux 中重新啟動 Bindplane 代理程式，請執行下列指令：

    sudo systemctl restart observiq-otel-collector

    1. 確認服務正在執行：

      sudo systemctl status observiq-otel-collector

    2. 檢查記錄中是否有錯誤：

      sudo journalctl -u observiq-otel-collector -f

  • 如要在 Windows 中重新啟動 Bindplane 代理程式，請選擇下列其中一個選項：

    • 以管理員身分開啟命令提示字元或 PowerShell：

      net stop observiq-otel-collector && net start observiq-otel-collector

    • 服務控制台：

      1. 按下 Win+R，輸入 services.msc，然後按下 Enter 鍵。
      2. 找出 observIQ OpenTelemetry Collector。
      3. 按一下滑鼠右鍵，然後選取「重新啟動」。

      4. 確認服務正在執行：

        sc query observiq-otel-collector

      5. 檢查記錄中是否有錯誤：

        type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

在 F5 ASM 中設定系統記錄檔

  1. 輸入下列指令，登入 tmsh 執行個體：

    tmsh

  2. 使用下列指令編輯系統記錄設定：

    edit /sys syslog all-properties

  3. 系統會在 vi 文字編輯器中開啟 Syslog 設定，畫面與下列範例類似：

    modify syslog {
    auth-priv-from notice
    auth-priv-to emerg
    cron-from warning
    cron-to emerg
    daemon-from notice
    daemon-to emerg
    description none
    include none
    iso-date disabled
    kern-from notice
    kern-to emerg
    mail-from notice
    mail-to emerg
    messages-from notice
    messages-to warning
    remote-servers none
    user-log-from notice
    user-log-to emerg
}

  4. 將 include none 行替換為下列系統記錄篩選器：

    include `
    filter f_audit{
        match(AUDIT);
    };
    destination d_syslog_server {
        udp(\`<bindplane-ip>\` port (<bindplane-port>));
    };
    log {
        source(s_syslog_pipe);
        filter(f_audit);
        destination(d_syslog_server);
    };
`

  5. 請將 <bindplane-ip> 和 <bindplane-port> 替換為為 Bindplane 代理程式設定的實際 IP 位址和通訊埠編號。

  6. 輸入下列鍵序列即可退出 vi：

    :wq!

  7. 在下列提示中輸入 y，將變更儲存至檔案：

    Save changes? (y/n/e)

  8. 輸入下列指令，儲存設定：

    save /sys config

UDM 對應表

欄位名稱 UDM
/BAD_MSG/request-violations/violation[n]/actual_value_length security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_name security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_pattern security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_value security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/blocking_mask security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/buffer security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/length security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/offset security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/expected_value_length security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/extension security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/flg_disallowed_file_type security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_name security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_value security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sanity_checks_status security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation_status security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_code security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_violation_details security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/enforcement_level security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/name security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/value security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/post_len security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/query_len security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len_limit security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/blocking_mask security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/buffer security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/length security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/offset security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/sig_id security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/specific_desc security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len_limit security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len_limit security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/value_length_type security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/wildcard_entity security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/cfg_target security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/leakage_type security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/pattern_type security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/response_code security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_index security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_name security_result.detection_fields
/BAD_MSG/violation_masks/alarm security_result.detection_fields
/BAD_MSG/violation_masks/block security_result.detection_fields
/BAD_MSG/violation_masks/learn security_result.detection_fields
/BAD_MSG/violation_masks/staging security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/accessCode security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/companyId security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/txnPin security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/user security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
/s-Envelope/s-Body/processTransaction/accessCode security_result.detection_fields
/s-Envelope/s-Body/processTransaction/companyId security_result.detection_fields
/s-Envelope/s-Body/processTransaction/txnPin security_result.detection_fields
/s-Envelope/s-Body/processTransaction/user security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/accessCode security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/companyId security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/txnPin security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/user security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/accessCode security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/companyId security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/txnPin security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/user security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/accessCode security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/companyId security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/txnPin security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/user security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/accessCode security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/companyId security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/txnPin security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/user security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/accessCode security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/companyId security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/txnPin security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/user security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/accessCode security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/companyId security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/txnPin security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/user security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/accessCode security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/companyId security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/txnPin security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/user security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/companyId security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/user security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/accessCode security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/companyId security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/txnPin security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/user security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/user security_result.detection_fields
_csrfToken security_result.detection_fields
Accept additional.fields
accept additional.fields
Accept-Charset additional.fields
Accept-Encoding additional.fields
accept-encoding additional.fields
acceptEncoding security_result.detection_fields
Accept-Language additional.fields
accept-language additional.fields
acceptLanguage security_result.detection_fields
Access-Control-Request-Headers security_result.detection_fields
Access-Control-Request-Method network.http.method
AccountSid target.resource.product_object_id
AccountType target.user.attribute.roles.description
act security_result.action
security_result.action_details
act1 security_result.action
Action additional.fields
action security_result.action
security_result.action_details
action_summary security_result.detection_fields
additional_bot_signatures security_result.detection_fields
actual_mitigation_action security_result.detection_fields
actual_mitigation_action_reason security_result.detection_fields
alert_level security_result.severity
anomalies additional.fields
anomaly_categories additional.fields
apache_module security_result.detection_fields
ApiVersion security_result.detection_fields
App-Name target.application
Application target.application
Application-Type security_result.detection_fields
application_display_name additional.fields
application_version security_result.detection_fields
appID security_result.detection_fields
app_protocol network.application_protocol
app-version security_result.detection_fields
attack_type metadata.description
attacktype security_result.category_details
audit_component additional.fields
auth principal.user.userid
authCode security_result.detection_fields
auth_level principal.user.attribute.roles.name
auth_status security_result.action
security_result.summary
batchKey security_result.detection_fields
batchNo security_result.detection_fields
BEAuthenticator security_result.detection_fields
bigip_mgmt_ip intermediary.ip
bigip_mgmt_ip2 intermediary.ip
bill.isRecurring security_result.detection_fields
bill.productId security_result.detection_fields
blocking_exception_reason security_result.detection_fields
bot_name additional.fields
bot_signature additional.fields
bot_signature_category additional.fields
browser_actual_verification_action additional.fields
browser_configured_verification_action additional.fields
browser_verification_status security_result.detection_fields
bundle-version additional.fields
bytes_in network.received_bytes
bytes_out network.sent_bytes
c6a1 intermediary.ip
條件：
[c6a1Label] == "device_address"
c6a2 principal.ip
principal.asset.ip
條件：
[c6a2Label] == "source_address"
c6a3 target.ip
target.asset.ip
條件：
[c6a3Label] == "destination_address"
c6a4 security_result.about.ip
security_result.about.asset.ip
條件：
[c6a4Label] == "ip_address_intelligence"
Cache-Control additional.fields
captcha_result security_result.detection_fields
captcha_status security_result.detection_fields
category security_result.category_details
cdn-loop security_result.detection_fields
CF-Connecting-IP principal.ip
principal.asset.ip
cf-cert-presented principal.asset.attribute.labels
cf-cert-revoked principal.asset.attribute.labels
cf-cert-verified principal.asset.attribute.labels
cf-ipcity principal.location.city
CF-IPCountry principal.location.country_or_region
cf-ipcountry principal.location.country_or_region
cf-ipcontinent principal.asset.attribute.labels
cf-iplatitude principal.location.region_coordinates.latitude
cf-iplongitude principal.location.region_coordinates.longitude
cf-ipmetro-code principal.asset.attribute.labels
cf-ipostal-code principal.asset.attribute.labels
cf-iregion principal.location.state
cf-iregion-code principal.asset.attribute.labels
cf-itimezone principal.asset.attribute.labels
cf-ray principal.asset.attribute.labels
CF-Visitor security_result.detection_fields
CF-Visitor.scheme principal.asset.attribute.labels
challenge_failure_reason additional.fields
Channel security_result.detection_fields
channel security_result.detection_fields
Check-Id additional.fields
childTableRef security_result.detection_fields
CIPHER network.tls.cipher
city principal.location.city
class additional.fields
classification_reason security_result.detection_fields
clearGadgetId security_result.detection_fields
client-request-id additional.fields
client_id security_result.detection_fields
client_ip principal.ip
client_ip_geo_location principal.location.country_or_region
client_port principal.port
client_request_uri target.url
client_type additional.fields
Client-Version security_result.detection_fields
cmd_data principal.process.command_line
cn2 and cn2label security_result.detection_fields
cn3 principal.asset_id
條件：
[cn3Label] == "device_id"
其他情況：
security_result.detection_fields
cn4 and cn4label additional.fields
條件：
[cs4label] == "whitelistData"
cn5 and cn5label additional.fields
collected_time metadata.collected_timestamp
component additional.fields
COMPRESSION security_result.detection_fields
configured_mitigation_action security_result.detection_fields
configured_mitigation_action_reason security_result.detection_fields
configuration_date_time security_result.detection_fields
Connection additional.fields
connection additional.fields
contactNo principal.user.phone_numbers
Content-Length additional.fields
content-length additional.fields
Content-Type additional.fields
content-type additional.fields
context_name additional.fields
context_type additional.fields
contextPath security_result.detection_fields
Correlation-Id security_result.detection_fields
country principal.location.country_or_region
cs1 security_result.rule_id
cs2 security_result.summary
條件：
[cs2Label] == "reason"
其他情況：
security_result.detection_fields
cs3 security_result.detection_fields
cs4 and cs4label additional.fields
cs5 principal.ip
principal.asset.ip
currency security_result.detection_fields
currency_type security_result.detection_fields
current_monitor_state_1 security_result.detection_fields
current_monitor_state_2 security_result.detection_fields
currentFormName security_result.detection_fields
custMobile security_result.detection_fields
data.bits network.sent_bytes
data.name network.tls.cipher
data.sessionid network.session_id
data.version network.tls.version
data_mwh_requestId security_result.detection_fields
data_renegotiation security_result.detection_fields
datosReto security_result.detection_fields
DATE metadata.event_timestamp
date_time metadata.event_timestamp
dependentInfo.DependentRel2Name security_result.detection_fields
dependentInfo.MasterObjectId security_result.detection_fields
dependentInfo.MasterObjectTableRef security_result.detection_fields
dependentInfo.RelationshipTag security_result.detection_fields
desc security_result.description
description metadata.description
DEST_IP target.ip
dest_ip target.ip
DEST_PORT target.port
dest_port target.port
DeviceBrand principal.asset.hardware.manufacturer (僅接受字串)
principal.asset.attribute.labels (當 DeviceBrand 包含整數而非字串時使用)
device.app_signature principal.asset.attribute.labels
device.app_version principal.asset.platform_software.platform_version
device_blade intermediary.asset.attribute.labels
device.build_number principal.asset.attribute.labels
device.device_id principal.asset_id
device_id principal.asset_id
device_id_action security_result.detection_fields
device_id_status security_result.detection_fields
device.manufacturer principal.asset.hardware.manufacturer
DeviceModel principal.asset.hardware.model
device.model principal.asset.hardware.model
DeviceName principal.asset.attribute.labels
DeviceOsFamily principal.asset.platform_software.platform
device.os_version principal.platform_version
DeviceOsVersion principal.platform_version
device.platform principal.asset.platform_software.platform
device_product additional.fields
device.sdk_int principal.asset.attribute.labels
DeviceScreenDensity principal.asset.attribute.labels
DeviceScreenH principal.asset.attribute.labels
DeviceScreenW principal.asset.attribute.labels
DeviceSerial principal.asset.hardware.serial_number
deviceSerialNo principal.asset.hardware.serial_number
DeviceUnique principal.asset.product_object_id
DeviceVendorId principal.asset.attribute.labels
device_version metadata.product_version
dimensioneLista security_result.detection_fields
DNT security_result.detection_fields
dos_attack_detection_mode security_result.detection_fields
dos_attack_event security_result.detection_fields
dos_attack_id security_result.detection_fields
dos_attack_latency security_result.detection_fields
dos_attack_name security_result.detection_fields
dos_attack_tps security_result.detection_fields
dos_baseline_latency additional.fields
dos_baseline_tps additional.fields
dos_dropped_requests_count additional.fields
dos_incoming_requests_count additional.fields
dos_mitigation_action security_result.detection_fields
dos_mitigation_reason security_result.detection_fields
dpt target.port
dhost target.hostname
dst target.ip
dvc intermediary.ip
dvchost intermediary.hostname
ECID-Context security_result.detection_fields
EE_I_ConsultaListadoProcesosCRM.codigoEntidad security_result.detection_fields
EE_I_VerificacionBeneficiario.codigoEntidad security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanBeneficiario security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanOrdenante security_result.detection_fields
EE_I_VerificacionBeneficiario.nombreBeneficiario security_result.detection_fields
email principal.user.email_addresses
end additional.fields
enforced_by additional.fields
environment security_result.detection_fields
errorcode security_result.action
security_result.rule_id
error_message security_result.summary
errdefs_msg_name additional.fields
errdefs_msgno additional.fields
eventId security_result.detection_fields
event_time metadata.event_timestamp
expected_state security_result.detection_fields
expDate security_result.detection_fields
expires_in security_result.detection_fields
externalId additional.fields
f5_action security_result.action
f5_file security_result.detection_fields
f5_http_method network.http.method
f5_id security_result.rule_id
f5_line security_result.detection_fields
f5_name additional.fields
f5_path security_result.detection_fields
f5_rev security_result.rule_version
f5_rule_accuracy security_result.detection_fields
f5_rule_maturity security_result.detection_fields
f5_rule_version security_result.detection_fields
f5_signature security_result.rule_name
f5_sig_two security_result.threat_id
f5_tag security_result.detection_fields
f5_unique_id network.session_id
f5_uri target.url
f5_waf_msg security_result.summary
facility additional.fields
family_name principal.user.last_name
Fixed-Device-Id security_result.detection_fields
flavor security_result.detection_fields
folder principal.file.full_path
form_data additional.fields
From principal.user.phone_numbers
fragment security_result.detection_fields
geo_info security_result.detection_fields
geo_location principal.location.country_or_region
given_name principal.user.first_name
grant_type security_result.detection_fields
hashing_cf security_result.detection_fields
hashingCF security_result.detection_fields
headless_signatures security_result.detection_fields
header-one additional.fields
Host target.hostname
target.asset.hostname
Hostname principal.hostname
http_class_name security_result.detection_fields
http_method network.http.method
http_protocol_indication network.application_protocol
http_request network.http.referral_url
http_version network.application_protocol_version
human_behaviour security_result.detection_fields
id additional.fields
idApp target.resource.product_object_id
identificativointermediariopa security_result.detection_fields
identificativoStazioneIntermediarioPA security_result.detection_fields
idExterno security_result.detection_fields
idReto security_result.detection_fields
id_token security_result.detection_fields
I-Twilio-Idempotency-Token security_result.detection_fields
If-Modified-Since security_result.detection_fields
ifModifiedSince security_result.detection_fields
If-None-Match security_result.detection_fields
ifNoneMatch security_result.detection_fields
Image target.file.full_path
imei security_result.detection_fields
incap-client-ip principal.ip
principal.asset.ip
inquiretransaction_accessCode security_result.detection_fields
inquiretransaction_companyId security_result.detection_fields
inquiretransaction_txnPin security_result.detection_fields
inquiretransaction_user security_result.detection_fields
internal_timestamp metadata.event_timestamp
intermediary_Ip intermediary.ip
intermediary_port intermediary.port
invoiceNo security_result.detection_fields
ip security_result.about.ip
IP_ADDRESS principal.ip
principal.asset.ip
ip_addr_int security_result.detection_fields
ip_addr_intelli security_result.detection_fields
IP_CLIENT principal.ip
ip_client principal.ip
IpIntelligenceCategory additional.fields
ip_route_domain principal.ip
principal.asset.ip
Ipv4AddressIntelligence additional.fields
irule security_result.rule_name
irule-version security_result.rule_version
isDccTransaction security_result.detection_fields
isDebugConnected security_result.detection_fields
isDebuggable security_result.detection_fields
isHooked security_result.detection_fields
isRunningInEmulator security_result.detection_fields
isSignedWithDebugKey security_result.detection_fields
isTamperedApk security_result.detection_fields
is_trunct security_result.detection_fields
isWrongCert security_result.detection_fields
jailbroken_or_rooted_device security_result.detection_fields
Keep-Alive additional.fields
lat security_result.detection_fields
lbCookie security_result.detection_fields
level security_result.severity
link target.url
listener security_result.detection_fields
lng security_result.detection_fields
Locale security_result.detection_fields
log_event security_result.detection_fields
manage_ip_addr intermediary.ip
management_ip_address intermediary.ip
management_ip_address_2 intermediary.ip
max_amount security_result.detection_fields
member_with_port security_result.detection_fields
MessageSid security_result.detection_fields
MessageStatus security_result.detection_fields
meta_data.object_type security_result.detection_fields
METHOD network.http.method
method network.http.method
micro_service_hostname additional.fields
micro_service_matched_wildcard_url additional.fields
micro_service_name additional.fields
micro_service_type additional.fields
microservice additional.fields
min_amount security_result.detection_fields
mobile_application_name security_result.detection_fields
mobile_application_version security_result.detection_fields
mobile_debugger_enabled_device security_result.detection_fields
mobile_in_emulation_mode security_result.detection_fields
mobile_is_app additional.fields
mock security_result.detection_fields
model principal.asset.hardware.model
module security_result.detection_fields
monitor_details security_result.detection_fields
monitor_status security_result.detection_fields
monitor_type_1 security_result.detection_fields
monitor_type_2 security_result.detection_fields
msg security_result.summary
msgg security_result.description
msg_type security_result.detection_fields
Name principal.user.user_display_name
nativeDeviceId principal.asset.product_object_id
net.host.ip principal.ip
principal.asset.ip
net.host.name principal.hostname
principal.asset.hostname
net.host.port principal.port
net.peer.ip principal.ip
principal.asset.ip
net.peer.name target.hostname
target.asset.hostname
net.peer.port target.port
net.transport network.ip_protocol
network_http_method network.http.method
new_request_status additional.fields
nickname security_result.detection_fields
nii security_result.detection_fields
nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
num_of_attempts additional.fields
num_trans security_result.detection_fields
oauth_server security_result.detection_fields
Ocp-Apim-Subscription-Key security_result.detection_fields
ODJFS-AUTH-TOKEN security_result.detection_fields
Opcode security_result.severity
Origin additional.fields
origin additional.fields
originId security_result.detection_fields
os principal.asset.platform_software.platform
Os-Version principal.platform_version
os_name security_result.detection_fields
packageName security_result.detection_fields
partition additional.fields
partition_name intermediary.asset.attribute.labels
path target.url
pathContext target.application
paymentMode security_result.detection_fields
phost security_result.detection_fields
pideUsuario security_result.detection_fields
platform principal.asset.platform_software.platform
POLICY security_result.rule_name
policy security_result.rule_name
policy_apply_date security_result.detection_fields
policy_name security_result.rule_name
pool security_result.detection_fields
pool_name security_result.detection_fields
postalCode principal.asset.attribute.labels
post_len security_result.detection_fields
Pragma additional.fields
pragma additional.fields
previous_action additional.fields
previous_initiated_action security_result.detection_fields
previous_initiated_action_status security_result.detection_fields
previous_request_date_time security_result.detection_fields
previous_state security_result.detection_fields
previous_support_id security_result.detection_fields
principal_data.hostname principal.hostname
principal.asset.hostname
principal_data.ip principal.ip
principal.asset.ip
principal_ipv6 principal.ip
principal.asset.ip
principal_mail principal.user.email_addresses
Priority additional.fields
priority additional.fields
priority_value additional.fields
process target.application
process_id principal.process.pid
processtransaction_accessCode security_result.detection_fields
processtransaction_companyId security_result.detection_fields
processtransaction_txnPin security_result.detection_fields
processtransaction_user security_result.detection_fields
product_name security_result.rule_type
prod_id metadata.product_log_id
properties.branch target.resource.attribute.labels
properties.build target.resource.attribute.labels
properties.commit target.resource.attribute.labels
properties.deployment-environment target.resource.attribute.labels
properties.issueId target.resource.attribute.labels
properties.issueMatchesProjectContext target.resource.attribute.labels
properties.projectId target.resource.attribute.labels
properties.projectType target.resource.attribute.labels
properties.pullrequest target.resource.attribute.labels
properties.review target.resource.attribute.labels
properties.timeDelta target.resource.attribute.labels
PROTO network.application_protocol
protocol network.application_protocol
ProviderGuid target.resource.id
Proxy-Authorization security_result.detection_fields
Proxy-Connection security_result.detection_fields
proxy_errorcode security_result.detection_fields
proxy_id security_result.rule_id
proxy_message security_result.detection_fields
pushNotificationEnabled security_result.detection_fields
Qualys-Scan security_result.detection_fields
QUERY_STR additional.fields
query security_result.detection_fields
query_string additional.fields
query_str security_result.detection_fields
QUOTEDATA security_result.detection_fields
rangeDa security_result.detection_fields
rating security_result.severity_details
RawDlrDoneDate security_result.detection_fields
rawrequest target.url
received_bytes network.received_bytes
received_state security_result.detection_fields
Referer network.http.referral_url
referer network.http.referral_url
referrer network.http.referral_url
registerDevice security_result.detection_fields
related_pid additional.fields
remote_request_ip principal.ip
principal.asset.ip
reputation security_result.detection_fields
REQ additional.fields
REQ_STATUS security_result.action
req_status security_result.action
security_result.action_details
security_result.detection_fields
req_status_value security_result.action
security_result.action_details
request target.url
request_body_size additional.fields
Request-Context security_result.detection_fields
request_date_time security_result.detection_fields
Request-Id security_result.detection_fields
request_id additional.fields
requestClientApplication network.http.user_agent
network.http.parsed_user_agent
requestMethod network.http.method
request_status security_result.action
security_result.action_details
request_side security_result.detection_fields
resource_name target.resource.name
RESP_CODE network.http.response_code
resp security_result.detection_fields
resp_code network.http.response_code
response security_result.summary
response_code network.http.response_code
riskIT.deviceSignature.browser.userAgent network.http.user_agent
network.http.parsed_user_agent
riskIT.deviceSignature.camera.autoFocus principal.asset.attribute.labels
riskIT.deviceSignature.camera.flash principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCamera principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedFormats principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedSizes principal.asset.attribute.labels
riskIT.deviceSignature.camera.numberOfCameras principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCamera principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedFormats principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedSizes principal.asset.attribute.labels
riskIT.deviceSignature.collector principal.asset.attribute.labels
riskIT.deviceSignature.collectorVersion principal.asset.attribute.labels
riskIT.deviceSignature.extra.account principal.asset.attribute.labels
riskIT.deviceSignature.extra.securityPolicy principal.asset.attribute.labels
riskIT.deviceSignature.location.latitude principal.location.region_coordinates.latitude
riskIT.deviceSignature.location.longitude principal.location.region_coordinates.longitude
riskIT.deviceSignature.screen.displayId principal.asset.attribute.labels
riskIT.deviceSignature.screen.height principal.asset.attribute.labels
riskIT.deviceSignature.screen.orientation principal.asset.attribute.labels
riskIT.deviceSignature.screen.width principal.asset.attribute.labels
riskIT.deviceSignature.system.androidId principal.asset.attribute.labels
riskIT.deviceSignature.system.board principal.asset.attribute.labels
riskIT.deviceSignature.system.brand principal.asset.hardware.manufacturer
riskIT.deviceSignature.system.cpuAbi principal.asset.hardware.cpu_platform
riskIT.deviceSignature.system.debuggerAttached principal.asset.attribute.labels
riskIT.deviceSignature.system.deviceName principal.asset.attribute.labels
riskIT.deviceSignature.system.hardware principal.asset.attribute.labels
riskIT.deviceSignature.system.host principal.asset.attribute.labels
riskIT.deviceSignature.system.id principal.asset.attribute.labels
riskIT.deviceSignature.system.jailBroken principal.asset.attribute.labels
riskIT.deviceSignature.system.locale principal.asset.attribute.labels
riskIT.deviceSignature.system.model principal.asset.hardware.model
riskIT.deviceSignature.system.numberOfProcessors principal.asset.hardware.cpu_number_cores
riskIT.deviceSignature.system.osVersion principal.platform_version
riskIT.deviceSignature.system.platform principal.asset.platform_software.platform
riskIT.deviceSignature.system.processName principal.asset.attribute.labels
riskIT.deviceSignature.system.radio principal.asset.attribute.labels
riskIT.deviceSignature.system.tags principal.asset.attribute.labels
riskIT.deviceSignature.system.timeZone principal.asset.attribute.labels
riskIT.deviceSignature.system.totalDiskSpace principal.asset.attribute.labels
riskIT.deviceSignature.system.totalMemory principal.asset.hardware.ram
riskIT.deviceSignature.system.type principal.asset.attribute.labels
riskIT.deviceSignature.system.user principal.user.userid
riskIT.deviceSignature.telephony.carrierIsoCountryCode principal.location.country_or_region
riskIT.deviceSignature.telephony.carrierMobileCountryCode principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierMobileNetworkCode principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierName principal.network.carrier_name
riskIT.deviceSignature.telephony.cellIpAddress principal.ip
principal.asset.ip
riskIT.deviceSignature.telephony.isRoamingNetwork principal.asset.attribute.labels
riskIT.deviceSignature.telephony.networkType principal.asset.attribute.labels
riskIT.deviceSignature.telephony.phoneType principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simIsoCountryCode principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simOperatorName principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simSerialNumber principal.asset.attribute.labels
riskIT.deviceSignature.wifi.broadcastAddress principal.asset.attribute.labels
riskIT.deviceSignature.wifi.connected principal.asset.attribute.labels
riskIT.deviceSignature.wifi.gatewayAddress principal.asset.attribute.labels
riskIT.deviceSignature.wifi.macAddress principal.mac
principal.asset.mac
riskIT.deviceSignature.wifi.netmaskAddress principal.asset.attribute.labels
riskIT.deviceSignature.wifi.userEnabled principal.asset.attribute.labels
riskIT.ipAddress principal.ip
principal.asset.ip
rrn security_result.detection_fields
RS_VISITOR_ID security_result.detection_fields
rt metadata.event_timestamp
rule_name security_result.rule_name
rule_summary security_result.summary
rule_version metadata.product_version
save_payee security_result.detection_fields
schedule_frequency security_result.detection_fields
schedule_occurrence security_result.detection_fields
scope_details additional.fields
sec-ch-ua security_result.detection_fields
sec-ch-ua-mobile additional.fields
sec-ch-ua-platform principal.asset.platform_software.platform
sec-fetch-dest additional.fields
Sec-Fetch-Dest additional.fields
sec-fetch-mode additional.fields
Sec-Fetch-Mode additional.fields
sec-fetch-site additional.fields
Sec-Fetch-Site additional.fields
Sec-Fetch-Storage-Access security_result.detection_fields
sec-fetch-user additional.fields
Sec-Fetch-User additional.fields
Sec-Fetch-User additional.fields
sequence_id additional.fields
server_ip target.ip
server_port target.port
service_id target.resource.product_object_id
SESS_ID network.session_id
session_id network.session_id
session_status security_result.detection_fields
sessionDataId security_result.detection_fields
sessionDataKey security_result.detection_fields
Set-Cookie security_result.detection_fields
set_cookie security_result.detection_fields
severity security_result.severity
severity_number security_result.severity
sg_event_id security_result.detection_fields
sg_message_id security_result.detection_fields
sg_template_id security_result.detection_fields
sg_template_name security_result.detection_fields
Shield security_result.detection_fields
signature security_result.detection_fields
SIG_IDS security_result.rule_id
sig_cves security_result.detection_fields
sig_ids security_result.detection_fields
SIG_NAMES security_result.rule_name
條件：
[policy_name] == ""
SmsSid security_result.detection_fields
SmsStatus security_result.detection_fields
snat_ip principal.nat_ip
snat_port principal.nat_port
SOAPAction additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/accessCode security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/companyId security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/txnPin security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/user security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/accessCode security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/companyId security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnData additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnPin security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/user security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/accessCode security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/companyId security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/txnPin security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/user security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/accessCode security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/companyId security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/txnPin security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/user security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/accessCode security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/companyId security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/txnPin security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/user security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/accessCode security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/companyId security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/txnPin security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/user security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/accessCode security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/companyId security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/txnPin security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/user security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/accessCode security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/companyId security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/txnPin security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/user security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/accessCode security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/companyId security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/txnPin security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/user security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/companyId security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/user security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/accessCode security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/companyId security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/txnPin security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/user security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/user security_result.detection_fields
sort_order security_result.detection_fields
SourceModuleName target.resource.name
SourceModuleType observer.application
source_host principal.hostname
principal.asset.hostname
source_ip principal.ip
principal.asset.ip
spt principal.port
src principal.nat_ip
條件：
[src] != [cs5]
SRC_PORT principal.port
src_port principal.port
srcport principal.port
SSL_Client_Cert security_result.detection_fields
ssl_error_code security_result.detection_fields
ssl_routine security_result.detection_fields
staged_sig_cves security_result.detection_fields
staged_sig_ids security_result.detection_fields
staged_sig_names security_result.detection_fields
stagedThreatCampaignNames additional.fields
staged_threat_campaign_names security_result.detection_fields
start additional.fields
start_date security_result.detection_fields
state principal.location.state
status security_result.summary
SUB_VIOLATIONS additional.fields
sub_process additional.fields
sub_violates security_result.summary
sub_violations security_result.detection_fields
suid principal.user.userid
summary security_result.summary
SUPPORT_ID additional.fields
suser principal.user.user_display_name
tap_event_id security_result.detection_fields
tap_vid security_result.detection_fields
target_data.application target.application
target_data.ip target.ip
target.asset.ip
target_url target.url
taxCode security_result.detection_fields
terminalId security_result.detection_fields
threat_campaign_names security_result.detection_fields
thread_id security_result.detection_fields
tls network.tls.version
tls_version network.tls.version
tmm_unit security_result.detection_fields
To target.user.phone_numbers
token security_result.detection_fields
t_port target.port
traceNo security_result.detection_fields
traceparent security_result.detection_fields
Transfer-Encoding security_result.detection_fields
transfer_type security_result.detection_fields
transType security_result.detection_fields
True-Client-IP principal.ip
principal.asset.i
true-client-ip principal.ip
principal.asset.ip
tty additional.fields
TYPE security_result.category
security_result.category_details
type metadata.product_event_type
uniqueId security_result.detection_fields
Upgrade-Insecure-Requests security_result.detection_fields
URI target.url
url principal.url
user principal.user.userid
USER_AGENT network.http.user_agent
network.http.parsed_user_agent
User-Agent network.http.user_agent
network.http.parsed_user_agent
user_display_name principal.user.user_display_name
UserID principal.user.userid
user_id principal.user.userid
user_name principal.user.userid
userName principal.user.email_addresses
user_remarks security_result.detection_fields
user_type principal.asset.attribute.labels
usuarioBE security_result.detection_fields
uuid security_result.detection_fields
validateaccountnumber_accessCode security_result.detection_fields
validateaccountnumber_companyId security_result.detection_fields
validateaccountnumber_txnPin security_result.detection_fields
validateaccountnumber_user security_result.detection_fields
vAT security_result.detection_fields
verb network.http.method
versionCode security_result.detection_fields
versionName security_result.detection_fields
VFPJSESSION security_result.detection_fields
Via security_result.detection_fields
VIP security_result.detection_fields
VIRTUAL network.tls.client.server_name
VIRTUAL_address target.resource.name
virtual_server_name network.tls.client.server_name
virtualserver network.tls.client.server_name
violation_mask_alarm security_result.detection_fields
violation_mask_block security_result.detection_fields
violation_mask_learn security_result.detection_fields
violation_mask_staging security_result.detection_fields
violation_rating security_result.detection_fields
violations security_result.description
virus_name security_result.threat_name
vs_ip intermediary.ip
vs_name target.resource.name
vs_port intermediary.port
web_application_name target.application
websocket_direction network.direction = Inbound
條件：
(如為 [websocket_direction] == "clientToServer")
network.direction = OUTBOUND
條件：
(如為 [websocket_direction] == "ServerToclient")
websocket_message_type security_result.detection_fields
wm_client_ip principal.ip
principal.asset.ip
WORKIDENTIFIER security_result.detection_fields
wtfpc security_result.detection_fields
X-Amzn-Trace-Id security_result.detection_fields
X-Bug-Bounty security_result.detection_fields
X-Bug-Bounty-Contact security_result.detection_fields
X-Bug-Bounty-Purpose security_result.detection_fields
X-Client-Ip principal.ip
principal.asset.ip
x-codsecent security_result.detection_fields
X-Cnection security_result.detection_fields
X-Correlation-ID security_result.detection_fields
x-correlation-id security_result.detection_fields
x-country-code principal.location.country_or_region
x-dtpc security_result.detection_fields
X-Environment security_result.detection_fields
X-EVENT-TYPE metadata.product_event_type
X-F5-VIP target.ip
target.asset.ip
XFF principal.ip
X-FORWARDED-PORT target.port
X-FORWARDED-PROTO network.application_protocol
X-Forwarded-For principal.ip
principal.asset.ip
X-Forwarded-Proto network.application_protocol
x-forwarded-client-cert security_result.detection_fields
x-fwd-hdr-val security_result.detection_fields
X-header-postpay-addons-uri security_result.detection_fields
X-Home-Region security_result.detection_fields
x-iapp-real-ip principal.ip
principal.asset.ip
X-ma-bid security_result.detection_fields
X-ma-did security_result.detection_fields
X-ma-hostname security_result.detection_fields
X-ma-pid security_result.detection_fields
X-ma-sid security_result.detection_fields
X-MicrosoftAjax security_result.detection_fields
x-msisdnToken security_result.detection_fields
X-msisdnToken security_result.detection_fields
X-OAUTH-IDENTITY-DOMAIN-NAME security_result.detection_fields
X-ORIGINAL-HOST principal.hostname
X-Original-URL principal.url
X-OWA-ActionId additional.fields
X-OWA-ActionName additional.fields
X-OWA-Attempt additional.fields
X-OWA-CANARY additional.fields
X-OWA-ClientBuildVersion security_result.detection_fields
X-OWA-CorrelationId metadata.product_log_id
X-OWA-ExplicitLogonUser principal.user.email_addresses
X-OWA-UrlPostData security_result.detection_fields
X-Requested-With additional.fields
x-request-application metadata.product_event_type
X-ROBOT-AGENT security_result.detection_fields
X-ROBOT-LICENSE security_result.detection_fields
X-ROBOT-MACHINE-ENCODED security_result.detection_fields
X-ROBOT-SERVICE-USERNAME-ENCODED security_result.detection_fields
X-ROBOT-VERSION security_result.detection_fields
X-Remote-Addr principal.ip
principal.asset.ip
x-session security_result.detection_fields
X-Twilio-Email-Event-Webhook-Signature security_result.detection_fields
X-Twilio-Email-Event-Webhook-Timestamp security_result.detection_fields
X-Twilio-Signature security_result.detection_fields
X-UIPATH-INSTALLATION-ID security_result.detection_fields
X-UIPATH-INSTALLATION-VERSION security_result.detection_fields
X-UIPATH-Localization security_result.detection_fields
X-wa-sid security_result.detection_fields
xWpammRequestId security_result.detection_fields
X-XSRF-TOKEN additional.fields
X-xforwarded-client-cert security_result.detection_fields

CSV 記錄

輸入資料欄 目的地欄位 條件
IF [column4] != "asm-policy"
如果 column5 不是有效的 IP
column1 target_ip
column2 target_port
column3 geo_location [column3]不在 ["N/A", ""] 中
column3 target_ip [column3] != "" AND [column3] =~ "^[0-9.]"
column5 event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6 event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6 VIOLATION_DETAILS [column6] =~ ".*xml"
column7 intermediary_Ip [column7] != "" AND GROK %{IP:column7} succeeds
column8 network_http_method 「["GET","POST","PUT","DELETE","PATCH","HEAD","OPTIONS"]」設定了「[column8]」政策
column7 network_http_method ELSE IF [column7] in ["GET","POST", ...]
column9 event.idm.read_only_udm.additional.fields [column9]不在 ["", "N/A"] 中「且」不是時間戳記
column9 policy_apply_date [column9]不在 ["", "N/A"] 中，且為時間戳記
column10 security_result.rule_name ![column10_is_ip] AND [column10] == [column3] AND [column10] != ""
column11 app_protocol [column11] != ""
column13 Varies (KV) [column13] != ""
column14 req_status_value 「["blocked", "allowed", "alerted", "passed"]」設定了「[column14]」政策
column18 request_id [column18] != ""
column19 severity_level [column19] =~ "(?i)(Informational
column22 principal_port [column22] 不在 ["", "N/A"] 中，且 [column22] 為數字
column23 event.idm.read_only_udm.metadata.product_log_id [column23]不在 ["", "N/A"] 中
column25 syslog_host [syslog_host] == "" AND [column25] != ""
column26 event.idm.read_only_udm.network.http.referral_url [column26]不在 ["", "N/A"] 中
column27 VIOLATION_DETAILS [column27] =~ ".*xml"
column28 VIOLATION_DETAILS [column27] !~ ".xml" AND [column28] =~ ".xml"
column28 security_result.description [column27] !~ ".xml" AND [column28] !~ ".xml" AND [column28] not in ["", "N/A"] AND [column28] is NOT numeric
column15 response IF [column27] !~ ".*xml": [column15] != ""
column16 network_http_response_code IF [column27] !~ ".*xml": [column16] not in ["","-"]
column24 session_id IF [column27] !~ ".*xml": [column24] != ""
column29 security_result.summary IF [column27] !~ ".*xml": [column29] != ""
column24 resource_name IF [column27] =~ ".*xml": [column24] != ""
column31 event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
如果第 5 欄是有效的 IP
column1 target_ip
column2 target_port
column3 geo_location 「[column3]」不是有效的 IP
column3 target_ip [column3] != "" AND [column3] is valid IP
column6 principal_ip [column6] != "" AND GROK %{IP:column6} succeeds
column7 event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column7 VIOLATION_DETAILS [column7] =~ ".*xml"
column8 intermediary_Ip [column8] 不在 ["", "N/A"] 中，且 GROK %{IP:column8} 成功
column9 network_http_method 「["GET","POST", ...]」設定了「[column9]」政策
column8 network_http_method ELSE IF [column8] in ["GET","POST", ...]
column9 collected_time [column9] =~ "^[0-9]+"
column22 request_body_size [column22] =~ "^[0-9]+$"
column10 event.idm.read_only_udm.additional.fields [column10]不在 ["", "N/A"] 中「且」不是時間戳記
column10 policy_apply_date [column10]不在 ["", "N/A"] 中，且為時間戳記
column11 security_result.rule_name [column11_is_ip] AND [column11] == [column4] AND [column11] != ""
column4 policy_name ELSE IF [column11] != [column4] AND [column4] != "" AND [column4] is NOT numeric
column4 target_port ELSE IF [column4] 是數字
column12 app_protocol
column13 Varies (KV) [column13] != ""
column15 req_status_value 「["blocked", "allowed", "alerted", "passed"]」設定了「[column15]」政策
column19 request_id
column20 severity_level [column20] =~ "(?i)(Informational
column23 principal_port [column23] 不在 ["", "N/A"] 中，且 [column23] 為數字
column26 syslog_host [syslog_host] == "" AND [column26] != ""
column27 event.idm.read_only_udm.network.http.referral_url [column27]不在 ["", "N/A"] 中
column28 VIOLATION_DETAILS [column28] =~ ".*xml"
column29 VIOLATION_DETAILS [column28] !~ ".xml" AND [column29] =~ ".xml"
column29 security_result.description [column28] !~ ".xml" AND [column29] !~ ".xml" AND [column29] not in ["", "N/A"] AND [column29] is NOT numeric
column16 response IF [column28] !~ ".*xml": [column16] != ""
column17 network_http_response_code IF [column28] !~ ".*xml": [column17] not in ["","-"]
column25 session_id IF [column28] !~ ".*xml": [column25] != ""
column30 security_result.summary IF [column28] !~ ".*xml": [column30] != ""
column25 principal_ip IF [column28] =~ ".*xml": [column25] != "" AND ![column25_is_ip]
column16 network_http_response_code IF [column28] =~ ".*xml": [column25] != "" AND [column16] != ""
column19 severity_level IF [column28] =~ ".*xml": [column25] != "" AND [column19] =~ "(?i)(Informational...)"
column24 session_id IF [column28] =~ ".*xml": [column25] != "" AND [column24] not in ["", "N/A"]
column25 resource_name IF [column28] =~ ".*xml" AND [column25] == "": [column25] != ""
column24 event.idm.read_only_udm.metadata.product_log_id IF [column28] =~ ".*xml" AND [column25] == "": [column24] not in ["", "N/A"]
column32 event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column33 request
column34 response
IF [column4] == "asm-policy"
column1 principal_ip [column1] != "" AND [column1] =~ "^[0-9.]"
column2 principal_port [column2]不在 ["","N/A","none"] 中
column3 principal_ip [column3] != "" AND [column3] =~ "^[0-9.]"
column4 event.idm.read_only_udm.metadata.product_event_type [column4] != ""
column6 principal_ip [column6] != "" AND [column6] is valid IP
column6 req_status_value ELSE IF [column6] in ["blocked", "allowed", ...]
column6 support_id ELSE [column6] != ""
column7 severity_level [column7] =~ "(?i)(Informational...)"
column8 geo_location [column8]不在 ["N/A", ""] 中
column9 VIOLATION_DETAILS [column9] =~ ".*xml"
column9 event.idm.read_only_udm.target.application ELSE IF [column9] != ""
column11 intermediary_Ip GROK %{IP:column11} 成功
column16 target_ip GROK %{IP:column16} 成功
column18 network_http_method [column18]不在 ["","N/A","none"] 中
column24 policy_apply_date
column26 app_protocol
column29 target_url [column29] != "" AND Grok match
column29 Varies (KV) [column29] != "" AND Grok match
column30 req_status_value 「["blocked", "allowed", ...]」設定了「[column30]」政策
column31 security_result.summary
column32 network_http_response_code [column32] != ""
column35 severity
column55 VIOLATION_DETAILS [column55] =~ ".*xml"
column58 VIOLATION_DETAILS [column58] =~ ".*xml"
column60 security_result.description [column60]不在 ["","N/A","none"] 中
column62 event.idm.read_only_udm.target.resource.name
IF ![utf_error] (整個區塊都符合這項條件。如果 [utf_error] 為 true，則會捨棄郵件) IF ![utf_error]
column2 principalIp (在 ![utf_error] 內)
column1 column1 (在 ![utf_error] 內)
「IF [no_ip_address] (Grok on column2 failed)」
column1 date_time
column2 attackType
column3 principalIp
column11 method
column12 url
column13 app_protocol
column10 targetIp
column9 intermediaryIp
column19 rating
column15 req_status
column5 geo_location
column27 VIOLATION_DETAILS 如果 [column27] 類似於 XML 資料
column25 VIOLATION_DETAILS 如果 [column27] 與 XML 資料不相似
「ELSE (of [no_ip_address]) (Grok on column2 succeeded)」
column1 date_time
attack_type attackType
column10 method
column11 url
column12 app_protocol
column9 targetIp
column8 intermediaryIp
column18 rating
column14 req_status
column5 geo_location ![no_ip_address] AND [column5] not in ["N/A", ""]
column17 severity ![no_ip_address] AND [column17] not in ["N/A", ""]
column20 request_id ![no_ip_address] AND [column20] not in ["N/A", ""]
column26 x_forwarded_for ![no_ip_address] AND [column26] not in ["N/A", ""]
column4 dest_port [column3] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
column3 dest_port ELSE (of [column3] ip check)
column15 resp_code 不適用
column16 resp_code IF [column15_not_resp_code]
column17 resp_code IF [column15_not_resp_code] AND [column16_not_resp_code]
attackType attack_type [attackType]不在 ["N/A", ""] 中
intermediaryIp intermediary_Ip [intermediaryIp] != ""
principalIp principal_ip [principalIp] != ""
targetIp target_ip [targetIp] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
resp_code network_http_response_code [resp_code] != ""
dest_port target_port [dest_port] != ""
url target_url [url] != ""
intermediary_Ip intermediary.ip [intermediary_Ip] != ""
ELSE (of ![utf_error])
使用 TAG_UNSUPPORTED 捨棄訊息

發布差異

Google SecOps 發布新版 F5 ASM 剖析器，其中包含 Parser_Name 記錄欄位對應至 UDM 欄位的重大變更，以及事件類型對應的變更。

記錄欄位對應差異

記錄欄位 現有對應 新增
Accept "security_result.about.resource.attribute.label\nsecurity_result.about.labels" additional.fields
Accept-Charset security_result.about.resource.attribute.labels additional.fields
Accept-Encoding "security_result.about.resource.attribute.labels\nsecurity_result.about.labels" additional.fields
Accept-Language security_result.detection_fields additional.fields
Accept-Language "security_result.detection_fields\nsecurity_result.aboit.labels" additional.fields
AccountType target.user.role_description target.user.attribute.roles.description
act security_result.action == ALLOW security_result.action == QUARATINE
action1 security_result.detection_fields security_result.action_details
actual_mitigation_action security_result.detection_fields 已移除「無」值
actual_mitigation_action_reason security_result.detection_fields 已移除「無」值
attack_type intermediary.hostname and security_result.category_details security_result.category_details
Cache-Control security_result.about.resource.attribute.labels additional.fields
Cache-Control security_result.detection_fields additional.fields
cn2 (評分) security_result.severity security_result.detection_fields
Connection "security_result.about.resource.attribute.labels\nsecurity_result.about.labels" additional.fields
Connection security_result.detection_fields additional.fields
Content-Length security_result.about.labels additional.fields
Content-Type security_result.about.labels additional.fields
date_time metadata.event_timestamp 移除多餘的對應項目
descrip metadata.descrption 移除多餘的對應項目
device_id target.asset.id principal.asset.id
device_product security_result.detection_fields additional.fields
dvchost intermediary.ip and intermedairy.asset.ip intermediary.ip
event_id (grok 擷取的值) additional.fields principal.process.pid
Keep-Alive security_result.about.resource.attribute.labels additional.fields
net.host.port principal.port and additional.fields additional.fields
net.peer.name "target.hostname, target.asset.hostname\nadditional.fields" target.hostname
net.peer.port target.port and additional.fields additional.fields
policy_name about.resource.name security_result.rule_name
policy_name security_result.about.resource.name security_result.rule_name
Pragma security_result.about.resource.attribute.labels additional.fields
Pragma security_result.detection_fields additional.fields
rating security_result.severity 移除多餘的對應項目
Reason security_resultsummary and securtiy_result.detetction_fields security_result.detection_fields
resp_code security_result.severity 移除多餘的對應項目
response_code additional.fields and network.http.response_code network.http.response_code
sig_names security_result.rule_name security_result.detection_fields
sub_violations security_result.about.resource.attribute.labels security_result.detection_fields
support_id additional.fields and metadata.product_log_id metadata.product_log_id
SYSLOG headers principal.ip intermediary.ip
uri principal.url and target.url traget.url
violation_rating security_result.about.resource.attribute.labels security_result.detection_fields
X-Forwarded-For security_result.about.resource.attribute.labels principal.ip
XFF intermediary.ip principal.ip
x_forwarded_for_header_value additional.fields principal.ip

其他變更

  • 已移除「不適用」值對應：

    • 系統不會再為 principal.location.country_or_region 對應「不適用」值。
    • 系統不會再為 principal.user.userid 對應「不適用」值。

  • 已移除的直接通訊協定/方向對應：

    • 已移除含有「UDP」的訊息直接對應至 network.ip_protocol 的功能。
    • 已移除含有「HTTPS」的訊息直接對應至 network.application_protocol 的功能。
    • 已移除 network.direction 的靜態設定 INBOUND。
    • 已移除含有「HTTPS/1.1」的訊息與 network.network.tls.version 的直接對應關係。

  • 更新網址對應：

    • 先前，req_host 和 req_uri 已合併對應至 target.url。這項設定已更新，現在只會將 req_uri 對應至 target.url。

  • 已修改動作設定：

    • 已移除將 security_result.action 設為 ALLOW 的動作 (當 "num_of_attempts" 不是空值時)。

  • 已移除靜態 IP 對應：

    • 已移除 dvc_ip 到 0.0.0.0 的靜態對應。
    • 已移除 target_ip 到 0.0.0.0 的靜態對應。

  • 修訂後的 externalid 對應：

    • externalid 的對應現在會填入 additional.fields，且鍵名已從 Support_id 變更為 externalid。

  • 更新嚴重程度對應：

    • 數值 [severity_level] (例如「1」、「2」、「3」) 現在會重新對應至「LOW」。這項功能會將嚴重程度的數字代碼標準化為一致的比例。
    • 「警告」記錄現在會合併並對應至「中」，簡化嚴重程度分類。
    • 嚴重性檢查的順序已調整，優先順序從最嚴重到最輕微依序為：ERROR、CRITICAL、HIGH、MEDIUM、LOW，最後是 INFORMATIONAL。

  • 移除無效值：

    • 已從 principal.url 中移除含有雙引號 (\") 的值。
    • 系統已從 network.http.parsed_user_agent 移除無效值 (以 * 或 $ 開頭的值)。

變更記錄

查看這個剖析器的變更記錄

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求解答。