Pemetaan endpoint API SIEM
Didukung di:
Google SecOps
SIEM
Dokumen ini memetakan endpoint API SIEM lama (Backstory API termasuk Customer Management API, dan Ingestion API) ke endpoint API Chronicle API modern yang sesuai.
Otorisasi dan delegasi partner
Di Chronicle API, Identity and Access Management (IAM) menggantikan kunci dan token API lama untuk kontrol akses. Untuk mengakses instance secara langsung, lakukan autentikasi dengan kredensial OAuth 2.0 untuk akun layanan atau akun utama Workload Identity Federation. Akun utama tersebut harus memiliki peran IAM yang diperlukan dalam project yang menghosting instance.
Untuk partner, otorisasi bergantung pada kepemilikan resource. Project yang menghosting resource menentukan kredensial dan izin IAM yang diperlukan partner. Mencakup operasi tenant ke kredensial yang didelegasikan tenant selaras dengan prinsip keamanan inti bahwa partner tidak boleh dapat mengakses, mengambil, atau mengubah data tenant tanpa izin eksplisit yang diberikan oleh tenant. Tabel berikut membandingkan otorisasi partner di Backstory API lama dan Chronicle API:
| API | Metode | Cakupan resource | Otorisasi |
|---|---|---|---|
| Legacy Backstory API | /v1/partner/customer/* endpoint |
Semua kode pelanggan partner | Partner memanggil endpoint ini secara langsung dengan token partner atau kunci API mereka sendiri. |
Chronicle API: TenantService |
CreateTenant, ListTenants, dan UpdateTenant |
Instance partner: projects/{partner_project}/locations/{location}/instances/{partner_instance}/tenants/* |
Partner memanggil metode ini secara langsung dengan akun layanan atau kredensial mereka sendiri yang memiliki izin chronicle.googleapis.com/tenants.* dalam project partner. |
Chronicle API: layanan lain, seperti InstanceService dan ForwarderService |
GetInstance, UpdateInstance, GenerateForwarderFiles, dan metode lainnya yang tercakup dalam cakupan tenant |
Instance tenant: projects/{tenant_project}/locations/{location}/instances/{tenant_instance}/... |
Kredensial partner saja tidak dapat mengakses atau mengubah data tenant. Administrator tenant harus memberikan peran IAM, seperti roles/chronicle.admin, roles/chronicle.viewer, atau peran khusus, kepada akun layanan partner atau akun utama Workload Identity Federation di project Google Cloud tenant. |
Tabel pemetaan API
| Area fitur | Metode API lama | Versi API lama | Metode Chronicle API | Izin IAM diperlukan | Pemetaan permintaan dan respons yang mendetail |
|---|---|---|---|---|---|
| BigQuery | UpdateBigQueryAccess |
v1 | ProvideBigQueryAccess | chronicle.googleapis.com/bigQueryAccesses.provide |
ProvideBigQueryAccess |
| CuratedRule | ListCuratedRuleDetections |
v2 | LegacySearchCuratedDetections | chronicle.googleapis.com/legacies.legacySearchCuratedDetections |
LegacySearchCuratedDetections |
| CuratedRule | ListCuratedRules |
v2 | ListCuratedRules | chronicle.googleapis.com/curatedRules.list |
ListCuratedRules |
| LegacyAlert | UpdateAlert |
v1 | LegacyUpdateAlert | chronicle.googleapis.com/legacies.legacyUpdateAlert |
LegacyUpdateAlert |
| LegacyAlert | CreateSoarAlert |
v1 | LegacyCreateSoarAlert | chronicle.googleapis.com/legacies.legacyCreateSoarAlert |
LegacyCreateSoarAlert |
| Kasus | CreateOrUpdateCase |
v1 | LegacyCreateOrUpdateCase | chronicle.googleapis.com/legacies.legacyCreateOrUpdateCase |
LegacyCreateOrUpdateCase |
| Ekspor Data | CancelDataExport |
v1 | CancelDataExport | chronicle.googleapis.com/dataExports.cancel |
— |
| Ekspor Data | CreateDataExport |
v1 | CreateDataExport | chronicle.googleapis.com/dataExports.create |
— |
| Ekspor Data | GetDataExport |
v1 | GetDataExport | chronicle.googleapis.com/dataExports.get |
— |
| Ekspor Data | ListAvailableLogTypes |
v1 | FetchLogTypesAvailableForExport | chronicle.googleapis.com/dataExports.fetchAvailableLogTypes |
— |
| DataTap | CreateDataTap |
v1 | CreateDataTap | chronicle.googleapis.com/dataTaps.create |
CreateDataTap |
| DataTap | DeleteDataTap |
v1 | DeleteDataTap | chronicle.googleapis.com/dataTaps.delete |
DeleteDataTap |
| DataTap | GetDataTap |
v1 | GetDataTap | chronicle.googleapis.com/dataTaps.get |
GetDataTap |
| DataTap | ListDataTaps |
v1 | ListDataTaps | chronicle.googleapis.com/dataTaps.list |
ListDataTaps |
| DataTap | UpdateDataTap |
v1 | UpdateDataTap | chronicle.googleapis.com/dataTaps.update |
UpdateDataTap |
| Feed | CreateFeed |
v1 | CreateFeed | chronicle.googleapis.com/feeds.create |
CreateFeed |
| Feed | DeleteFeed |
v1 | DeleteFeed | chronicle.googleapis.com/feeds.delete |
DeleteFeed |
| Feed | DisableFeed |
v1 | DisableFeed | chronicle.googleapis.com/feeds.disable |
DisableFeed |
| Feed | EnableFeed |
v1 | EnableFeed | chronicle.googleapis.com/feeds.enable |
EnableFeed |
| Feed | FetchFeedServiceAccount |
v1 | FetchServiceAccountForCustomer | chronicle.googleapis.com/feedServiceAccounts.fetch |
FetchServiceAccountForCustomer |
| Feed | GetFeed |
v1 | GetFeed | chronicle.googleapis.com/feeds.get |
GetFeed |
| Feed | GetFeedSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| Feed | GetLogTypeSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| Feed | ListFeeds |
v1 | ListFeeds | chronicle.googleapis.com/feeds.list |
ListFeeds |
| Feed | ListFeedSourceTypeSchemas |
v1 | ListFeedSourceTypeSchemas | chronicle.googleapis.com/feedSourceTypeSchemas.list |
ListFeedSourceTypeSchemas |
| Feed | ListLogTypeSchemas |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| Feed | UpdateFeed |
v1 | UpdateFeed | chronicle.googleapis.com/feeds.update |
UpdateFeed |
| Penerus | CreateForwarder |
v2 | CreateForwarder | chronicle.googleapis.com/forwarders.create |
CreateForwarder |
| Penerus | GetForwarder |
v2 | GetForwarder | chronicle.googleapis.com/forwarders.get |
GetForwarder |
| Forwarder | ListForwarders |
v2 | ListForwarders | chronicle.googleapis.com/forwarders.list |
ListForwarders |
| Penerus | UpdateForwarder |
v2 | UpdateForwarder | chronicle.googleapis.com/forwarders.update |
UpdateForwarder |
| Forwarder | DeleteForwarder |
v2 | DeleteForwarder | chronicle.googleapis.com/forwarders.delete |
DeleteForwarder |
| Forwarder | GenerateForwarderFiles |
v2 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
— |
| Penerus | CreateCollector |
v2 | CreateCollector | chronicle.googleapis.com/collectors.create |
CreateCollector |
| Penerus | GetCollector |
v2 | GetCollector | chronicle.googleapis.com/collectors.get |
GetCollector |
| Penerus | ListCollectors |
v2 | ListCollectors | chronicle.googleapis.com/collectors.list |
ListCollectors |
| Penerus | UpdateCollector |
v2 | UpdateCollector | chronicle.googleapis.com/collectors.update |
UpdateCollector |
| Penerus | DeleteCollector |
v2 | DeleteCollector | chronicle.googleapis.com/collectors.delete |
DeleteCollector |
| Parser | ArchiveCbnParser |
v1 | DeactivateParser | chronicle.googleapis.com/parsers.deactivate |
DeactivateParser |
| Parser | CreateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
CreateParser |
| Parser | GetCbnParser |
v1 | GetParser | chronicle.googleapis.com/parsers.get |
GetParser |
| Parser | ListCbnParserHistory |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
ListParsers |
| Parser | ListCbnParsers |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
ListParsers |
| Parser | RetrieveSampleLogs |
v1 | ListLogs | chronicle.googleapis.com/logs.list |
ListLogs |
| Parser | ValidateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
CreateParser |
| Partner | CreateCustomer |
v1 | CreateTenant | chronicle.googleapis.com/tenants.create |
CreateTenant |
| Partner | GetCustomer |
v1 | GetInstance | chronicle.googleapis.com/instances.get |
GetInstance |
| Partner | GetForwarderConfigs |
v1 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generate |
GenerateForwarderFiles |
| Partner | ListCustomersOfPartner |
v1 | ListTenants | chronicle.googleapis.com/tenants.list |
ListTenants |
| Partner | SetAuthVersion |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| Partner | SetComplianceRequirements |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| Partner | SetUIState |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| Partner | SetWorkforcePoolProvider |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| ReferenceList | CreateReferenceList |
v2 | CreateReferenceList | chronicle.googleapis.com/referenceLists.create |
CreateReferenceList |
| ReferenceList | VerifyReferenceList |
v2 | VerifyReferenceList | chronicle.googleapis.com/referenceLists.verifyReferenceList |
VerifyReferenceList |
| ReferenceList | GetReferenceList |
v2 | GetReferenceList | chronicle.googleapis.com/referenceLists.get |
GetReferenceList |
| ReferenceList | ListReferenceLists |
v2 | ListReferenceLists | chronicle.googleapis.com/referenceLists.list |
ListReferenceLists |
| ReferenceList | UpdateReferenceList |
v2 | UpdateReferenceList | chronicle.googleapis.com/referenceLists.update |
UpdateReferenceList |
| Retrohunt | RunRetrohunt |
v2 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
CreateRetrohunt |
| Retrohunt | ListRetrohunts |
v2 | ListRetrohunts | chronicle.googleapis.com/retrohunts.list |
ListRetrohunts |
| Retrohunt | GetRetrohunt |
v2 | GetRetrohunt | chronicle.googleapis.com/retrohunts.get |
GetRetrohunt |
| Retrohunt | CancelRetrohunt |
v2 | CancelOperation | chronicle.googleapis.com/operations.cancel |
— |
| Retrohunt | WaitRetrohunt |
v2 | GetOperation | chronicle.googleapis.com/operations.get |
— |
| Aturan | GetRule |
v2 | GetRule | chronicle.googleapis.com/rules.get |
GetRule |
| Aturan | CreateRule |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| Aturan | VerifyRule |
v2 | VerifyRuleText | chronicle.googleapis.com/rules.verifyRuleText |
VerifyRuleText |
| Aturan | ListRules |
v2 | ListRules | chronicle.googleapis.com/rules.list |
ListRules |
| Aturan | DeleteRule |
v2 | DeleteRule | chronicle.googleapis.com/rules.delete |
DeleteRule |
| Aturan | ArchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | UnarchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | EnableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | DisableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | ListRuleVersions |
v2 | ListRuleVersions | chronicle.googleapis.com/ruleVersions.list |
— |
| Aturan | CreateRuleVersion |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| Aturan | EnableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | DisableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | ListDetections |
v2 | LegacySearchDetections | chronicle.googleapis.com/legacies.legacySearchDetections |
LegacySearchDetections |
| Aturan | GetDetection |
v2 | LegacyGetDetection | chronicle.googleapis.com/legacies.legacyGetDetection |
LegacyGetDetection |
| Aturan | StreamDetectionAlerts |
v2 | LegacyStreamDetectionAlerts | chronicle.googleapis.com/legacies.legacyStreamDetectionAlerts |
LegacyStreamDetectionAlerts |
| Aturan | StreamTestRule |
v2 | LegacyTestRuleStreaming | chronicle.googleapis.com/legacies.legacyTestRuleStreaming |
LegacyTestRuleStreaming |
| Aturan | CreateRule |
v1 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| Aturan | GetRule |
v1 | GetRule | chronicle.googleapis.com/rules.get |
GetRule |
| Aturan | UpdateRule |
v1 | UpdateRule | chronicle.googleapis.com/rules.update |
UpdateRule |
| Aturan | DeleteRule |
v1 | DeleteRule | chronicle.googleapis.com/rules.delete |
DeleteRule |
| Aturan | EnableLiveRule |
v1 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| Aturan | ListResults |
v1 | LegacySearchRuleResults | chronicle.googleapis.com/legacies.legacySearchRuleResults |
LegacySearchRuleResults |
| Aturan | ListRules |
v1 | ListRules | chronicle.googleapis.com/rules.list |
ListRules |
| Aturan | RunRule |
v1 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
CreateRetrohunt |
| Notifikasi | StreamDetections |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
LegacyStreamDetectionAlerts |
| Notifikasi | StreamRuleNotifications |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
LegacyStreamDetectionAlerts |
| Telusuri | FetchUdmSearchView |
v1 | LegacyFetchUdmSearchView | chronicle.googleapis.com/legacies.legacyFetchUdmSearchView |
LegacyFetchUdmSearchView |
| Telusuri | GetEvent |
v1 | GetEvent | chronicle.googleapis.com/events.get |
GetEvent |
| Log | GetLog |
v1 | GetLog | chronicle.googleapis.com/logs.get |
— |
| Telusuri | ListArtifactAssets |
v1 | FindRelatedEntities | chronicle.googleapis.com/entities.findRelated |
FindRelatedEntities |
| IOC | ListArtifactIoCDetails |
v1 | LegacySearchArtifactIoCDetails | chronicle.googleapis.com/legacies.legacySearchArtifactIoCDetails |
— |
| Telusuri | ListEvents |
v1 | LegacySearchAssetEvents | chronicle.googleapis.com/legacies.legacySearchAssetEvents |
LegacySearchAssetEvents |
| IOC | ListIoCs |
v1 | ListIocMatches | chronicle.googleapis.com/iocMatches.list |
— |
| Telusuri | SearchRawLogs |
v1 | SearchRawLogs | chronicle.googleapis.com/rawLogs.search |
SearchRawLogs |
| Telusuri | UdmSearch |
v1 | UdmSearch | chronicle.googleapis.com/events.udmSearch |
UdmSearch |
| Telusuri | ListAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| Telusuri | ListAssetAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| Telusuri | ListUserAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| Pemberitahuan Huruf Besar | GetUppercaseAlert |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Catatan: Penerapan endpoint dihapus dari Backstory pada pertengahan tahun 2023. |
— |
| Pemberitahuan Huruf Besar | ListUppercaseAlerts |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings. Catatan: Penerapan endpoint dihapus dari Backstory pada pertengahan tahun 2023. |
— |
| Ingestion API | BatchCreateEntities |
v2 | ImportEntities | chronicle.googleapis.com/entities.import |
ImportEntities |
| Ingestion API | BatchCreateEvents |
v2 | ImportStatsEvents | chronicle.googleapis.com/forwarders.importStatsEvents |
ImportStatsEvents |
| Ingestion API | BatchCreateLogs |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
ImportLogs |
| Ingestion API | BatchCreateUDMEvents |
v2 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | BatchCreateUnstructuredLogEntries |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
— |
| Ingestion API | CreateEntities |
v1 | ImportEntities | chronicle.googleapis.com/entities.import |
ImportEntities |
| Ingestion API | CreateUDMEvents |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | CreateUnstructuredLogEntries |
v1 | ImportLogs | chronicle.googleapis.com/logs.import |
ImportLogs |
| Ingestion API | ListLogTypes |
v1 | ListLogTypes | chronicle.googleapis.com/logTypes.list |
ListLogTypes |
| Ingestion API | ListSupportedLogTypes |
v2 | ListLogTypeSettings | chronicle.googleapis.com/logTypeSettings.list |
ListLogTypeSettings |
| Ingestion API | PutEvent |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | PutLog |
v1 | UpdateLogType | chronicle.googleapis.com/logTypes.update |
UpdateLogType |
Untuk mengetahui informasi selengkapnya tentang cara bermigrasi dari Ingestion API ke Chronicle API, lihat Metode penyerapan Chronicle API.
Endpoint yang tidak dipetakan dan dihapus
Tabel berikut mencantumkan endpoint API lama yang tidak dipetakan ke Chronicle API modern dan dijadwalkan untuk dihapus, beserta alasan bisnisnya:
| Area fitur | Metode API lama | Versi API lama | Justifikasi |
|---|---|---|---|
| RBAC lama | CreateSubject |
v1 | Tidak digunakan lagi; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| RBAC Lama | DeleteSubject |
v1 | Tidak berlaku; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| RBAC Lama | GetSubject |
v1 | Tidak berlaku; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| RBAC Lama | ListRoles |
v1 | Tidak berlaku; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| RBAC Lama | ListSubjects |
v1 | Tidak berlaku; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| RBAC Lama | UpdateRole |
v1 | Tidak berlaku; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| RBAC lama | UpdateSubject |
v1 | Tidak berlaku; kontrol akses kini diatur oleh peran IAM Google Cloud terperinci. |
| Parser | ListCbnParserErrors |
v1 | Tidak lagi diperlukan atau tersedia dalam alur kerja pengelolaan parser modern. |
| Partner | EnableIAM |
v1 | Fitur sudah tidak digunakan lagi dan ditangani menggunakan mekanisme Google Cloud standar. |
| Partner | GenerateIamMigrationCommands |
v1 | Fitur ini sudah tidak digunakan lagi dan redundan dalam arsitektur modern. |
| Partner | GenerateIdPMetadata |
v1 | Redundan dalam arsitektur terintegrasi Google Cloudmodern. |
| Partner | GetIngestionFilter |
v1 | Redundan dalam arsitektur terintegrasi Google Cloudmodern. |
| Partner | SetGCPProjectLink |
v1 | Redundan dalam arsitektur terintegrasi Google Cloudmodern. |
| Pemberitahuan Huruf Besar | CreateCorrespondence |
v1 | Fitur sudah tidak digunakan lagi. |
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.