收集 Abnormal Security 日志

支持的平台：

本文档介绍了如何将 Abnormal Security 日志注入到 Google Security Operations。解析器可处理 JSON 和 Syslog 格式的电子邮件日志。它首先尝试将输入内容处理为 JSON，如果失败，则使用 Grok 模式从 Syslog 格式中提取数据。然后，系统会将提取的字段映射到统一数据模型 (UDM)，通过相关安全上下文扩充数据，并标准化格式以供进一步分析。

准备工作

请确保满足以下前提条件：

  • Google SecOps 实例。
  • 对 Abnormal Security 的特权访问权限。

获取 Google SecOps 客户 ID

  1. 登录 Google SecOps 控制台。
  2. 依次前往 SIEM 设置 > 个人资料。
  3. 复制并保存组织详细信息部分中的客户 ID。

获取 Google SecOps 注入身份验证文件

  1. 登录 Google SecOps 控制台。
  2. 依次前往 SIEM 设置 > 收集代理。
  3. 下载注入身份验证文件。

配置 Abnormal Security 以将日志发送到 Google SecOps

  1. 登录 Abnormal Security 网页界面。
  2. 依次点击设置> 集成。
  3. 找到 Google Chronicle 图标，然后点击关联。
  4. 输入您的 Google SecOps 客户 ID。
  5. 输入 Google SecOps 实例的端点地址。
  6. 将之前下载的提取身份验证文件作为 Google 服务账号上传。
  7. 依次点击保存 > 确认。

支持的 Abnormal Security 日志格式

Abnormal Security 解析器支持 SYSLOG 和 JSON 格式的日志。

支持的 Abnormal Security 示例日志

  • JSON
{
  "threatId": "3fd4ed1a-9237-7e6f-d434-eacdcc41f47b",
  "messages": [
    {
      "abxMessageId": 3405268390454580698,
      "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/3405268390454580698",
      "attachmentCount": 0,
      "attachmentNames": [],
      "attackStrategy": "Unknown Sender",
      "attackType": "Spam",
      "attackVector": "Link",
      "attackedParty": "VIP",
      "autoRemediated": true,
      "fromAddress": "masked.from@example.com",
      "fromName": "Masked User Name",
      "impersonatedParty": "None / Others",
      "internetMessageId": "<20eb9e7c1c3046fda97f6564c81ced64@530566577>",
      "isRead": false,
      "postRemediated": false,
      "receivedTime": "2023-08-28T14:09:31Z",
      "recipientAddress": "masked.recipient@example.com",
      "remediationStatus": "Auto-Remediated",
      "remediationTimestamp": "2023-08-28T14:09:35.618Z",
      "sentTime": "2023-08-28T14:08:44Z",
      "subject": "Banking Insights | A deep dive into the global M&A landscape",
      "threatId": "3fd4ed1a-9237-7e6f-d434-eacdcc41f47b",
      "toAddresses": [
        "masked.to@example.com"
      ],
      "ccEmails": [],
      "replyToEmails": [
        "masked.reply@example.com"
      ],
      "returnPath": "masked.returnPath@example.com",
      "senderDomain": "masked.sender.domain",
      "senderIpAddress": null,
      "summaryInsights": [
        "Suspicious Link",
        "Unusual Sender",
        "Abnormal Email Body HTML",
        "Invisible characters found in Email",
        "Unusual Sender Domain",
        "Suspicious Financial Request",
        "Unusual Reply To"
      ],
      "urlCount": 19,
      "urls": [
        "https://masked.comm.link/e/es?s=530566577&e=2595782&elqTrackId=MASKEDID&elq=MASKEDID&elqaid=119820&elqat=1",
        "https://www.masked.group/en/simplifying-the-brand?utm_source=Eloqua&utm_medium=email&utm_campaign=MASKED_CAMPAIGN&elqCampaignId=20995&elq=MASKEDID",
        "https://masked.group.link/e/er?utm_source=Eloqua&utm_medium=email&utm_campaign=MASKED_CAMPAIGN&elqCampaignId=20995&s=530566577&lid=192730&elqTrackId=MASKEDID&elq=MASKEDID&elqaid=119820&elqat=1"
        // ... (16 additional masked URLs omitted for brevity)
      ]
    }
  ]
}
  • SYSLOG + JSON
<14> {
  "threatId": "83da593b-3778-9d2f-da8c-e305dc1425e1",
  "messages": [
    {
      "abxMessageId": 8274341447487143770,
      "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/8274341447487143770",
      "attackType": "Spam",
      "fromAddress": "masked.from.1@example.com",
      "fromName": "Masked User Name",
      "internetMessageId": "<PUZPR06MB45764FCED76739D0BC8A1B69E3DFA@masked.server.prod.outlook.com>",
      "recipientAddress": "masked.recipient.1@example.com",
      "remediationStatus": "Auto-Remediated",
      "subject": "Freightview, FreightPOP Users List",
      "toAddresses": [
        "masked.to.1@example.com"
      ],
      "returnPath": "masked.returnPath.1@example.com",
      "senderDomain": "outlook.com",
      "senderIpAddress": null,
      "urlCount": 0,
      "urls": []
    },
    {
      "abxMessageId": -4495524442058864563,
      "abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/-4495524442058864563",
      "attackType": "Spam",
      "fromAddress": "masked.user.2@outlook.com",
      "fromName": "Masked User Name",
      "internetMessageId": "<PUZPR06MB4576BF221988D780C8412731E3DFA@masked.server.prod.outlook.com>",
      "recipientAddress": "masked.recipient.2@example.com",
      "remediationStatus": "Auto-Remediated",
      "subject": "Freightview, FreightPOP Users List",
      "toAddresses": [
        "masked.to.2@example.com"
      ],
      "returnPath": "masked.user.2@outlook.com",
      "senderDomain": "outlook.com",
      "senderIpAddress": null,
      "urlCount": 0,
      "urls": []
    }
  ]
}
  • JSON (threat_log) 架构
{
  "event": {
    "abx_message_id": -3325933065721657641,
    "abx_portal_url": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/-3325933065721657641",
    "threat_id": "1c3736ab-9e3a-883f-62b5-6fe36ac9672c",
    "subject": "[EXTERNAL] RE: Masked Name PUP094439581",
    "from_address": "masked.sender@maskeddomain.xyz",
    "from_name": "masked.sender@maskeddomain.xyz",
    "to_addresses": "masked.recipient@maskedcorp.com",
    "recipient_address": "masked.recipient@maskedcorp.com",
    "internet_message_id": "<MASKEDID@masked-insurance-group.com>",
    "attack_type": "Phishing: Credential",
    "return_path": "masked.sender@maskeddomain.xyz",
    "sender_ip_address": "",
    "urls": [
      "www.masked-insurance-group.com",
      "http://www.masked-insurance-group.com/"
    ],
    "sender_domain": "masked-insurance-group.com",
    "tenant": "Auto Club Group"
  },
  "sourcetype": "threat_log"
}
  • JSON (abuse_mailbox) 架构
{
  "event": {
    "abx_metadata": {
      "event_type": "ABUSE_MAILBOX",
      "timestamp": "2024-04-27T15:25:53.374227319Z",
      "trace_id": "00bc67b5-eb26-41c2-9f95-021eb435fc49"
    },
    "abx_body": {
      "campaign_id": "28b9c99f-f4a4-3032-bd99-3b7bac532471",
      "subject": "[EXTERNAL] News you might have missed",
      "recipient_name": "Masked PII Name",
      "recipient_address": "masked.abuse.recipient@secops.com",
      "internet_message_id": "<AutoNewsDigest-MASKED@odspnotify>",
      "email_label_or_location": "inbox"
    }
  },
  "sourcetype": "abuse_mailbox"
}
  • JSON（审核日志）架构
{
  "event": {
    "abx_metadata": {
      "event_type": "AUDIT_LOG",
      "timestamp": "2024-04-01T17:50:55.194231924Z",
      "trace_id": "6f95188c-cba2-4e86-a3ae-3eaf22c869e4"
    },
    "abx_body": {
      "category": "login",
      "details": {
        "request_url": "/api-token-auth/"
      },
      "source_ip": "0.0.0.0",
      "status": "SUCCESS",
      "tenant_name": "masked_secops_tenant",
      "timestamp": "2024-04-01T17:50:54.632Z",
      "user": {
        "email": "masked.audit.user@secops.net"
      }
    }
  },
  "sourcetype": "audit_log"
}
  • JSON（案例）架构
{
  "event": {
    "abx_metadata": {
      "event_type": "CASE",
      "timestamp": "2024-08-08T12:42:45.104485389Z",
      "trace_id": "e4ad638f-439a-4c5f-839d-b650ecab9156"
    },
    "abx_body": {
      "schema_version": "1.0.0",
      "case_id": 11188520,
      "tenant": "masked name",
      "entity": {
        "entity_type": "USER_ACCOUNT",
        "identifier": "masked.case.user@secops.com"
      },
      "description": "Account Compromised",
      "event_timeline": [
        {
          "timestamp": "2024-09-07T20:17:25+00:00",
          "event_type": "SIGN_IN",
          "platform": "AZURE_AD",
          "insights": [
            {
              "signal": "Risky Browser",
              "description": "The browser associated with this sign-in, None, is considered risky and has been blocklisted by Abnormal or your organization."
            }
          ],
          "ip_address": "0.0.0.0 ",
          "operating_system": "ios 17.6",
          "isp": "verizon wireless",
          "location": {
            "city": "Huntley",
            "state": "Illinois",
            "country": "United States"
          }
        },
        {
          "timestamp": "2024-09-07T20:17:25+00:00",
          "event_type": "SIGN_IN",
          "platform": "AZURE_AD",
          "ip_address": "0.0.0.0 ",
          "operating_system": "ios 15.6"
        }
      ],
      "event_type": "CASE"
    }
  },
  "sourcetype": "case"
}

UDM 映射表

日志字段 UDM 映射 逻辑
attachmentCount additional.fields.attachmentCount.value.number_value 直接映射
attachmentNames additional.fields.attachmentNames.value 连接成以英文逗号分隔的字符串
attackStrategy security_result.detection_fields.attackStrategy.value 直接映射
attackType security_result.threat_name 直接映射
attackVector security_result.detection_fields.attackVector.value 直接映射
attackedParty security_result.detection_fields.attackedParty.value 直接映射
autoRemediated 未映射到 IDM 对象
ccEmails network.email.cc 系统会提取每个电子邮件地址并将其添加到数组中
fromAddress network.email.from 电子邮件地址直接提取并映射
fromName principal.user.user_display_name 直接映射
impersonatedParty security_result.detection_fields.impersonatedParty.value 直接映射
internetMessageId additional.fields.internetMessageId.value.string_value 直接映射
isRead additional.fields.isRead.value.bool_value 直接映射
postRemediated additional.fields.postRemediated.value.bool_value 直接映射
receivedTime additional.fields.mailReceivedTime.value.string_value 直接映射
remediationStatus additional.fields.remediationStatus.value.string_value 直接映射
remediationTimestamp additional.fields.mailRemediationTimestamp.value.string_value 直接映射
replyToEmails network.email.reply_to 系统会提取第一个电子邮件地址并直接进行映射
returnPath additional.fields.returnPath.value.string_value 直接映射
senderDomain principal.administrative_domain 直接映射
senderIpAddress principal.ip、principal.asset.ip IP 地址已提取并映射到这两个字段
sentTime additional.fields.mailSentTime.value.string_value 直接映射
subject network.email.subject 直接映射
summaryInsights security_result.summary 连接成以英文逗号分隔的字符串
threatId security_result.threat_id 直接映射
toAddresses network.email.to 系统会提取每个电子邮件地址并将其添加到数组中
urlCount additional.fields.urlCount.value.number_value 直接映射
网址 additional.fields.detectedUrls.value 连接成以英文逗号分隔的字符串
additional.fields.campaign_id.value.string_value 如果存在，则从 event_data.abx_body.campaign_id 映射
additional.fields.trace_id.value.string_value 如果存在，则从 event_data.abx_metadata.trace_id 映射
additional.fields.messageReportedTime.value.string_value 如果存在，则从 event_data.abx_body.message_reported_time 映射
metadata.event_type 如果存在 messages 数组，则设置为 EMAIL_TRANSACTION；否则，根据其他字段确定，可以是 USER_LOGIN、STATUS_UPDATE 或 GENERIC_EVENT
metadata.product_name 始终设置为 ABNORMAL_SECURITY
metadata.vendor_name 始终设置为 ABNORMAL_SECURITY
metadata.product_event_type 如果存在，则从 event_data.abx_metadata.event_type 映射
extensions.auth.type 如果 event_type 为 USER_LOGIN，则设置为 AUTHTYPE_UNSPECIFIED
security_result.category 如果存在消息数组，则设置为 MAIL_SPAM 和 MAIL_PHISHING，否则根据其他字段设置为 MAIL_PHISHING 和/或 MAIL_SPAM
security_result.category_details 如果 abx_metadata.event_type 为 ABUSE_MAILBOX，则设置为 ABUSE_MAILBOX；否则，如果 abx_body.category 为 login，则设置为 login
security_result.detection_fields.reported.value 如果存在，则从 event_data.abx_body.reported 映射
security_result.detection_fields.judgement.value 如果存在，则从 event_data.abx_body.judgement 映射
target.url 如果存在，则从 event_data.abx_body.details.request_url 映射
target.user.userid 如果存在，则从 event_data.abx_body.user.email 映射
target.user.email_addresses 如果存在，则从 event_data.abx_body.user.email 映射

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。