Mengumpulkan log Abnormal Security

Versi Parser: 6.0

Didukung di:

Dokumen ini menjelaskan cara menyerap log Abnormal Security ke Google Security Operations. Parser menangani log email dalam format JSON dan Syslog. Logstash pertama-tama akan mencoba memproses input sebagai JSON, dan jika tidak berhasil, Logstash akan menggunakan pola Grok untuk mengekstrak data dari format Syslog. Kolom yang diekstrak kemudian dipetakan ke Model Data Terpadu (UDM), sehingga memperkaya data dengan konteks keamanan yang relevan dan menstandarkan format untuk analisis lebih lanjut.

Sebelum memulai

Pastikan Anda memiliki prasyarat berikut:

  • Instance Google SecOps.
  • Akses istimewa ke Abnormal Security.

Mendapatkan ID pelanggan Google SecOps

  1. Login ke konsol Google SecOps.
  2. Buka SIEM Settings > Profile.
  3. Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.

Mendapatkan kredensial Google SecOps

Untuk mengautentikasi Abnormal Security ke Google SecOps, pilih salah satu metode berikut:

  • Deployment baru: Gunakan Chronicle API (Opsi 1).
  • Deployment lama: Terus gunakan file autentikasi penyerapan (Opsi 2) hingga Ingestion API dihentikan pada 20 Juli 2027.
  1. Login ke Google Cloud konsol dan pilih project Google Cloud yang ditautkan ke instance Google SecOps Anda.
  2. Buka IAM & Admin > Service Accounts.
  3. Klik Create service account.
  4. Berikan detail konfigurasi berikut:
    • Service account name: Masukkan nama akun (misalnya, abnormal-security-ingest).
    • Deskripsi akun layanan: Masukkan deskripsi (misalnya, Abnormal Security log ingestion).
  5. Klik Create and continue.
  6. Di bagian Grant this service account access to project, klik Select a role, lalu pilih Chronicle Editor.
  7. Klik Continue lalu klik Done.
  8. Klik akun layanan yang Anda buat, lalu buka tab Keys.
  9. Klik Add key > Create new key.
  10. Pilih JSON, lalu klik Create. File kunci akan didownload ke komputer Anda.
  11. Simpan file kunci dengan aman untuk digunakan dalam konfigurasi Abnormal Security.

Opsi 2: Mendownload file autentikasi penyerapan (lama)

  1. Login ke konsol Google SecOps.
  2. Buka Setelan SIEM > Agen Pengumpulan.
  3. Download file autentikasi penyerapan.
  4. Simpan file dengan aman untuk digunakan dalam konfigurasi Abnormal Security.

Mengonfigurasi Abnormal Security untuk mengirim log ke Google SecOps

  1. Login ke UI Web Abnormal Security.
  2. Klik Setelan > Integrasi.
  3. Temukan ikon Google Chronicle, lalu klik Hubungkan.
  4. Masukkan ID Pelanggan Google SecOps Anda.
  5. Masukkan alamat endpoint instance Google SecOps Anda. Endpoint berikut menampilkan Ingestion API modern. Anda harus menggunakan API lama jika menggunakan metode lama.
  6. Jika Anda menggunakan Opsi 1 - upload file kunci JSON akun layanan yang didownload sebelumnya sebagai Akun Layanan Google.
  7. Jika Anda menggunakan Opsi 2 - upload File Autentikasi Penyerapan yang didownload sebelumnya sebagai Akun Layanan Google.
  8. Klik Simpan > Konfirmasi.

Format log Abnormal Security yang didukung

Parser Abnormal Security mendukung log dalam format SYSLOG dan JSON.

Contoh Log Abnormal Security yang Didukung

  • JSON
{
  "threatId": "3fd4ed1a-9237-7e6f-d434-eacdcc41f47b",
  "messages": [
    {
      "abxMessageId": 3405268390454580698,
      "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/3405268390454580698",
      "attachmentCount": 0,
      "attachmentNames": [],
      "attackStrategy": "Unknown Sender",
      "attackType": "Spam",
      "attackVector": "Link",
      "attackedParty": "VIP",
      "autoRemediated": true,
      "fromAddress": "masked.from@example.com",
      "fromName": "Masked User Name",
      "impersonatedParty": "None / Others",
      "internetMessageId": "<20eb9e7c1c3046fda97f6564c81ced64@530566577>",
      "isRead": false,
      "postRemediated": false,
      "receivedTime": "2023-08-28T14:09:31Z",
      "recipientAddress": "masked.recipient@example.com",
      "remediationStatus": "Auto-Remediated",
      "remediationTimestamp": "2023-08-28T14:09:35.618Z",
      "sentTime": "2023-08-28T14:08:44Z",
      "subject": "Banking Insights | A deep dive into the global M&A landscape",
      "threatId": "3fd4ed1a-9237-7e6f-d434-eacdcc41f47b",
      "toAddresses": [
        "masked.to@example.com"
      ],
      "ccEmails": [],
      "replyToEmails": [
        "masked.reply@example.com"
      ],
      "returnPath": "masked.returnPath@example.com",
      "senderDomain": "masked.sender.domain",
      "senderIpAddress": null,
      "summaryInsights": [
        "Suspicious Link",
        "Unusual Sender",
        "Abnormal Email Body HTML",
        "Invisible characters found in Email",
        "Unusual Sender Domain",
        "Suspicious Financial Request",
        "Unusual Reply To"
      ],
      "urlCount": 19,
      "urls": [
        "https://masked.comm.link/e/es?s=530566577&e=2595782&elqTrackId=MASKEDID&elq=MASKEDID&elqaid=119820&elqat=1",
        "https://www.masked.group/en/simplifying-the-brand?utm_source=Eloqua&utm_medium=email&utm_campaign=MASKED_CAMPAIGN&elqCampaignId=20995&elq=MASKEDID",
        "https://masked.group.link/e/er?utm_source=Eloqua&utm_medium=email&utm_campaign=MASKED_CAMPAIGN&elqCampaignId=20995&s=530566577&lid=192730&elqTrackId=MASKEDID&elq=MASKEDID&elqaid=119820&elqat=1"
        // ... (16 additional masked URLs omitted for brevity)
      ]
    }
  ]
}
  • SYSLOG + JSON
<14> {
  "threatId": "83da593b-3778-9d2f-da8c-e305dc1425e1",
  "messages": [
    {
      "abxMessageId": 8274341447487143770,
      "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/8274341447487143770",
      "attackType": "Spam",
      "fromAddress": "masked.from.1@example.com",
      "fromName": "Masked User Name",
      "internetMessageId": "<PUZPR06MB45764FCED76739D0BC8A1B69E3DFA@masked.server.prod.outlook.com>",
      "recipientAddress": "masked.recipient.1@example.com",
      "remediationStatus": "Auto-Remediated",
      "subject": "Freightview, FreightPOP Users List",
      "toAddresses": [
        "masked.to.1@example.com"
      ],
      "returnPath": "masked.returnPath.1@example.com",
      "senderDomain": "outlook.com",
      "senderIpAddress": null,
      "urlCount": 0,
      "urls": []
    },
    {
      "abxMessageId": -4495524442058864563,
      "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/-4495524442058864563",
      "attackType": "Spam",
      "fromAddress": "masked.user.2@outlook.com",
      "fromName": "Masked User Name",
      "internetMessageId": "<PUZPR06MB4576BF221988D780C8412731E3DFA@masked.server.prod.outlook.com>",
      "recipientAddress": "masked.recipient.2@example.com",
      "remediationStatus": "Auto-Remediated",
      "subject": "Freightview, FreightPOP Users List",
      "toAddresses": [
        "masked.to.2@example.com"
      ],
      "returnPath": "masked.user.2@outlook.com",
      "senderDomain": "outlook.com",
      "senderIpAddress": null,
      "urlCount": 0,
      "urls": []
    }
  ]
}
  • Skema JSON (threat_log)
{
  "event": {
    "abx_message_id": -3325933065721657641,
    "abx_portal_url": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/-3325933065721657641",
    "threat_id": "1c3736ab-9e3a-883f-62b5-6fe36ac9672c",
    "subject": "[EXTERNAL] RE: Masked Name PUP094439581",
    "from_address": "masked.sender@maskeddomain.xyz",
    "from_name": "masked.sender@maskeddomain.xyz",
    "to_addresses": "masked.recipient@maskedcorp.com",
    "recipient_address": "masked.recipient@maskedcorp.com",
    "internet_message_id": "<MASKEDID@masked-insurance-group.com>",
    "attack_type": "Phishing: Credential",
    "return_path": "masked.sender@maskeddomain.xyz",
    "sender_ip_address": "",
    "urls": [
      "www.masked-insurance-group.com",
      "http://www.masked-insurance-group.com/"
    ],
    "sender_domain": "masked-insurance-group.com",
    "tenant": "Auto Club Group"
  },
  "sourcetype": "threat_log"
}
  • Skema JSON (abuse_mailbox)
{
  "event": {
    "abx_metadata": {
      "event_type": "ABUSE_MAILBOX",
      "timestamp": "2024-04-27T15:25:53.374227319Z",
      "trace_id": "00bc67b5-eb26-41c2-9f95-021eb435fc49"
    },
    "abx_body": {
      "campaign_id": "28b9c99f-f4a4-3032-bd99-3b7bac532471",
      "subject": "[EXTERNAL] News you might have missed",
      "recipient_name": "Masked PII Name",
      "recipient_address": "masked.abuse.recipient@secops.com",
      "internet_message_id": "<AutoNewsDigest-MASKED@odspnotify>",
      "email_label_or_location": "inbox"
    }
  },
  "sourcetype": "abuse_mailbox"
}
  • Skema JSON (audit_log)
{
  "event": {
    "abx_metadata": {
      "event_type": "AUDIT_LOG",
      "timestamp": "2024-04-01T17:50:55.194231924Z",
      "trace_id": "6f95188c-cba2-4e86-a3ae-3eaf22c869e4"
    },
    "abx_body": {
      "category": "login",
      "details": {
        "request_url": "/api-token-auth/"
      },
      "source_ip": "0.0.0.0",
      "status": "SUCCESS",
      "tenant_name": "masked_secops_tenant",
      "timestamp": "2024-04-01T17:50:54.632Z",
      "user": {
        "email": "masked.audit.user@secops.net"
      }
    }
  },
  "sourcetype": "audit_log"
}
  • Skema JSON (kasus)
{
  "event": {
    "abx_metadata": {
      "event_type": "CASE",
      "timestamp": "2024-08-08T12:42:45.104485389Z",
      "trace_id": "e4ad638f-439a-4c5f-839d-b650ecab9156"
    },
    "abx_body": {
      "schema_version": "1.0.0",
      "case_id": 11188520,
      "tenant": "masked name",
      "entity": {
        "entity_type": "USER_ACCOUNT",
        "identifier": "masked.case.user@secops.com"
      },
      "description": "Account Compromised",
      "event_timeline": [
        {
          "timestamp": "2024-09-07T20:17:25+00:00",
          "event_type": "SIGN_IN",
          "platform": "AZURE_AD",
          "insights": [
            {
              "signal": "Risky Browser",
              "description": "The browser associated with this sign-in, None, is considered risky and has been blocklisted by Abnormal or your organization."
            }
          ],
          "ip_address": "0.0.0.0 ",
          "operating_system": "ios 17.6",
          "isp": "verizon wireless",
          "location": {
            "city": "Huntley",
            "state": "Illinois",
            "country": "United States"
          }
        },
        {
          "timestamp": "2024-09-07T20:17:25+00:00",
          "event_type": "SIGN_IN",
          "platform": "AZURE_AD",
          "ip_address": "0.0.0.0 ",
          "operating_system": "ios 15.6"
        }
      ],
      "event_type": "CASE"
    }
  },
  "sourcetype": "case"
}

Tabel pemetaan UDM

Kolom log Pemetaan UDM Logika
attachmentCount additional.fields.attachmentCount.value.number_value Dipetakan secara langsung
attachmentNames additional.fields.attachmentNames.value Digabungkan menjadi string yang dipisahkan koma
attackStrategy security_result.detection_fields.attackStrategy.value Dipetakan secara langsung
attackType security_result.threat_name Dipetakan secara langsung
attackVector security_result.detection_fields.attackVector.value Dipetakan secara langsung
attackedParty security_result.detection_fields.attackedParty.value Dipetakan secara langsung
autoRemediated Tidak dipetakan ke objek IDM
ccEmails network.email.cc Setiap alamat email diekstrak dan ditambahkan ke array
fromAddress network.email.from Alamat email diekstrak dan dipetakan secara langsung
fromName principal.user.user_display_name Dipetakan secara langsung
impersonatedParty security_result.detection_fields.impersonatedParty.value Dipetakan secara langsung
internetMessageId additional.fields.internetMessageId.value.string_value Dipetakan secara langsung
isRead additional.fields.isRead.value.bool_value Dipetakan secara langsung
postRemediated additional.fields.postRemediated.value.bool_value Dipetakan secara langsung
receivedTime additional.fields.mailReceivedTime.value.string_value Dipetakan secara langsung
remediationStatus additional.fields.remediationStatus.value.string_value Dipetakan secara langsung
remediationTimestamp additional.fields.mailRemediationTimestamp.value.string_value Dipetakan secara langsung
replyToEmails network.email.reply_to Alamat email pertama diekstrak dan dipetakan secara langsung
returnPath additional.fields.returnPath.value.string_value Dipetakan secara langsung
senderDomain principal.administrative_domain Dipetakan secara langsung
senderIpAddress principal.ip, principal.asset.ip Alamat IP diekstrak dan dipetakan ke kedua kolom
sentTime additional.fields.mailSentTime.value.string_value Dipetakan secara langsung
subject network.email.subject Dipetakan secara langsung
summaryInsights security_result.summary Digabungkan menjadi string yang dipisahkan koma
threatId security_result.threat_id Dipetakan secara langsung
toAddresses network.email.to Setiap alamat email diekstrak dan ditambahkan ke array
urlCount additional.fields.urlCount.value.number_value Dipetakan secara langsung
URL additional.fields.detectedUrls.value Digabungkan menjadi string yang dipisahkan koma
additional.fields.campaign_id.value.string_value Dipetakan dari event_data.abx_body.campaign_id jika ada
additional.fields.trace_id.value.string_value Dipetakan dari event_data.abx_metadata.trace_id jika ada
additional.fields.messageReportedTime.value.string_value Dipetakan dari event_data.abx_body.message_reported_time jika ada
metadata.event_type Ditetapkan ke EMAIL_TRANSACTION jika array pesan ada, jika tidak, ditentukan berdasarkan kolom lain dan dapat berupa USER_LOGIN, STATUS_UPDATE, atau GENERIC_EVENT
metadata.product_name Selalu ditetapkan ke ABNORMAL_SECURITY
metadata.vendor_name Selalu ditetapkan ke ABNORMAL_SECURITY
metadata.product_event_type Dipetakan dari event_data.abx_metadata.event_type jika ada
extensions.auth.type Tetapkan ke AUTHTYPE_UNSPECIFIED jika event_type adalah USER_LOGIN
security_result.category Tetapkan ke MAIL_SPAM dan MAIL_PHISHING jika array pesan ada, jika tidak, tetapkan ke MAIL_PHISHING dan/atau MAIL_SPAM berdasarkan kolom lain
security_result.category_details Tetapkan ke ABUSE_MAILBOX jika abx_metadata.event_type adalah ABUSE_MAILBOX, jika tidak, tetapkan ke login jika abx_body.category adalah login
security_result.detection_fields.reported.value Dipetakan dari event_data.abx_body.reported jika ada
security_result.detection_fields.judgement.value Dipetakan dari event_data.abx_body.judgement jika ada
target.url Dipetakan dari event_data.abx_body.details.request_url jika ada
target.user.userid Dipetakan dari event_data.abx_body.user.email jika ada
target.user.email_addresses Dipetakan dari event_data.abx_body.user.email jika ada
event.abx_body.abnormal_message_id event.idm.read_only_udm.metadata.product_log_id Dipetakan dari log perubahan
event.abx_body.email_label_or_location event.idm.read_only_udm.additional.fields Dipetakan dari log perubahan
event.abx_body.not_analyzed event.idm.read_only_udm.security_result.detection_fields Dipetakan dari log perubahan
event_data.message_sources", "event_data.sender_auth_results.spf", "event_data.sender_auth_results.dkim", "event_data.sender_auth_results.dmarc", "event_data.tenant", and "event_data.attack_score additional.fields Dipetakan dari log perubahan
event_data.abx_body.severity security_result.severity Dipetakan dari log perubahan
event_data.abx_body.trigger_event" and "event_data.abx_body.entity.entity_type additional.fields Dipetakan dari log perubahan
event_data.abx_body.entity.identifier principal.user.email_addresses Dipetakan dari log perubahan
event_data.abx_body.case_id metadata.product_log_id Dipetakan dari log perubahan
sourcetype", "event.folder_locations additional.fields Dipetakan dari log perubahan
event.abx_message_id metadata.product_log_id Dipetakan dari log perubahan

Log Perubahan

Melihat Log Perubahan untuk parser ini

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.