Mengumpulkan log Instance AWS EC2

Versi Parser: 1.0

Didukung di:

Dokumen ini menjelaskan cara mengonfigurasi log Instance AWS EC2 ke Google Security Operations untuk pemantauan dan analisis. Parser mengekstrak data dari log JSON pemesanan instance, merestrukturisasi dan mengganti nama kolom agar sesuai dengan UDM, menangani berbagai jenis data dan struktur bertingkat, termasuk antarmuka jaringan, grup, dan tag, sekaligus membuat hubungan aset dan metadata. Alat ini juga melakukan penanganan error dan menghapus pesan JSON yang salah format.

Sebelum memulai

  • Pastikan Anda memiliki instance Google SecOps.
  • Pastikan Anda memiliki akses istimewa ke AWS.

Mengonfigurasi AWS IAM dan S3

  1. Buat bucket Amazon S3 dengan mengikuti panduan pengguna ini: Membuat bucket.
  2. Simpan Name dan Region bucket untuk digunakan nanti.
  3. Buat pengguna dengan mengikuti panduan pengguna ini: Membuat pengguna IAM.
  4. Pilih User yang dibuat.
  5. Pilih tab kredensial keamanan.
  6. Klik Create Access Key di bagian Access Keys.
  7. Pilih Layanan pihak ketiga sebagai Kasus penggunaan.
  8. Klik Berikutnya.
  9. Opsional: tambahkan tag deskripsi.
  10. Klik Create access key.
  11. Klik Download CSV file untuk menyimpan Access Key dan Secret Access Key untuk digunakan nanti.
  12. Klik Done.
  13. Pilih tab Izin.
  14. Klik Tambahkan izin di bagian Kebijakan Izin.
  15. Pilih Add permissions.
  16. Pilih Attach policies directly
  17. Telusuri dan pilih kebijakan AmazonS3FullAccess.
  18. Klik Berikutnya.
  19. Klik Add permissions.

Mengonfigurasi EC2 untuk mengirim log ke CloudWatch Logs

  1. Gunakan SSH untuk terhubung ke instance EC2, dengan memberikan pasangan kunci Anda untuk autentikasi.

    ssh -i your-key.pem ec2-user@your-ec2-public-ip

  2. Instal agen CloudWatch Logs:

    • Untuk menginstal agen CloudWatch Logs di Amazon Linux, gunakan perintah berikut:
    sudo yum install -y awslogs
    • Untuk menginstal agen CloudWatch Logs di Ubuntu, gunakan perintah berikut:
    sudo apt-get install -y awslogs

  3. Buka file konfigurasi CloudWatch Logs:

    sudo vi /etc/awslogs/awslogs.conf

  4. Buat skrip yang mengambil Metadata Instance Log ini dan menulisnya ke file:

    #!/bin/bash
echo "Architecture: $(curl -s http://169.254.169.254/latest/meta-data/architecture)" >> /var/log/instance_metadata.log
echo "AmiLaunchIndex: $(curl -s http://169.254.169.254/latest/meta-data/ami-launch-index)" >> /var/log/instance_metadata.log
echo "BootMode: $(curl -s http://169.254.169.254/latest/meta-data/boot-mode)" >> /var/log/instance_metadata.log

  5. Simpan skrip sebagai /etc/init.d/metadata_script.sh dan jalankan saat startup instance menggunakan crontab atau rc.local.

  6. Buka file konfigurasi untuk agen CloudWatch Logs:

    sudo vi /etc/awslogs/awslogs.conf

  7. Tambahkan kode berikut ke file konfigurasi:

    [/var/log/messages]
file = /var/log/messages
log_group_name = /ec2/system/logs
log_stream_name = {instance_id}

[/var/log/secure]
file = /var/log/secure
log_group_name = /ec2/security/logs
log_stream_name = {instance_id}

[/var/log/auth.log]
file = /var/log/auth.log
log_group_name = /ec2/auth/logs
log_stream_name = {instance_id}

[/var/log/httpd/access_log]
file = /var/log/httpd/access_log
log_group_name = /ec2/application/apache/access_logs
log_stream_name = {instance_id}

[/var/log/httpd/error_log]
file = /var/log/httpd/error_log
log_group_name = /ec2/application/apache/error_logs
log_stream_name = {instance_id}

  8. Simpan konfigurasi dan keluar dari editor.

  9. Mulai agen CloudWatch Logs:

    • Di Amazon Linux:
    sudo service awslogs start
    • Di Ubuntu:
    sudo service awslogs start

  10. Pastikan agen sedang berjalan:

    sudo service awslogs status

Mengonfigurasi Izin IAM untuk Lambda dan S3

  1. Di konsol AWS IAM, buat peran IAM baru dengan izin berikut:

    • logs:PutSubscriptionFilter
    • logs:DescribeLogGroups
    • logs:GetLogEvents
    • s3:PutObject

  2. Lampirkan peran ini ke fungsi Lambda Anda yang akan mengekspor log ke S3.

Mengonfigurasi Lambda untuk Mengekspor Log ke S3

  1. Buka konsol Lambda dan buat fungsi baru.

    import boto3
import gzip
from io import BytesIO

s3 = boto3.client('s3')
logs = boto3.client('logs')

def lambda_handler(event, context):
    log_group = event['logGroup']
    log_stream = event['logStream']

    log_events = logs.get_log_events(
        logGroupName=log_group,
        logStreamName=log_stream,
        startFromHead=True
    )

    log_data = "\n".join([event['message'] for event in log_events['events']])

    # Compress and upload to S3
    compressed_data = gzip.compress(log_data.encode('utf-8'))
    s3.put_object(
        Bucket='your-s3-bucket-name',
        Key='logs/ec2-log.gz',
        Body=compressed_data
    )
  ```
    • Ganti your-s3-bucket-name dengan nama sebenarnya dari bucket S3 Anda.

  2. Lampirkan peran IAM ke fungsi Lambda yang dibuat sebelumnya.

  3. Di konsol CloudWatch, buka bagian Logs.

  4. Pilih grup log; misalnya, /ec2/system/logs.

  5. Klik Actions > Create Subscription Filter.

  6. Tetapkan destination ke Lambda function yang dibuat sebelumnya.

Mengonfigurasi feed di Google SecOps untuk menyerap log Instance AWS EC2

  1. Buka Setelan > Pengelolaan Data > Feed. Jika Anda menggunakan platform khusus SIEM, buka Settings > Feeds.
  2. Klik Tambahkan Feed Berita Baru.
  3. Di kolom Feed name, masukkan nama untuk feed; misalnya, AWS EC2 Instance Logs.
  4. Pilih Amazon S3 V2 sebagai Jenis sumber.
  5. Pilih AWS EC2 Instance sebagai Log type.
  6. Klik Berikutnya.

  7. Tentukan nilai untuk parameter input berikut:

    • S3 URI: URI bucket.
      • s3://your-log-bucket-name/
        • Ganti your-log-bucket-name dengan nama bucket yang sebenarnya.

    • Opsi penghapusan sumber: pilih opsi penghapusan sesuai preferensi Anda.

    • Usia File Maksimum: Sertakan file yang diubah dalam jumlah hari terakhir. Defaultnya adalah 180 hari.

    • Access Key ID: Kunci akses Pengguna dengan akses ke bucket s3.

    • Secret Access Key: Kunci rahasia Pengguna dengan akses ke bucket s3.

    • Namespace aset: namespace aset.

    • Label penyerapan: label yang akan diterapkan ke peristiwa dari feed ini.

  8. Klik Berikutnya.

  9. Tinjau konfigurasi feed berita baru Anda di layar Finalize, lalu klik Submit.

Format log Instance AWS EC2 yang didukung

Parser AWS EC2 Instances mendukung log dalam format JSON.

Contoh Log Instance AWS EC2 yang Didukung

  • JSON:

    {
  "GroupSet": null,
  "InstancesSet": [
    {
      "AmiLaunchIndex": 0,
      "Architecture": "x86_64",
      "BlockDeviceMapping": [
        {
          "DeviceName": "",
          "Ebs": null
        }
      ],
      "BootMode": "",
      "CapacityReservationID": "",
      "CapacityReservationSpecification": null,
      "ClientToken": "xMcwG14507example",
      "CPU": {
        "AmdSevSnp": "",
        "CoreCount": 1,
        "ThreadsPerCore": 1
      },
      "CurrentInstanceBootMode": "",
      "DNSName": "ec2-198-51-100-1.eu-west-1.compute.amazonaws.com",
      "EbsOptimized": false,
      "ElasticGpuAssociationSet": null,
      "ElasticInferenceAcceleratorAssociationSet": null,
      "EnaSupport": false,
      "EnclaveOption": false,
      "GroupSet": [
        {
          "GroupID": "sg-c1234567",
          "GroupName": "SecurityGroup1"
        }
      ],
      "HibernationOptions": false,
      "Hypervisor": "xen",
      "IamInstanceProfile": {
        "Arn": "arn:aws:iam::123456789012:instance-profile/AdminRole",
        "ID": "ABCDEFGHIJKLMNOP123AB"
      },
      "ImageID": "ami-abc32ddd",
      "InstanceID": "i-1234567890abcdef0",
      "InstanceLifecycle": "",
      "InstanceState": {
        "Code": 16,
        "Name": "running"
      },
      "InstanceType": "t2.micro",
      "IPAddress": "198.51.100.1",
      "Ipv6Address": "",
      "KernelID": "",
      "KeyName": "my_keypair",
      "LaunchTime": "2018-05-08T16:46:19.000Z",
      "LicenseSet": null,
      "MaintenanceOptions": "",
      "MetadataOptions": {
        "HTTPEndpoint": "",
        "HTTPProtocolIpv6": "",
        "HTTPPutResponseHopLimit": 0,
        "HTTPTokens": "",
        "InstanceMetadataTags": "",
        "State": ""
      },
      "Monitoring": {
        "State": "disabled"
      },
      "NetworkInterfaceSet": [
        {
          "Association": {
            "CarrierIP": "",
            "CustomerOwnedIP": "",
            "IPOwnerID": "amazon",
            "PublicDNSName": "ec2-198-51-100-1.eu-west-1.compute.amazonaws.com",
            "PublicIP": "198.51.100.1"
          },
          "Attachment": {
            "AttachmentID": "eni-attach-12345abc",
            "AttachTime": "2018-05-08T16:46:19.000Z",
            "DeleteOnTermination": true,
            "DeviceIndex": 0,
            "NetworkCardIndex": 0,
            "Status": "attached"
          },
          "Description": "Primary network interface",
          "GroupSet": [
            {
              "GroupID": "sg-a1234567",
              "GroupName": "SecurityGroup1"
            }
          ],
          "InterfaceType": "",
          "Ipv4PrefixSet": null,
          "Ipv6AddressesSet": [
            {
              "Ipv6Address": "d9a3:d3b1:03e0:0279:5196:3b5c:242b:10da",
              "IsPrimaryIpv6": false
            }
          ],
          "Ipv6PrefixSet": null,
          "MacAddress": "a2-d4-a6-24-12-f4",
          "NetworkInterfaceID": "eni-551ba033",
          "OwnerID": "123456789012",
          "PrivateDNSName": "ip-198-51-100-1.eu-west-1.compute.internal",
          "PrivateIPAddress": "198.51.100.1",
          "PrivateIPAddressesSet": [
            {
              "Association": {
                "CarrierIP": "",
                "CustomerOwnedIP": "",
                "IPOwnerID": "amazon",
                "PublicDNSName": "ec2-198-51-100-1.eu-west-1.compute.amazonaws.com",
                "PublicIP": "198.51.100.1"
              },
              "Primary": true,
              "PrivateDNSName": "ip-198-51-100-1.eu-west-1.compute.internal",
              "PrivateIPAddress": "198.51.100.1"
            }
          ],
          "SourceDestCheck": true,
          "Status": "in-use",
          "SubnetID": "subnet-56f5f633",
          "VpcID": "vpc-11112222"
        }
      ],
      "OutpostArn": "",
      "Placement": {
        "Affinity": "",
        "AvailabilityZone": "eu-west-1c",
        "GroupID": "",
        "GroupName": "",
        "HostID": "",
        "HostResourceGroupArn": "",
        "PartitionNumber": 0,
        "SpreadDomain": "",
        "Tenancy": "default"
      },
      "Platform": "",
      "PlatformDetails": "",
      "PrivateDNSName": "ip-198-51-100-1.eu-west-1.compute.internal",
      "PrivateDNSNameOptions": null,
      "PrivateIPAddress": "198.51.100.1",
      "ProductCodes": null,
      "RamdiskID": "",
      "Reason": "",
      "RootDeviceName": "/dev/xvda",
      "RootDeviceType": "ebs",
      "SourceDestCheck": true,
      "SpotInstanceRequestID": "",
      "SriovNetSupport": "",
      "StateReason": "",
      "SubnetID": "subnet-56f5f633",
      "TagSet": [
        {
          "Key": "Name",
          "Value": "Server_1"
        }
      ],
      "TpmSupport": "",
      "UsageOperation": "",
      "UsageOperationUpdateTime": "",
      "VirtualizationType": "hvm",
      "VpcID": "vpc-11112222"
    }
  ],
  "OwnerID": "123456789012",
  "RequesterID": "",
  "ReservationID": "r-1234567890abcdef0"
}

Tabel Pemetaan UDM

Kolom Log Pemetaan UDM Logika
Architecture entity.entity.asset.attribute.labels.key=instances_set_architecture, entity.entity.asset.attribute.labels.value Nilai diambil langsung dari kolom Instances.Architecture di log mentah.
AmiLaunchIndex entity.entity.asset.attribute.labels.key=instances_set_ami_launch_index, entity.entity.asset.attribute.labels.value Nilai diambil langsung dari kolom Instances.AmiLaunchIndex di log mentah.
BlockDeviceMapping.Ebs.AttachTime entity.entity.resource_ancestors.attribute.labels.key=instances_set_block_device_mapping_ebs_attach_time, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.BlockDeviceMapping.Ebs.AttachTime.
BlockDeviceMapping.Ebs.DeleteOnTermination entity.entity.resource_ancestors.attribute.labels.key=instances_set_block_device_mapping_ebs_delete_on_termination, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.BlockDeviceMapping.Ebs.DeleteOnTermination.
BlockDeviceMapping.Ebs.Status entity.entity.resource_ancestors.attribute.labels.key=instances_set_block_device_mapping_ebs_volume_status, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.BlockDeviceMapping.Ebs.Status.
BlockDeviceMapping.Ebs.VolumeID entity.entity.resource_ancestors.product_object_id, entity.entity.resource_ancestors.resource_type=VOLUME Nilai diambil dari Instances.BlockDeviceMapping.Ebs.VolumeID.
BlockDeviceMapping.Name entity.entity.resource_ancestors.attribute.labels.key=instances_set_block_device_mapping_device_name, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.BlockDeviceMapping.Name.
BootMode entity.entity.asset.attribute.labels.key=instances_set_boot_mode, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.BootMode.
CapacityReservationID entity.entity.asset.attribute.labels.key=instances_set_capacity_reservation_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.CapacityReservationID.
CapacityReservationSpecification.CapacityReservationPreference entity.entity.asset.attribute.labels.key=instances_set_capacity_reservation_specification_capacity_reservation_preference, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.CapacityReservationSpecification.CapacityReservationPreference.
CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationID entity.entity.asset.attribute.labels.key=instances_set_capacity_reservation_specification_capacity_reservation_target_capacity_reservation_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationID.
CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArn entity.entity.resource_ancestors.name, entity.entity.resource_ancestors.resource_subtype=Capacity Reservation Arn Nilai diambil dari Instances.CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArn.
ClientToken entity.entity.asset.attribute.labels.key=instances_set_client_token, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ClientToken.
CPU.AmdSevSnp entity.entity.asset.attribute.labels.key=instances_set_cpu_options_amd_sev_snp, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.CPU.AmdSevSnp.
CPU.CoreCount entity.entity.asset.hardware.cpu_number_cores Nilai diambil dari Instances.CPU.CoreCount.
CPU.ThreadsPerCore entity.entity.asset.attribute.labels.key=instances_set_cpu_options_threads_per_core, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.CPU.ThreadsPerCore.
CurrentInstanceBootMode entity.entity.asset.attribute.labels.key=instances_set_current_instance_boot_mode, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.CurrentInstanceBootMode.
DNSName entity.entity.network.dns_domain Nilai diambil dari Instances.DNSName.
EbsOptimized entity.entity.asset.attribute.labels.key=instances_set_ebs_optimized, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.EbsOptimized.
ElasticGpuAssociationSet.ElasticGpuAssociationID entity.entity.asset.attribute.labels.key=instances_set_elastic_gpu_association_set_elastic_gpu_association_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ElasticGpuAssociationSet.ElasticGpuAssociationID.
ElasticGpuAssociationSet.ElasticGpuAssociationState entity.entity.asset.attribute.labels.key=instances_set_elastic_gpu_association_set_elastic_gpu_association_state, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ElasticGpuAssociationSet.ElasticGpuAssociationState.
ElasticGpuAssociationSet.ElasticGpuAssociationTime entity.entity.asset.attribute.labels.key=instances_set_elastic_gpu_association_set_elastic_gpu_association_time, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ElasticGpuAssociationSet.ElasticGpuAssociationTime.
ElasticGpuAssociationSet.ElasticGpuID entity.entity.asset.attribute.labels.key=instances_set_elastic_gpu_association_set_elastic_gpu_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ElasticGpuAssociationSet.ElasticGpuID.
ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorArn entity.entity.resource_ancestors.name, entity.entity.resource_ancestors.resource_subtype=Elastic Interface Accelerator Arn Nilai diambil dari Instances.ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorArn.
ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorAssociationID entity.entity.resource_ancestors.attribute.labels.key=instances_set_elastic_inference_accelerator_association_set_elastic_inference_accelerator_association_id, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorAssociationID.
ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorAssociationState entity.entity.resource_ancestors.attribute.labels.key=instances_set_elastic_inference_accelerator_association_set_elastic_inference_accelerator_association_state, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorAssociationState.
ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorAssociationTime entity.entity.resource_ancestors.attribute.labels.key=instances_set_elastic_inference_accelerator_association_set_elastic_inference_accelerator_association_time, entity.entity.resource_ancestors.attribute.labels.value Nilai diambil dari Instances.ElasticInferenceAcceleratorAssociationSet.ElasticInferenceAcceleratorAssociationTime.
EnaSupport entity.entity.asset.attribute.labels.key=instances_set_ena_support, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.EnaSupport.
EnclaveOptions.Enabled entity.entity.asset.attribute.labels.key=instances_set_enclave_options_enabled, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.EnclaveOptions.Enabled.
GroupSet.GroupID entity.entity.group.product_object_id, entity.entity.group.attribute.labels.key=group_set_group_id, entity.entity.group.attribute.labels.value, entity.entity.group.attribute.labels.key=instances_set_group_set_group_id, entity.entity.group.attribute.labels.value, entity.entity.group.attribute.labels.key=instances_set_network_interface_set_group_set_group_id, entity.entity.group.attribute.labels.value Nilai diambil dari GroupSet.GroupID. GroupID pertama dalam array dipetakan ke entity.entity.group.product_object_id. Nilai GroupID berikutnya dipetakan sebagai label.
GroupSet.GroupName entity.entity.group.group_display_name, entity.entity.group.attribute.labels.key=group_set_group_name, entity.entity.group.attribute.labels.value, entity.entity.group.attribute.labels.key=instances_set_group_set_group_name, entity.entity.group.attribute.labels.value, entity.entity.group.attribute.labels.key=instances_set_network_interface_set_group_set_group_name, entity.entity.group.attribute.labels.value Nilai diambil dari GroupSet.GroupName. GroupName pertama dalam array dipetakan ke entity.entity.group.group_display_name. Nilai GroupName berikutnya dipetakan sebagai label.
HibernationOptions entity.entity.asset.attribute.labels.key=instances_set_hibernation_options, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.HibernationOptions.
HibernationOptions.Configured entity.entity.asset.attribute.labels.key=instances_set_hibernation_options_configured, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.HibernationOptions.Configured.
Hypervisor entity.entity.asset.attribute.labels.key=instances_set_hypervisor, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Hypervisor.
IamInstanceProfile.Arn entity.entity.resource_ancestors.name, entity.entity.resource_ancestors.resource_subtype=Instance Profile Arn Nilai diambil dari Instances.IamInstanceProfile.Arn.
IamInstanceProfile.ID entity.entity.resource_ancestors.product_object_id Nilai diambil dari Instances.IamInstanceProfile.ID.
ImageID entity.entity.resource_ancestors.product_object_id, entity.entity.resource_ancestors.resource_type=IMAGE Nilai diambil dari Instances.ImageID.
InstanceID entity.metadata.product_entity_id, entity.entity.asset.asset_id Nilai diambil dari Instances.InstanceID.
InstanceLifecycle entity.entity.asset.attribute.labels.key=instances_set_instance_lifecycle, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.InstanceLifecycle.
InstanceState.Code entity.entity.asset.attribute.labels.key=instances_set_instance_state_code, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.InstanceState.Code.
InstanceState.Name entity.entity.asset.deployment_status Nilai ini berasal dari Instances.InstanceState.Name. Jika nilainya adalah running, kolom UDM akan ditetapkan ke ACTIVE. Jika nilainya adalah shutting-down atau stopping, kolom UDM akan ditetapkan ke PENDING_DECOMMISSION. Jika nilainya adalah stopped atau terminated, kolom UDM akan ditetapkan ke DECOMMISSIONED.
InstanceType entity.entity.asset.category Nilai diambil dari Instances.InstanceType.
IPAddress entity.entity.asset.ip Nilai diambil dari Instances.IPAddress.
Ipv6Address entity.entity.asset.ip Nilai diambil dari Instances.Ipv6Address.
KernelID entity.entity.asset.attribute.labels.key=instances_set_kernel_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.KernelID.
KeyName entity.entity.asset.attribute.labels.key=instances_set_key_name, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.KeyName.
LaunchTime entity.metadata.creation_timestamp Nilai diambil dari Instances.LaunchTime.
LicenseSet.LicenseConfigurationArn entity.entity.resource_ancestors.name, entity.entity.resource_ancestors.resource_subtype=License Configuration Arn Nilai diambil dari Instances.LicenseSet.LicenseConfigurationArn.
MaintenanceOptions entity.entity.asset.attribute.labels.key=instances_set_maintenance_options_auto_recovery, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MaintenanceOptions.
MetadataOptions.HTTPEndpoint entity.entity.asset.attribute.labels.key=instances_set_metadata_options_http_endpoint, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MetadataOptions.HTTPEndpoint.
MetadataOptions.HTTPProtocolIpv6 entity.entity.asset.attribute.labels.key=instances_set_metadata_options_http_protocol_ipv6, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MetadataOptions.HTTPProtocolIpv6.
MetadataOptions.HTTPPutResponseHopLimit entity.entity.asset.attribute.labels.key=instances_set_metadata_options_http_put_response_hop_limit, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MetadataOptions.HTTPPutResponseHopLimit.
MetadataOptions.HTTPTokens entity.entity.asset.attribute.labels.key=instances_set_metadata_options_http_tokens, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MetadataOptions.HTTPTokens.
MetadataOptions.InstanceMetadataTags entity.entity.asset.attribute.labels.key=instances_set_metadata_options_instance_metadata_tags, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MetadataOptions.InstanceMetadataTags.
MetadataOptions.State entity.entity.asset.attribute.labels.key=instances_set_metadata_options_state, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.MetadataOptions.State.
Monitoring.State entity.entity.asset.attribute.labels.key=instances_set_monitoring_state, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Monitoring.State.
NetworkInterfaceSet.Association.CarrierIP entity.entity.asset.nat_ip Nilai diambil dari Instances.NetworkInterfaceSet.Association.CarrierIP.
NetworkInterfaceSet.Association.CustomerOwnedIP entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_association_customer_owned_ip, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Association.CustomerOwnedIP.
NetworkInterfaceSet.Association.IPOwnerID entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_association_ip_owner_id, entity.entity.asset.attribute.labels.value, entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_private_ip_addresses_set_association_ip_owner_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Association.IPOwnerID.
NetworkInterfaceSet.Association.PublicDNSName entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_association_public_dns_name, entity.entity.asset.attribute.labels.value, entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_private_ip_addresses_set_association_public_dns_name, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Association.PublicDNSName.
NetworkInterfaceSet.Association.PublicIP entity.entity.asset.ip Nilai diambil dari Instances.NetworkInterfaceSet.Association.PublicIP.
NetworkInterfaceSet.Attachment.AttachTime entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_attachment_attach_time, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Attachment.AttachTime.
NetworkInterfaceSet.Attachment.AttachmentID entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_attachment_attachment_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Attachment.AttachmentID.
NetworkInterfaceSet.Attachment.DeleteOnTermination entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_attachment_delete_on_termination, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Attachment.DeleteOnTermination.
NetworkInterfaceSet.Attachment.DeviceIndex entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_attachment_device_index, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Attachment.DeviceIndex.
NetworkInterfaceSet.Attachment.NetworkCardIndex entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_attachment_network_card_index, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Attachment.NetworkCardIndex.
NetworkInterfaceSet.Attachment.Status entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_attachment_status, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Attachment.Status.
NetworkInterfaceSet.Description entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_description, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Description.
NetworkInterfaceSet.GroupSet.GroupID entity.entity.group.attribute.labels.key=instances_set_network_interface_set_group_set_group_id, entity.entity.group.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.GroupSet.GroupID.
NetworkInterfaceSet.GroupSet.GroupName entity.entity.group.attribute.labels.key=instances_set_network_interface_set_group_set_group_name, entity.entity.group.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.GroupSet.GroupName.
NetworkInterfaceSet.InterfaceType entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_interface_type, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.InterfaceType.
NetworkInterfaceSet.Ipv6AddressesSet.Ipv6Address entity.entity.asset.ip Nilai diambil dari Instances.NetworkInterfaceSet.Ipv6AddressesSet.Ipv6Address.
NetworkInterfaceSet.Ipv6AddressesSet.IsPrimaryIpv6 entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_ipv6_addresses_set_is_primary_ipv6, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Ipv6AddressesSet.IsPrimaryIpv6.
NetworkInterfaceSet.MacAddress entity.entity.asset.mac Nilai diambil dari Instances.NetworkInterfaceSet.MacAddress.
NetworkInterfaceSet.NetworkInterfaceID entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_network_interface_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.NetworkInterfaceID.
NetworkInterfaceSet.OwnerID entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_owner_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.OwnerID.
NetworkInterfaceSet.PrivateDNSName entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_private_dns_name, entity.entity.asset.attribute.labels.value, entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_private_ip_addresses_set_private_dns_name, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.PrivateDNSName.
NetworkInterfaceSet.PrivateIPAddress entity.entity.asset.ip Nilai diambil dari Instances.NetworkInterfaceSet.PrivateIPAddress.
NetworkInterfaceSet.PrivateIPAddressesSet.Primary entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_private_ip_addresses_set_primary, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.PrivateIPAddressesSet.Primary.
NetworkInterfaceSet.PrivateIPAddressesSet.PrivateIPAddress entity.entity.asset.ip Nilai diambil dari Instances.NetworkInterfaceSet.PrivateIPAddressesSet.PrivateIPAddress.
NetworkInterfaceSet.SourceDestCheck entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_source_dest_check, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.SourceDestCheck.
NetworkInterfaceSet.Status entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_status, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.Status.
NetworkInterfaceSet.SubnetID entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_subnet_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.SubnetID.
NetworkInterfaceSet.VpcID entity.entity.asset.attribute.labels.key=instances_set_network_interface_set_vpc_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.NetworkInterfaceSet.VpcID.
OutpostArn entity.relations.entity.asset.product_object_id Nilai diambil dari Instances.OutpostArn.
Placement.Affinity entity.entity.asset.attribute.labels.key=instances_set_placement_affinity, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Placement.Affinity.
Placement.AvailabilityZone entity.entity.asset.attribute.cloud.availability_zone Nilai diambil dari Instances.Placement.AvailabilityZone.
Placement.GroupID entity.entity.group.attribute.labels.key=instances_set_placement_group_id, entity.entity.group.attribute.labels.value Nilai diambil dari Instances.Placement.GroupID.
Placement.GroupName entity.entity.group.attribute.labels.key=instances_set_placement_group_name, entity.entity.group.attribute.labels.value Nilai diambil dari Instances.Placement.GroupName.
Placement.HostID entity.relations.entity.asset.asset_id Nilai diambil dari Instances.Placement.HostID.
Placement.HostResourceGroupArn entity.relations.entity.asset.attribute.labels.key=instances_set_placement_host_resource_group_arn, entity.relations.entity.asset.attribute.labels.value Nilai diambil dari Instances.Placement.HostResourceGroupArn.
Placement.PartitionNumber entity.entity.asset.attribute.labels.key=instances_set_placement_partition_number, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Placement.PartitionNumber.
Placement.SpreadDomain entity.entity.asset.attribute.labels.key=instances_set_placement_spread_domain, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Placement.SpreadDomain.
Placement.Tenancy entity.entity.asset.attribute.labels.key=instances_set_placement_tenancy, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Placement.Tenancy.
PlatformDetails entity.entity.asset.attribute.labels.key=instances_set_platform_details, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.PlatformDetails.
PrivateDNSName entity.entity.network.dns.questions.name Nilai diambil dari Instances.PrivateDNSName.
PrivateDNSNameOptions.EnableResourceNameDnsAAAARecord entity.entity.network.dns.questions.type Jika nilainya adalah true, kolom UDM akan ditetapkan ke 28.
PrivateDNSNameOptions.EnableResourceNameDnsARecord entity.entity.network.dns.questions.type Jika nilainya adalah true, kolom UDM akan ditetapkan ke 1.
PrivateDNSNameOptions.HostnameType entity.entity.asset.attribute.labels.key=instances_set_private_dns_name_options_hostname_type, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.PrivateDNSNameOptions.HostnameType.
PrivateIPAddress entity.entity.asset.ip Nilai diambil dari Instances.PrivateIPAddress.
ProductCodes.ProductCode entity.entity.asset.attribute.labels.key=instances_set_product_codes_product_code, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ProductCodes.ProductCode.
ProductCodes.Type entity.entity.asset.attribute.labels.key=instances_set_product_codes_type, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.ProductCodes.Type.
RamdiskID entity.entity.asset.attribute.labels.key=instances_set_ramdisk_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.RamdiskID.
Reason entity.entity.asset.attribute.labels.key=instances_set_reason, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.Reason.
ReservationID entity.additional.fields.key=reservation_id, entity.additional.fields.value.string_value Nilai diambil dari ReservationID.
RequesterID entity.additional.fields.key=requester_id, entity.additional.fields.value.string_value Nilai diambil dari RequesterID.
RootDeviceName entity.entity.asset.attribute.labels.key=instances_set_root_device_name, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.RootDeviceName.
RootDeviceType entity.entity.asset.attribute.labels.key=instances_set_root_device_type, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.RootDeviceType.
SourceDestCheck entity.entity.asset.attribute.labels.key=instances_set_source_dest_check, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.SourceDestCheck.
SpotInstanceRequestID entity.entity.asset.attribute.labels.key=instances_set_spot_instance_request_id, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.SpotInstanceRequestID.
SriovNetSupport entity.entity.asset.attribute.labels.key=instances_set_sriov_net_support, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.SriovNetSupport.
StateReason entity.entity.asset.attribute.labels.key=instances_set_state_reason_code, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.StateReason.
StateReason.Code entity.entity.asset.attribute.labels.key=instances_set_state_reason_code, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.StateReason.Code.
StateReason.Message entity.entity.asset.attribute.labels.key=instances_set_state_reason_message, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.StateReason.Message.
SubnetID entity.entity.resource_ancestors.product_object_id, entity.entity.resource_ancestors.resource_type=SUBNET Nilai diambil dari Instances.SubnetID.
TagSet.Key entity.entity.asset.attribute.labels.key Nilai diambil dari Instances.TagSet.Key.
TagSet.Value entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.TagSet.Value.
TpmSupport entity.entity.asset.attribute.labels.key=instances_set_tpm_support, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.TpmSupport.
UsageOperation entity.entity.asset.attribute.labels.key=instances_set_usage_operation, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.UsageOperation.
UsageOperationUpdateTime entity.entity.asset.attribute.labels.key=instances_set_usage_operation_update_time, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.UsageOperationUpdateTime.
VirtualizationType entity.entity.asset.attribute.labels.key=instances_set_virtualization_type, entity.entity.asset.attribute.labels.value Nilai diambil dari Instances.VirtualizationType.
VpcID entity.entity.resource_ancestors.product_object_id, entity.entity.resource_ancestors.resource_type=VPC_NETWORK Nilai diambil dari Instances.VpcID.
collection_time entity.metadata.collected_timestamp Nilai diambil langsung dari kolom collection_time di log mentah. Dihardcode ke AMAZON_WEB_SERVICES. Dihardcode ke AMAZON_WEB_SERVICES untuk jenis resource IMAGE, VOLUME, SUBNET, VPC_NETWORK, Instance Profile Arn, Capacity Reservation Arn, Elastic Interface Accelerator Arn, dan License Configuration Arn. Dihardcode ke SERVER. Dihardcode ke Amazon EC2. Dihardcode ke AWS. Di-hardcode ke ASSET jika Instances.Placement.HostID ada dan tidak kosong. Di-hardcode ke EXECUTES jika Instances.Placement.HostID ada dan tidak kosong. Dihardcode ke ASSET.

Log Perubahan

Melihat Log Perubahan untuk parser ini

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.