SIEM API 端點對應
支援的國家/地區：
Google SecOps
SIEM
本文會將舊版 SIEM API 端點 (包括 Backstory API (含 Customer Management API) 和 Ingestion API) 對應至相應的現代 Chronicle API 端點。
授權和合作夥伴委派
在 Chronicle API 中，Identity and Access Management (IAM) 會取代舊版 API 金鑰和權杖，用於存取權控管。如要直接存取執行個體，請使用服務帳戶或 Workload Identity Federation 主體的 OAuth 2.0 憑證進行驗證。該主體必須在託管執行個體的專案中具備必要的 IAM 角色。
對合作夥伴來說，授權取決於資源擁有權。資源所在的專案會決定合作夥伴需要哪些憑證和 IAM 權限。將租戶作業範圍限定為租戶委派的憑證，符合核心安全性原則，即合作夥伴在未經租戶明確授權的情況下，不得存取、擷取或修改租戶資料。下表比較舊版 Backstory API 和 Chronicle API 的合作夥伴授權：
| API | 方法 | 資源範圍 | 授權 |
|---|---|---|---|
| 舊版 Backstory API | /v1/partner/customer/* 個端點 |
合作夥伴的所有客戶代碼 | 合作夥伴會直接使用自己的合作夥伴權杖或 API 金鑰呼叫這些端點。 |
Chronicle API：TenantService |
CreateTenant、ListTenants 和 UpdateTenant |
合作夥伴的執行個體：projects/{partner_project}/locations/{location}/instances/{partner_instance}/tenants/* |
合作夥伴會使用自己的服務帳戶或憑證直接呼叫這些方法，這些帳戶或憑證在合作夥伴專案中具有 chronicle.googleapis.com/tenants.* 權限。 |
Chronicle API：其他服務，例如 InstanceService 和 ForwarderService |
GetInstance、UpdateInstance、GenerateForwarderFiles 和其他以房客為範圍的方法 |
租戶的執行個體：projects/{tenant_project}/locations/{location}/instances/{tenant_instance}/... |
單憑合作夥伴憑證無法存取或修改房客資料。租戶管理員必須在租戶的 Google Cloud 專案中，將 roles/chronicle.admin、roles/chronicle.viewer 或自訂角色等 IAM 角色，授予合作夥伴的服務帳戶或 Workload Identity Federation 主體。 |
API 對應表
| 功能區域 | 舊版 API 方法 | 舊版 API 版本 | Chronicle API 方法 | 需要 IAM 權限 | 詳細要求和回應對應 |
|---|---|---|---|---|---|
| BigQuery | UpdateBigQueryAccess |
v1 | ProvideBigQueryAccess | chronicle.googleapis.com/bigQueryAccesses.provide |
ProvideBigQueryAccess |
| CuratedRule | ListCuratedRuleDetections |
v2 | LegacySearchCuratedDetections | chronicle.googleapis.com/legacies.legacySearchCuratedDetections |
LegacySearchCuratedDetections |
| CuratedRule | ListCuratedRules |
v2 | ListCuratedRules | chronicle.googleapis.com/curatedRules.list |
ListCuratedRules |
| LegacyAlert | UpdateAlert |
v1 | LegacyUpdateAlert | chronicle.googleapis.com/legacies.legacyUpdateAlert |
LegacyUpdateAlert |
| LegacyAlert | CreateSoarAlert |
v1 | LegacyCreateSoarAlert | chronicle.googleapis.com/legacies.legacyCreateSoarAlert |
LegacyCreateSoarAlert |
| 案件 | CreateOrUpdateCase |
v1 | LegacyCreateOrUpdateCase | chronicle.googleapis.com/legacies.legacyCreateOrUpdateCase |
LegacyCreateOrUpdateCase |
| 資料匯出 | CancelDataExport |
v1 | CancelDataExport | chronicle.googleapis.com/dataExports.cancel |
— |
| 資料匯出 | CreateDataExport |
v1 | CreateDataExport | chronicle.googleapis.com/dataExports.create |
— |
| 資料匯出 | GetDataExport |
v1 | GetDataExport | chronicle.googleapis.com/dataExports.get |
— |
| 資料匯出 | ListAvailableLogTypes |
v1 | FetchLogTypesAvailableForExport | chronicle.googleapis.com/dataExports.fetchAvailableLogTypes |
— |
| DataTap | CreateDataTap |
v1 | CreateDataTap | chronicle.googleapis.com/dataTaps.create |
CreateDataTap |
| DataTap | DeleteDataTap |
v1 | DeleteDataTap | chronicle.googleapis.com/dataTaps.delete |
DeleteDataTap |
| DataTap | GetDataTap |
v1 | GetDataTap | chronicle.googleapis.com/dataTaps.get |
GetDataTap |
| DataTap | ListDataTaps |
v1 | ListDataTaps | chronicle.googleapis.com/dataTaps.list |
ListDataTaps |
| DataTap | UpdateDataTap |
v1 | UpdateDataTap | chronicle.googleapis.com/dataTaps.update |
UpdateDataTap |
| 動態饋給 | CreateFeed |
v1 | CreateFeed | chronicle.googleapis.com/feeds.create |
CreateFeed |
| 動態饋給 | DeleteFeed |
v1 | DeleteFeed | chronicle.googleapis.com/feeds.delete |
DeleteFeed |
| 動態饋給 | DisableFeed |
v1 | DisableFeed | chronicle.googleapis.com/feeds.disable |
DisableFeed |
| 動態饋給 | EnableFeed |
v1 | EnableFeed | chronicle.googleapis.com/feeds.enable |
EnableFeed |
| 動態饋給 | FetchFeedServiceAccount |
v1 | FetchServiceAccountForCustomer | chronicle.googleapis.com/feedServiceAccounts.fetch |
FetchServiceAccountForCustomer |
| 動態饋給 | GetFeed |
v1 | GetFeed | chronicle.googleapis.com/feeds.get |
GetFeed |
| 動態饋給 | GetFeedSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| 動態饋給 | GetLogTypeSchema |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| 動態饋給 | ListFeeds |
v1 | ListFeeds | chronicle.googleapis.com/feeds.list |
ListFeeds |
| 動態饋給 | ListFeedSourceTypeSchemas |
v1 | ListFeedSourceTypeSchemas | chronicle.googleapis.com/feedSourceTypeSchemas.list |
ListFeedSourceTypeSchemas |
| 動態饋給 | ListLogTypeSchemas |
v1 | ListLogTypeSchemas | chronicle.googleapis.com/logTypeSchemas.list |
ListLogTypeSchemas |
| 動態饋給 | UpdateFeed |
v1 | UpdateFeed | chronicle.googleapis.com/feeds.update |
UpdateFeed |
| 轉送站 | CreateForwarder |
v2 | CreateForwarder | chronicle.googleapis.com/forwarders.create |
CreateForwarder |
| 轉送站 | GetForwarder |
v2 | GetForwarder | chronicle.googleapis.com/forwarders.get |
GetForwarder |
| 轉送站 | ListForwarders |
v2 | ListForwarders | chronicle.googleapis.com/forwarders.list |
ListForwarders |
| 轉送站 | UpdateForwarder |
v2 | UpdateForwarder | chronicle.googleapis.com/forwarders.update |
UpdateForwarder |
| 轉送站 | DeleteForwarder |
v2 | DeleteForwarder | chronicle.googleapis.com/forwarders.delete |
DeleteForwarder |
| 轉送站 | GenerateForwarderFiles |
v2 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generateFiles |
— |
| 轉送站 | CreateCollector |
v2 | CreateCollector | chronicle.googleapis.com/collectors.create |
CreateCollector |
| 轉送站 | GetCollector |
v2 | GetCollector | chronicle.googleapis.com/collectors.get |
GetCollector |
| 轉送站 | ListCollectors |
v2 | ListCollectors | chronicle.googleapis.com/collectors.list |
ListCollectors |
| 轉送站 | UpdateCollector |
v2 | UpdateCollector | chronicle.googleapis.com/collectors.update |
UpdateCollector |
| 轉送站 | DeleteCollector |
v2 | DeleteCollector | chronicle.googleapis.com/collectors.delete |
DeleteCollector |
| 剖析器 | ArchiveCbnParser |
v1 | DeactivateParser | chronicle.googleapis.com/parsers.deactivate |
DeactivateParser |
| 剖析器 | CreateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
CreateParser |
| 剖析器 | GetCbnParser |
v1 | GetParser | chronicle.googleapis.com/parsers.get |
GetParser |
| 剖析器 | ListCbnParserHistory |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
ListParsers |
| 剖析器 | ListCbnParsers |
v1 | ListParsers | chronicle.googleapis.com/parsers.list |
ListParsers |
| 剖析器 | RetrieveSampleLogs |
v1 | ListLogs | chronicle.googleapis.com/logs.list |
ListLogs |
| 剖析器 | ValidateCbnParser |
v1 | CreateParser | chronicle.googleapis.com/parsers.create |
CreateParser |
| 合作夥伴 | CreateCustomer |
v1 | CreateTenant | chronicle.googleapis.com/tenants.create |
CreateTenant |
| 合作夥伴 | GetCustomer |
v1 | GetInstance | chronicle.googleapis.com/instances.get |
GetInstance |
| 合作夥伴 | GetForwarderConfigs |
v1 | GenerateForwarderFiles | chronicle.googleapis.com/forwarders.generate |
GenerateForwarderFiles |
| 合作夥伴 | ListCustomersOfPartner |
v1 | ListTenants | chronicle.googleapis.com/tenants.list |
ListTenants |
| 合作夥伴 | SetAuthVersion |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| 合作夥伴 | SetComplianceRequirements |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| 合作夥伴 | SetUIState |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| 合作夥伴 | SetWorkforcePoolProvider |
v1 | UpdateInstance | chronicle.googleapis.com/instances.update |
UpdateInstance |
| ReferenceList | CreateReferenceList |
v2 | CreateReferenceList | chronicle.googleapis.com/referenceLists.create |
CreateReferenceList |
| ReferenceList | VerifyReferenceList |
v2 | VerifyReferenceList | chronicle.googleapis.com/referenceLists.verifyReferenceList |
VerifyReferenceList |
| ReferenceList | GetReferenceList |
v2 | GetReferenceList | chronicle.googleapis.com/referenceLists.get |
GetReferenceList |
| ReferenceList | ListReferenceLists |
v2 | ListReferenceLists | chronicle.googleapis.com/referenceLists.list |
ListReferenceLists |
| ReferenceList | UpdateReferenceList |
v2 | UpdateReferenceList | chronicle.googleapis.com/referenceLists.update |
UpdateReferenceList |
| RetroHunt | RunRetrohunt |
v2 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
CreateRetrohunt |
| RetroHunt | ListRetrohunts |
v2 | ListRetrohunts | chronicle.googleapis.com/retrohunts.list |
ListRetrohunts |
| RetroHunt | GetRetrohunt |
v2 | GetRetrohunt | chronicle.googleapis.com/retrohunts.get |
GetRetrohunt |
| RetroHunt | CancelRetrohunt |
v2 | CancelOperation | chronicle.googleapis.com/operations.cancel |
— |
| RetroHunt | WaitRetrohunt |
v2 | GetOperation | chronicle.googleapis.com/operations.get |
— |
| 規則 | GetRule |
v2 | GetRule | chronicle.googleapis.com/rules.get |
GetRule |
| 規則 | CreateRule |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| 規則 | VerifyRule |
v2 | VerifyRuleText | chronicle.googleapis.com/rules.verifyRuleText |
VerifyRuleText |
| 規則 | ListRules |
v2 | ListRules | chronicle.googleapis.com/rules.list |
ListRules |
| 規則 | DeleteRule |
v2 | DeleteRule | chronicle.googleapis.com/rules.delete |
DeleteRule |
| 規則 | ArchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | UnarchiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | EnableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | DisableLiveRule |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | ListRuleVersions |
v2 | ListRuleVersions | chronicle.googleapis.com/ruleVersions.list |
— |
| 規則 | CreateRuleVersion |
v2 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| 規則 | EnableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | DisableAlerting |
v2 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | ListDetections |
v2 | LegacySearchDetections | chronicle.googleapis.com/legacies.legacySearchDetections |
LegacySearchDetections |
| 規則 | GetDetection |
v2 | LegacyGetDetection | chronicle.googleapis.com/legacies.legacyGetDetection |
LegacyGetDetection |
| 規則 | StreamDetectionAlerts |
v2 | LegacyStreamDetectionAlerts | chronicle.googleapis.com/legacies.legacyStreamDetectionAlerts |
LegacyStreamDetectionAlerts |
| 規則 | StreamTestRule |
v2 | LegacyTestRuleStreaming | chronicle.googleapis.com/legacies.legacyTestRuleStreaming |
LegacyTestRuleStreaming |
| 規則 | CreateRule |
v1 | CreateRule | chronicle.googleapis.com/rules.create |
CreateRule |
| 規則 | GetRule |
v1 | GetRule | chronicle.googleapis.com/rules.get |
GetRule |
| 規則 | UpdateRule |
v1 | UpdateRule | chronicle.googleapis.com/rules.update |
UpdateRule |
| 規則 | DeleteRule |
v1 | DeleteRule | chronicle.googleapis.com/rules.delete |
DeleteRule |
| 規則 | EnableLiveRule |
v1 | UpdateRuleDeployment | chronicle.googleapis.com/ruleDeployments.update |
UpdateRuleDeployment |
| 規則 | ListResults |
v1 | LegacySearchRuleResults | chronicle.googleapis.com/legacies.legacySearchRuleResults |
LegacySearchRuleResults |
| 規則 | ListRules |
v1 | ListRules | chronicle.googleapis.com/rules.list |
ListRules |
| 規則 | RunRule |
v1 | CreateRetrohunt | chronicle.googleapis.com/retrohunts.create |
CreateRetrohunt |
| 快訊 | StreamDetections |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
LegacyStreamDetectionAlerts |
| 快訊 | StreamRuleNotifications |
v1 | StreamDetectionAlerts | chronicle.googleapis.com/legacies.streamDetectionAlerts |
LegacyStreamDetectionAlerts |
| 搜尋 | FetchUdmSearchView |
v1 | LegacyFetchUdmSearchView | chronicle.googleapis.com/legacies.legacyFetchUdmSearchView |
LegacyFetchUdmSearchView |
| 搜尋 | GetEvent |
v1 | GetEvent | chronicle.googleapis.com/events.get |
GetEvent |
| 記錄 | GetLog |
v1 | GetLog | chronicle.googleapis.com/logs.get |
— |
| 搜尋 | ListArtifactAssets |
v1 | FindRelatedEntities | chronicle.googleapis.com/entities.findRelated |
FindRelatedEntities |
| IOC | ListArtifactIoCDetails |
v1 | LegacySearchArtifactIoCDetails | chronicle.googleapis.com/legacies.legacySearchArtifactIoCDetails |
— |
| 搜尋 | ListEvents |
v1 | LegacySearchAssetEvents | chronicle.googleapis.com/legacies.legacySearchAssetEvents |
LegacySearchAssetEvents |
| IOC | ListIoCs |
v1 | ListIocMatches | chronicle.googleapis.com/iocMatches.list |
— |
| 搜尋 | SearchRawLogs |
v1 | SearchRawLogs | chronicle.googleapis.com/rawLogs.search |
SearchRawLogs |
| 搜尋 | UdmSearch |
v1 | UdmSearch | chronicle.googleapis.com/events.udmSearch |
UdmSearch |
| 搜尋 | ListAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| 搜尋 | ListAssetAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| 搜尋 | ListUserAliases |
v1 | SummarizeEntity | chronicle.googleapis.com/entities.summarize |
SummarizeEntity |
| 大寫警告 | GetUppercaseAlert |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings。注意：Backstory 已於 2023 年中移除端點實作。 |
— |
| 大寫警告 | ListUppercaseAlerts |
v1 | LegacySearchFindings | chronicle.googleapis.com/legacies.legacySearchFindings。注意：Backstory 已於 2023 年中移除端點實作功能。 |
— |
| Ingestion API | BatchCreateEntities |
v2 | ImportEntities | chronicle.googleapis.com/entities.import |
ImportEntities |
| Ingestion API | BatchCreateEvents |
v2 | ImportStatsEvents | chronicle.googleapis.com/forwarders.importStatsEvents |
ImportStatsEvents |
| Ingestion API | BatchCreateLogs |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
ImportLogs |
| Ingestion API | BatchCreateUDMEvents |
v2 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | BatchCreateUnstructuredLogEntries |
v2 | ImportLogs | chronicle.googleapis.com/logs.import |
— |
| Ingestion API | CreateEntities |
v1 | ImportEntities | chronicle.googleapis.com/entities.import |
ImportEntities |
| Ingestion API | CreateUDMEvents |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | CreateUnstructuredLogEntries |
v1 | ImportLogs | chronicle.googleapis.com/logs.import |
ImportLogs |
| Ingestion API | ListLogTypes |
v1 | ListLogTypes | chronicle.googleapis.com/logTypes.list |
ListLogTypes |
| Ingestion API | ListSupportedLogTypes |
v2 | ListLogTypeSettings | chronicle.googleapis.com/logTypeSettings.list |
ListLogTypeSettings |
| Ingestion API | PutEvent |
v1 | ImportEvents | chronicle.googleapis.com/events.import |
ImportEvents |
| Ingestion API | PutLog |
v1 | UpdateLogType | chronicle.googleapis.com/logTypes.update |
UpdateLogType |
如要進一步瞭解如何從 Ingestion API 遷移至 Chronicle API，請參閱「Chronicle API 擷取方法」。
未對應及已移除的端點
下表列出未對應至新版 Chronicle API 的舊版 API 端點，以及預定移除這些端點的業務理由：
| 功能區域 | 舊版 API 方法 | 舊版 API 版本 | 原因 |
|---|---|---|---|
| 舊版 RBAC | CreateSubject |
v1 | 已淘汰；存取控管現在由精細的 Google Cloud IAM 角色控管。 |
| 舊版 RBAC | DeleteSubject |
v1 | 已過時；存取控管機制現在由精細的 Google Cloud IAM 角色管理。 |
| 舊版 RBAC | GetSubject |
v1 | 已淘汰；存取控管現在由精細的 Google Cloud IAM 角色控管。 |
| 舊版 RBAC | ListRoles |
v1 | 已淘汰；存取控管現在由精細的 Google Cloud IAM 角色控管。 |
| 舊版 RBAC | ListSubjects |
v1 | 已過時；存取控管機制現在由精細的 Google Cloud IAM 角色管理。 |
| 舊版 RBAC | UpdateRole |
v1 | 已過時；存取控管機制現在由精細的 Google Cloud IAM 角色管理。 |
| 舊版 RBAC | UpdateSubject |
v1 | 已過時；存取控管機制現在由精細的 Google Cloud IAM 角色管理。 |
| 剖析器 | ListCbnParserErrors |
v1 | 新版剖析器管理工作流程不再需要或提供這項功能。 |
| 合作夥伴 | EnableIAM |
v1 | 這項功能已淘汰，並使用標準 Google Cloud 機制處理。 |
| 合作夥伴 | GenerateIamMigrationCommands |
v1 | 這項功能已淘汰，在現代架構中是多餘的。 |
| 合作夥伴 | GenerateIdPMetadata |
v1 | 在現代化 Google Cloud整合架構中，這項功能是多餘的。 |
| 合作夥伴 | GetIngestionFilter |
v1 | 在現代整合式架構中，這項功能已顯得冗餘。 Google Cloud |
| 合作夥伴 | SetGCPProjectLink |
v1 | 在現代 Google Cloud整合架構中，這項功能是多餘的。 |
| 大寫警報 | CreateCorrespondence |
v1 | 功能已淘汰。 |
還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求解答。