Chrome Enterprise 데이터 수집

다음에서 지원:

Google secops SIEM

참고: 이 기능은 Google Security Operations 서비스 특정 약관에 있는 GA 이전 서비스 약관이 적용됩니다. GA 이전 기능에서 지원이 제한될 수 있으며 GA 이전 기능의 변경사항은 다른 GA 이전 버전과 호환되지 않을 수 있습니다. 자세한 내용은 Google SecOps 기술 지원 서비스 가이드라인 및 Google SecOps 서비스 특정 약관을 참고하세요.

이 문서에서는 엔터프라이즈 보고 커넥터를 사용하여 Google Chrome 로그를 Google SecOps에 수집하는 방법을 설명합니다. Google Chrome Enterprise Core 및 Chrome Enterprise Premium 배포의 데이터 수집 프로세스를 자세히 설명하며, 일부 고급 로그 데이터에는 Chrome Enterprise Premium 라이선스가 필요하다고 명시합니다.

일반적인 배포

일반적인 배포는 다음 구성요소의 조합으로 구성됩니다.

• Chrome: 수집하려는 Chrome 브라우저 및 ChromeOS 관리 이벤트입니다.

• ChromeOS: ChromeOS 관리 기기가 Google SecOps에 로그를 전송하도록 구성할 수 있습니다. ChromeOS 기기는 선택사항입니다.

• Chrome Enterprise 보고 커넥터: Chrome Enterprise 보고 커넥터는 Chrome 로그를 Google SecOps로 전달합니다.

• Google SecOps: Chrome 로그를 보관하고 분석합니다.

시작하기 전에

• Google Workspace 관리자 계정
• Google Chrome 137 이상 이전 버전에서는 완전한 리퍼러 URL 데이터를 제공하지 않습니다.
• 고급 기능을 위한 Chrome Enterprise Premium 라이선스
• 선택사항: Google SecOps 수집 토큰입니다. 이 옵션을 사용하는 경우 Google Workspace 관리 콘솔의 Google Workspace Customer ID도 필요합니다.
• 선택사항: Google SecOps 담당자가 제공하는 Chronicle 수집 API 키

참고: Chrome Enterprise Premium에서 지원하는 두 지리적 리전이 Google SecOps 인스턴스의 데이터 상주 리전과 일치하지 않을 수 있습니다.

Chrome 브라우저 클라우드 관리 설정

1. Chrome 브라우저의 클라우드 관리를 사용 설정하려면 타겟 기기를 등록하세요. 자세한 내용은 클라우드 관리 Chrome 브라우저 등록하기를 참고하세요.

2. 선택사항: 의심스러운 파일 조사를 위해 증거 보관함을 구성합니다. (Chrome Enterprise Premium만 해당)

3. 선택사항: Identity-Aware Proxy를 사용하는 경우 Chrome Enterprise Premium 컨텍스트 액세스 인식 데이터 수집의 단계를 실행하여 이 데이터를 Google SecOps에 통합합니다.

Chrome 데이터를 Google SecOps 인스턴스에 연결

Chrome 관리 파서와 Chrome Enterprise 보고 커넥터를 구성합니다.

Chrome 관리 파서 구성

최신 Chrome 로그를 지원하려면 Chrome 관리 파서를 새 버전으로 업데이트해야 할 수 있습니다.

1. Google SecOps 인스턴스에서 메뉴 > 설정 > 파서로 이동합니다.
2. Chrome 관리 미리 빌드 항목을 찾아 보류 중인 업데이트를 적용하여 버전 날짜가 2025-08-14 이상인지 확인합니다.

Chrome Enterprise Premium 구성

이 섹션에서는 Chrome Enterprise Premium의 로깅을 설정하는 방법을 설명합니다.

세이프 브라우징의 컨텍스트가 포함된 Chrome Enterprise Premium의 로그 전달을 구성할 수 있습니다. Chrome Enterprise Premium용 Chrome Enterprise 보고 커넥터는 다음 로그 유형을 구성하고 선택적으로 전달할 수 있습니다.

• 브라우저 비정상 종료
• 콘텐츠 전송
• 데이터 액세스 제어
• 확장 프로그램 설치
• 확장 프로그램 텔레메트리
• Google 로그인 활동
• 멀웨어 전송
• 비밀번호 유출
• 비밀번호가 변경됨
• 비밀번호 재사용
• 민감한 정보 전송
• 의심스러운 URL
• 안전하지 않은 사이트 방문
• URL 필터링 전면 광고
• URL 탐색

내보낼 Chrome Enterprise Premium 데이터 설정하기

권장 보안 설정을 사용하여 Chrome Enterprise Premium 로깅을 위한 Chrome Enterprise 보고 커넥터를 구성하려면 다음 단계를 따르세요.

1. Google 관리 콘솔에서 메뉴 > Chrome 브라우저 > 커넥터로 이동합니다.
2. Chrome Enterprise 데이터용 Google SecOps 소개 배너에서 세부정보 보기 및 사용 설정을 클릭합니다.
3. Chrome Enterprise Premium용 Google SecOps 사용 설정 페이지에서 구성 이름을 입력합니다.
4. Chrome Enterprise 보고 커넥터 구성에 설명된 대로 전달 옵션을 선택합니다.

Chrome Enterprise 보고 커넥터 구성하기

Chrome Enterprise 보고 커넥터는 Chrome Enterprise Premium과 Chrome Enterprise Core 모두에 대해 로그 데이터를 Google SecOps로 전송합니다.

다음 옵션 중 하나를 사용하여 Chrome 데이터를 Google SecOps로 전송하도록 Chrome Enterprise 보고 커넥터를 구성합니다.

• 이전에 Google Cloud 감사 로그를 Google SecOps로 전달하도록 구성한 경우 Chrome Enterprise Premium 로그를 전송하는 옵션이 있을 수 있습니다. 자세한 내용은
  동일한 조직의 Google SecOps 인스턴스로 Chrome 전달 구성하기를 참고하세요.

• Google SecOps에서 생성된 임시 토큰 코드를 사용하여 Chrome Enterprise Premium 인스턴스로의 전달을 구성할 수 있습니다. 자세한 내용은
  통합 토큰을 사용하여 Google SecOps에 Chrome 전달 구성하기를 참고하세요.

• 또는 Chronicle Ingestion API 키를 사용할 수 있습니다. 자세한 내용은
  Chronicle 수집 API를 사용하여 Google SecOps에 Chrome 전달 구성을 참고하세요.

동일한 조직의 Google SecOps 인스턴스로 Chrome 전달 구성

다음 필수 요건을 모두 충족하는 경우 커넥터 구성에서 기존 Google SecOps 인스턴스를 선택할 수 있습니다.

• Google SecOps 인스턴스가 Google Cloud 프로젝트에 연결되어 있습니다.

• Google Cloud 프로젝트가 Chrome Enterprise Premium을 관리하는 Google Workspace와 동일한 조직에 있습니다.

• 이전에 해당 조직에서 Google SecOps로 Cloud 감사 로그 통합을 구성했습니다.

이러한 사전 요구사항을 충족하면 Google SecOps 인스턴스가 연결된 GCP 계정의 인스턴스 사용 아래의 선택 목록에 표시됩니다.

동일한 조직의 Google SecOps 인스턴스로 Chrome 전달을 구성하려면 다음 단계를 따르세요.

1. 구성의 이름을 입력합니다.
2. 연결된 GCP 계정의 인스턴스 사용 옵션에서 Google SecOps 인스턴스를 선택합니다.
3. 로그 내보내기 설정에서 전달할 로그 유형을 선택합니다.
4. 연결 테스트를 클릭합니다.
5. 연결 테스트가 완료되면 사용 설정을 클릭합니다.
6. 구성이 완료되면 완료를 클릭합니다.

통합 토큰을 사용하여 Google SecOps로 Chrome 전달 구성

대상 Google SecOps 인스턴스가 선택 목록에 표시되지 않거나 Chrome 로그를 다른 Google Cloud의 Google SecOps 인스턴스로 전달해야 하는 경우 다음 단계를 따르세요.

1. 대상 인스턴스의 Google SecOps 관리자에게 Google Workspace 고객 ID를 제공하고 Google SecOps 인스턴스 ID와 토큰을 가져오도록 합니다. 이 토큰은 24시간 동안 유효합니다.

2. 구성의 이름을 입력합니다.

3. 조직 외부의 인스턴스 사용을 선택합니다.

4. Google SecOps 관리자가 제공한 토큰 코드를 입력합니다.

5. 로그 내보내기 설정에서 전달할 로그 유형을 선택합니다.

6. Test Connection(연결 테스트)을 클릭합니다.

7. 연결 테스트가 완료되면 사용 설정을 클릭합니다.

8. 구성이 완료되면 완료를 클릭합니다.

Chronicle 수집 API를 사용하여 Google SecOps로 Chrome 전달 구성

Chronicle 수집 API 키를 사용하여 Google Chrome 보고 커넥터를 구성할 수 있습니다. 다른 통합 방법을 사용할 수 없는 경우에만 이 방법을 사용해야 합니다.

1. 관리 콘솔에서 메뉴 > 기기 > Chrome > 커넥터로 이동합니다.

2. + 새 제공업체 구성을 클릭합니다.

3. 측면 패널에서 Google SecOps 설정을 찾아 설정을 클릭합니다.

4. 구성 ID, API 키, 호스트 이름을 입력합니다.

   • 구성 ID: ID는 사용자 및 브라우저 설정 페이지와 커넥터 페이지에 표시됩니다.

   • API 키: 고객을 식별하기 위해 Chronicle 수집 API를 호출할 때 지정할 API 키입니다.

   • 호스트 이름: Ingestion API 엔드포인트입니다. 미국 고객의 경우 malachiteingestion-pa.googleapis.com이어야 합니다. 다른 지역의 경우 리전별 엔드포인트 문서를 참고하세요.

5. 구성 추가를 클릭하여 새 제공업체 구성을 추가합니다.

Chrome Enterprise Premium 컨텍스트 액세스 인식 데이터 수집

피드를 설정하여 IAP (Identity-Aware Proxy) 및 컨텍스트 인식 액세스 데이터와 관련된 Chrome Enterprise Premium 콘텐츠를 수집합니다.

참고: Chrome Enterprise Core (CEC) 고객은 이 기능을 사용할 수 없습니다.

누가 Identity-Aware Proxy API를 사용 설정해야 하나요?

• IAP (Identity-Aware Proxy) 데이터를 사용하는 Chrome Enterprise Premium 고객은 이를 사용 설정해야 합니다.
• Identity-Aware Proxy 데이터를 사용하지 않는 Chrome Enterprise Premium 고객의 경우 Identity-Aware Proxy API를 사용 설정하는 것은 선택사항이지만 권장됩니다. 이렇게 하면 컨텍스트 인식 액세스 데이터 필드가 로그 데이터에 추가됩니다.

Identity-Aware Proxy API를 사용 설정하려면 Chrome Enterprise Premium 컨텍스트 액세스 인식 데이터 수집의 단계를 따르세요.

데이터 흐름 확인

데이터 흐름을 확인하려면 다음 단계를 따르세요.

1. Google SecOps 인스턴스를 엽니다.
2. 메뉴 > 검색으로 이동합니다.
3. 다음 검색어를 실행하여 파싱되지 않은 원시 이벤트를 찾습니다. metadata.log_type = "CHROME_MANAGEMENT"

지원되는 로그 유형

다음 섹션은 CHROME_MANAGEMENT 파서에 적용됩니다.

지원되는 로그 이벤트

보안 카테고리	이벤트 유형
Audit Activity	CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT browserExtensionInstallEvent browserCrashEvent extensionTelemetryEvent loginEvent passwordChangedEvent
ChromeOS	ChromeOS 로그인 실패 (CHROME_OS_LOGIN_FAILURE_EVENT) ChromeOS 로그인 성공 (CHROME_OS_LOGIN_EVENT) ChromeOS 로그아웃 (CHROME_OS_LOGOUT_EVENT) ChromeOS 사용자가 추가됨 (CHROME_OS_ADD_USER) ChromeOS 사용자가 삭제됨 (CHROME_OS_REMOVE_USER) ChromeOS 잠금 완료 (CHROMEOS_AFFILIATED_LOCK_SUCCESS) ChromeOS 잠금 해제 완료 (CHROMEOS_AFFILIATED_UNLOCK_SUCCESS) ChromeOS 잠금 해제 실패 (CHROMEOS_AFFILIATED_UNLOCK_FAILURE) ChromeOS 기기 부팅 상태 변경 (CHROMEOS_DEVICE_BOOT_STATE_CHANGE) ChromeOS 기기에 USB 기기가 추가됨 (CHROMEOS_PERIPHERAL_ADDED) ChromeOS 기기에서 USB 기기가 삭제됨 (CHROMEOS_PERIPHERAL_REMOVED) ChromeOS USB 상태 변경 (CHROMEOS_PERIPHERAL_STATUS_UPDATED) ChromeOS CRD 호스트가 시작됨 (CHROME_OS_CRD_HOST_STARTED) ChromeOS CRD 클라이언트가 연결됨 (CHROME_OS_CRD_CLIENT_CONNECTED) ChromeOS CRD 클라이언트 연결 해제됨 (CHROME_OS_CRD_CLIENT_DISCONNECTED) ChromeOS CRD 호스트가 중지됨 (CHROME_OS_CRD_HOST_ENDED)
Credential Security	passwordReuseEvent passwordBreachEvent
Data Protection	dataAccessControlEvent sensitiveDataEvent sensitiveDataTransferEvent
File Transfer	contentTransferEvent dangerousDownloadEvent unscannedFileEvent
Malicious Activity	badNavigationEvent dangerousDownloadEvent malwareTransferEvent
Navigation	interstitialEvent urlFilteringInterstitialEvent urlNavigationEvent SafeBrowsingInterstitialEvent suspiciousUrlEvent

지원되는 Chrome 로그 형식

CHROME_MANAGEMENT 파서는 JSON 형식의 로그를 지원합니다.

지원되는 Chrome 샘플 로그

Chrome Management 파서에서 수집할 원시 로그의 샘플(JSON 형식)은 다음과 같습니다.

• JSON:

  {
    "event": "badNavigationEvent",
    "time": "1622093983.104",
    "reason": "SOCIAL_ENGINEERING",
    "result": "EVENT_RESULT_WARNED",
    "device_name": "",
    "device_user": "",
    "profile_user": "[e-mail]",
    "url": "https://test.domain.com/s/phishing.html",
    "device_id": "e9806c71-0f4e-4dfa-8c52-93c05420bb8f",
    "os_platform": "",
    "os_version": "",
    "browser_version": "109.0.5414.120",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
    "client_type": "CHROME_BROWSER_PROFILE"
  }
  

필드 매핑 참조

다음 필드 매핑 표는 CHROME_MANAGEMENT 파서 (로그 유형)와 관련이 있습니다.

이 섹션에서는 Google SecOps 파서가 Chrome 로그 필드를 데이터 세트의 Google SecOps 통합 데이터 모델(UDM) 필드에 매핑하는 방식을 설명합니다.

필드 매핑 참조: 이벤트 식별자에서 이벤트 유형으로

다음 표에는 CHROME_MANAGEMENT 로그 유형과 해당 UDM 이벤트 유형이 나와 있습니다.

Event Identifier	Event Type	Security Category
badNavigationEvent - SOCIAL_ENGINEERING	USER_RESOURCE_ACCESS	SOCIAL_ENGINEERING
badNavigationEvent - SSL_ERROR	USER_RESOURCE_ACCESS	NETWORK_SUSPICIOUS
badNavigationEvent - MALWARE	USER_RESOURCE_ACCESS	SOFTWARE_MALICIOUS
badNavigationEvent - UNWANTED_SOFTWARE	USER_RESOURCE_ACCESS	SOFTWARE_PUA
badNavigationEvent - THREAT_TYPE_UNSPECIFIED	USER_RESOURCE_ACCESS	SOFTWARE_MALICIOUS
browserCrashEvent	STATUS_UPDATE
browserExtensionInstallEvent	USER_RESOURCE_UPDATE_CONTENT
Extension install - BROWSER_EXTENSION_INSTALL	USER_RESOURCE_UPDATE_CONTENT
EXTENSION_REQUEST	USER_UNCATEGORIZED
CHROME_OS_ADD_USER - CHROMEOS_AFFILIATED_USER_ADDED	USER_CREATION
CHROME_OS_ADD_USER - CHROMEOS_UNAFFILIATED_USER_ADDED	USER_CREATION
ChromeOS user added - CHROMEOS_UNAFFILIATED_USER_ADDED	USER_CREATION
ChromeOS user removed - CHROMEOS_UNAFFILIATED_USER_REMOVED	USER_DELETION
CHROME_OS_REMOVE_USER - CHROMEOS_AFFILIATED_USER_REMOVED	USER_DELETION
CHROME_OS_REMOVE_USER - CHROMEOS_UNAFFILIATED_USER_REMOVED	USER_DELETION
Login events	USER_LOGIN
LOGIN_EVENT - CHROMEOS_UNAFFILIATED_LOGIN	USER_LOGIN
loginEvent	USER_LOGIN
ChromeOS login success	USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_AFFILIATED_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_UNAFFILIATED_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_GUEST_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_KIOSK_SESSION_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_GUEST_SESSION_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_EVENT - CHROMEOS_MANAGED_GUEST_SESSION_LOGIN	USER_LOGIN
ChromeOS login failure - CHROMEOS_AFFILIATED_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_FAILURE_EVENT - CHROMEOS_AFFILIATED_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_FAILURE_EVENT - CHROMEOS_UNAFFILIATED_LOGIN	USER_LOGIN
CHROME_OS_LOGIN_LOGOUT_EVENT - CHROMEOS_AFFILIATED_LOGIN	USER_LOGIN
CHROME_OS_LOGOUT_EVENT - CHROMEOS_AFFILIATED_LOGOUT	USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_GUEST_LOGOUT	USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_MANAGED_GUEST_SESSION_LOGOUT	USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_UNAFFILIATED_LOGOUT	USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_KIOSK_SESSION_LOGOUT	USER_LOGOUT
CHROME_OS_LOGOUT_EVENT - CHROMEOS_GUEST_SESSION_LOGOUT	USER_LOGOUT
ChromeOS logout - CHROMEOS_AFFILIATED_LOGOUT	USER_LOGOUT
CHROME_OS_REPORTING_DATA_LOST	STATUS_UPDATE
ChromeOS CRD client connected - CHROMEOS_CRD_CLIENT_CONNECTED	USER_LOGIN
ChromeOS CRD client disconnected	USER_LOGOUT
CHROME_OS_CRD_HOST_STARTED - CHROMEOS_CRD_HOST_STARTED	STATUS_STARTUP
ChromeOS CRD host started - CHROMEOS_CRD_HOST_STARTED	STATUS_STARTUP
ChromeOS CRD host stopped - CHROMEOS_CRD_HOST_ENDED	STATUS_STARTUP
ChromeOS device boot state change - CHROME_OS_VERIFIED_MODE	SETTING_MODIFICATION
ChromeOS device boot state change - CHROME_OS_DEV_MODE	SETTING_MODIFICATION
DEVICE_BOOT_STATE_CHANGE - CHROME_OS_VERIFIED_MODE	SETTING_MODIFICATION
ChromeOS lock success - CHROMEOS_AFFILIATED_LOCK_SUCCESS	USER_LOGOUT
ChromeOS unlock success - CHROMEOS_AFFILIATED_UNLOCK_SUCCESS	USER_LOGIN
ChromeOS unlock failure - CHROMEOS_AFFILIATED_LOGIN	USER_LOGIN
ChromeOS USB device added - CHROMEOS_PERIPHERAL_ADDED	USER_RESOURCE_ACCESS
ChromeOS USB device removed - CHROMEOS_PERIPHERAL_REMOVED	USER_RESOURCE_DELETION
ChromeOS USB status change - CHROMEOS_PERIPHERAL_STATUS_UPDATED	USER_RESOURCE_UPDATE_CONTENT
CHROMEOS_PERIPHERAL_STATUS_UPDATED - CHROMEOS_PERIPHERAL_STATUS_UPDATED	USER_RESOURCE_UPDATE_CONTENT
Client Side Detection	USER_UNCATEGORIZED
Content transfer	SCAN_FILE
CONTENT_TRANSFER	SCAN_FILE
contentTransferEvent	SCAN_FILE
Content unscanned	SCAN_UNCATEGORIZED
CONTENT_UNSCANNED	SCAN_UNCATEGORIZED
dataAccessControlEvent	USER_RESOURCE_ACCESS
dangerousDownloadEvent - Dangerous	SCAN_FILE	SOFTWARE_PUA
dangerousDownloadEvent - DANGEROUS_HOST	SCAN_HOST
dangerousDownloadEvent - UNCOMMON	SCAN_UNCATEGORIZED
dangerousDownloadEvent - POTENTIALLY_UNWANTED	SCAN_UNCATEGORIZED	SOFTWARE_PUA
dangerousDownloadEvent - UNKNOWN	SCAN_UNCATEGORIZED
dangerousDownloadEvent - DANGEROUS_URL	SCAN_UNCATEGORIZED
dangerousDownloadEvent - UNWANTED_SOFTWARE	SCAN_FILE	SOFTWARE_PUA
dangerousDownloadEvent - DANGEROUS_FILE_TYPE	SCAN_FILE	SOFTWARE_MALICIOUS
Desktop DLP Warnings	USER_UNCATEGORIZED
DLP_EVENT	USER_UNCATEGORIZED
interstitialEvent - Malware	NETWORK_HTTP	NETWORK_SUSPICIOUS
IOS/OSX Warnings	SCAN_UNCATEGORIZED
Malware transfer - MALWARE_TRANSFER_DANGEROUS	SCAN_FILE	SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_UNCOMMON	SCAN_FILE	SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_DANGEROUS	SCAN_FILE	SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_UNWANTED_SOFTWARE	SCAN_FILE	SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_UNKNOWN	SCAN_FILE	SOFTWARE_MALICIOUS
MALWARE_TRANSFER - MALWARE_TRANSFER_DANGEROUS_HOST	SCAN_FILE	SOFTWARE_MALICIOUS
malwareTransferEvent - DANGEROUS	SCAN_FILE	SOFTWARE_MALICIOUS
malwareTransferEvent - UNSPECIFIED	SCAN_FILE	SOFTWARE_MALICIOUS
Password breach	USER_RESOURCE_ACCESS
PASSWORD_BREACH	USER_RESOURCE_ACCESS
passwordBreachEvent - PASSWORD_ENTRY	USER_RESOURCE_ACCESS
Password changed	USER_CHANGE_PASSWORD
PASSWORD_CHANGED	USER_CHANGE_PASSWORD
passwordChangedEvent	USER_CHANGE_PASSWORD
Password reuse - PASSWORD_REUSED_UNAUTHORIZED_SITE	USER_RESOURCE_ACCESS	POLICY_VIOLATION, AUTH_VIOLATION
Password reuse - PASSWORD_REUSED_PHISHING_URL	USER_UNCATEGORIZED	PHISHING
PASSWORD_REUSE - PASSWORD_REUSED_UNAUTHORIZED_SITE	USER_RESOURCE_ACCESS	POLICY_VIOLATION, AUTH_VIOLATION
passwordReuseEvent - Unauthorized site	USER_RESOURCE_ACCESS	POLICY_VIOLATION, AUTH_VIOLATION
passwordReuseEvent - PASSWORD_REUSED_PHISHING_URL	USER_UNCATEGORIZED	PHISHING
passwordReuseEvent - PASSWORD_REUSED_UNAUTHORIZED_SITE	USER_RESOURCE_ACCESS	POLICY_VIOLATION, AUTH_VIOLATION
Permissions Blacklisting	RESOURCE_PERMISSIONS_CHANGE
Sensitive data transfer	SCAN_FILE	DATA_EXFILTRATION
SENSITIVE_DATA_TRANSFER	SCAN_FILE	DATA_EXFILTRATION
sensitiveDataEvent - [test_user_5] warn	SCAN_FILE	DATA_EXFILTRATION
sensitiveDataTransferEvent	SCAN_FILE	DATA_EXFILTRATION
Unsafe site visit - UNSAFE_SITE_VISIT_SSL_ERROR	USER_RESOURCE_ACCESS	NETWORK_SUSPICIOUS
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_MALWARE	USER_RESOURCE_ACCESS	SOFTWARE_MALICIOUS
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE	USER_RESOURCE_ACCESS	SOFTWARE_SUSPICIOUS
UNSAFE_SITE_VISIT - EVENT_REASON_UNSPECIFIED	USER_RESOURCE_ACCESS
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING	USER_RESOURCE_ACCESS	SOCIAL_ENGINEERING
UNSAFE_SITE_VISIT - UNSAFE_SITE_VISIT_SSL_ERROR	USER_RESOURCE_ACCESS	NETWORK_SUSPICIOUS
unscannedFileEvent - FILE_PASSWORD_PROTECTED	SCAN_FILE
unscannedFileEvent - FILE_TOO_LARGE	SCAN_FILE
urlFilteringInterstitialEvent	USER_RESOURCE_ACCESS	POLICY_VIOLATION
extensionTelemetryEvent	If the telemetry_event_signals.signal_name log field value is equal to the COOKIES_GET_ALL_INFO, COOKIES_GET_INFO, TABS_API_INFO, then the event_type set to USER_RESOURCE_ACCESS. Else, if the telemetry_event_signals.signal_name log field value is equal to REMOTE_HOST_CONTACTED_INFO, then if the telemetry_event_signals.connection_protocol log field value is equal to HTTP_HTTPS, then the event_type is set to NETWORK_HTTP. Else, the event_type UDM field is set to NETWORK_UNCATEGORIZED.	If the telemetry_event_signals.signal_name log field value is equal to REMOTE_HOST_CONTACTED_INFO, then the security category is set to NETWORK_SUSPICIOUS. Else, if the telemetry_event_signals.signal_name log field value contain one of the following values, then the security category UDM field is set to SOFTWARE_SUSPICIOUS. COOKIES_GET_INFO COOKIES_GET_ALL_INFO

필드 매핑 참조: CHROME_MANAGEMENT

다음 표에는 CHROME_MANAGEMENT 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field	UDM mapping	Logic
id.customerId	about.resource.product_object_id
event_detail	metadata.description
time	metadata.event_timestamp
events.parameters.name [TIMESTAMP]	metadata.event_timestamp
event	metadata.product_event_type
events.name	metadata.product_event_type
id.uniqueQualifier	metadata.product_log_id
	metadata.product_name	The metadata.product_name UDM field is set to Chrome Management.
id.applicationName
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
user_agent	network.http.user_agent
userAgent	network.http.user_agent
events.parameters.name [USER_AGENT]	network.http.user_agent
events.parameters.name [SESSION_ID]	network.session_id
client_type	principal.application
clientType	principal.application
events.parameters.name [CLIENT_TYPE]	principal.application
device_id	principal.asset.product_object_id
deviceId	principal.asset.product_object_id
events.parameters.name [DEVICE_ID]	principal.asset.product_object_id
device_name	principal.hostname
deviceName	principal.hostname
events.parameters.name [DEVICE_NAME]	principal.hostname
os_platform	principal.platform	The principal.platform UDM field is set to one of the following values: LINUX if the os_platform log field value is matched with regular expression pattern linux. MAC if the os_platform log field value is matched with regular expression pattern mac. WINDOWS if the os_platform log field value is matched with regular expression pattern windows. CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos. Else, if the os_platform log field value is not empty and osVersion log field value is not empty, then the os_platform osVersion log field is mapped to the principal.platform_version UDM field.
os_platform	principal.asset.platform_software.platform	The principal.asset.platform_software.platform UDM field is set to one of the following values: LINUX if the os_platform log field value is matched with regular expression pattern linux. MAC if the os_platform log field value is matched with regular expression pattern mac. WINDOWS if the os_platform log field value is matched with regular expression pattern windows. CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos.
os_platform	principal.asset.platform_software.platform	The principal.asset.platform_software.platform UDM field is set to one of the following values: LINUX if the os_platform log field value is matched with regular expression pattern linux. MAC if the os_platform log field value is matched with regular expression pattern mac. WINDOWS if the os_platform log field value is matched with regular expression pattern windows. CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos.
osPlatform	principal.platform	The principal.platform UDM field is set to one of the following values: LINUX if the osPlatform log field value is matched with regular expression pattern linux. MAC if the osPlatform log field value is matched with regular expression pattern mac. WINDOWS if the osPlatform log field value is matched with regular expression pattern windows. CHROME_OS if the osPlatform log field value is matched with regular expression pattern chromeos. Else, if the osPlatform log field value is not empty and osVersion log field value is not empty, then the osPlatform osVersion log field is mapped to the principal.platform_version UDM field.
osPlatform	principal.asset.platform_software.platform	The principal.asset.platform_software.platform UDM field is set to one of the following values: LINUX if the osPlatform log field value is matched with regular expression pattern linux. MAC if the osPlatform log field value is matched with regular expression pattern mac. WINDOWS if the osPlatform log field value is matched with regular expression pattern windows. CHROME_OS if the osPlatform log field value is matched with regular expression pattern chromeos.
events.parameters.name [DEVICE_PLATFORM]	principal.platform	The os_platform and os_version is extracted from the events.parameters.name [DEVICE_PLATFORM] log field using Grok pattern. The principal.platform UDM field is set to one of the following values: LINUX if the os_platform log field value is matched with regular expression pattern linux. MAC if the os_platform log field value is matched with regular expression pattern mac. WINDOWS if the os_platform log field value is matched with regular expression pattern windows. CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos. Else, if the os_platform log field value is not empty and osVersion log field value is not empty, then the os_platform osVersion log field is mapped to the principal.platform_version UDM field.
events.parameters.name [DEVICE_PLATFORM]	principal.asset.platform_software.platform	The os_platform is extracted from the events.parameters.name [DEVICE_PLATFORM] log field using Grok pattern. The principal.asset.platform_software.platform UDM field is set to one of the following values: LINUX if the os_platform log field value is matched with regular expression pattern linux. MAC if the os_platform log field value is matched with regular expression pattern mac. WINDOWS if the os_platform log field value is matched with regular expression pattern windows. CHROME_OS if the os_platform log field value is matched with regular expression pattern chromeos.
os_version	principal.platform_version
osVersion	principal.platform_version
events.parameters.name [DEVICE_PLATFORM]	principal.platform_version	The Version is extracted from the events.parameters.name [DEVICE_PLATFORM] log field using Grok pattern.
device_id	principal.resource.id
deviceId	principal.resource.id
events.parameters.name [DEVICE_ID]	principal.resource.id
directory_device_id	principal.resource.product_object_id
events.parameters.name [DIRECTORY_DEVICE_ID]	principal.resource.product_object_id
	principal.resource.resource_subtype	If the event log field value is equal to CHROMEOS_PERIPHERAL_STATUS_UPDATED, then the principal.resource.resource_subtype UDM field is set to USB. Else, if the events.name log field value is equal to CHROMEOS_PERIPHERAL_STATUS_UPDATED, then the principal.resource.resource_subtype UDM field is set to USB.
	principal.resource.resource_type	If the device_id log field value is not empty, then the principal.resource.resource_type UDM field is set to DEVICE.
actor.email	principal.user.email_addresses
actor.profileId	principal.user.userid
result	security_result.action_details
events.parameters.name [EVENT_RESULT]	security_result.action_details
event_result	security_result.action_details
	security_result.action	The security_result.action UDM field is set to one of the following values: ALLOW if the result or events.parameters.name [EVENT_RESULT] log field value is matched with regular expression pattern ALLOWED or EVENT_RESULT_ALLOWED. BLOCK if the result or events.parameters.name [EVENT_RESULT] log field value is matched with regular expression pattern BLOCKED or EVENT_RESULT_BLOCKED.
reason	security_result.category_details
events.parameters.name [EVENT_REASON]	security_result.category_details
events.parameters.name [EVENT_REASON]	security_result.summary
events.parameters.name [LOGIN_FAILURE_REASON]	security_result.description
events.parameters.name [REMOVE_USER_REASON]	security_result.description	If the events.name log field value is equal to CHROME_OS_REMOVE_USER, then the events.parameters.name REMOVE_USER_REASON log field value is mapped to the security_result.description UDM field.
triggered_rules	security_result.rule_name
events.type	security_result.category_details
events.parameters.name [PRODUCT_NAME]	target.application	If the events.name log field value contains one of the following values, then the events.parameters.name [PRODUCT_NAME] log field is mapped to the target.resource.name UDM field: ChromeOS USB device added ChromeOS USB device removed ChromeOS USB status change CHROMEOS_PERIPHERAL_STATUS_UPDATED
content_name	target.file.full_path
contentName	target.file.full_path
events.parameters.name [CONTENT_NAME]	target.file.full_path
content_type	target.file.mime_type
contentType	target.file.mime_type
events.parameters.name [CONTENT_TYPE]	target.file.mime_type
content_hash	target.file.sha256
events.parameters.name [CONTENT_HASH]	target.file.sha256
content_size	target.file.size
contentSize	target.file.size
events.parameters.name [CONTENT_SIZE]	target.file.size
	target.file.file_type	The fileType is extracted from the content_name log field using Grok pattern, Then target.file.file_type UDM field is set to one of the following values: FILE_TYPE_ZIP if the fileType value is equal to zip. FILE_TYPE_DOS_EXE if the fileType value is equal to exe. FILE_TYPE_PDF if the fileType value is equal to pdf. FILE_TYPE_XLSX if the fileType value is equal to xlsx.
extension_id	target.resource.product_object_id
events.parameters.name [APP_ID]	target.resource.product_object_id
extension_name	target.resource.name	If the event log field value is equal to badNavigationEvent or the events.name log field value is equal to badNavigationEvent, then the extension_name log field is mapped to the target.resource.name UDM field.
telemetry_event_signals.signal_name	target.resource.name	If the event log field value is equal to extensionTelemetryEvent, then the telemetry_event_signals.signal_name log field is mapped to the target.resource.name UDM field.
events.parameters.name [APP_NAME]	target.resource.name
url	target.url
events.parameters.name [URL]	target.url
telemetry_event_signals.url	target.url	If the telemetry_event_signals.url log field value matches the regular expression pattern the [http:\/\/ or https:\/\/].*, then the telemetry_event_signals.url log field is mapped to the target.url UDM field.
device_user	target.user.userid
deviceUser	principal.user.userid	If the event log field value is equal to passwordChangedEvent, then the deviceUser log field is mapped to the principal.user.userid UDM field. Else, the deviceUser log field is mapped to the principal.user.user_display_name UDM field.
events.parameters.name [DEVICE_USER]	If the event log field value is equal to passwordChangedEvent, then the events.parameters.name [DEVICE_USER] log field is mapped to the principal.user.userid UDM field. Else, the events.parameters.name [DEVICE_USER] log field is mapped to the principal.user.user_display_name UDM field.
scan_id	about.labels [scan_id]
events.parameters.name [CONNECTION_TYPE]	about.labels [connection_type]
etag	about.labels [etag]
kind	about.labels [kind]
actor.key	principal.user.attribute.labels [actor_key]
actor.callerType	principal.user.attribute.labels [actor_callerType]
events.parameters.name [EVIDENCE_LOCKER_FILEPATH]	security_result.about.labels [evidence_locker_filepath]
federated_origin	security_result.about.labels [federated_origin]
is_federated	security_result.about.labels [is_federated]
destination	security_result.about.labels [trigger_destination]
events.parameters.name [TRIGGER_DESTINATION]	security_result.about.labels [trigger_destination]
source	security_result.about.labels [trigger_source]
events.parameters.name [TRIGGER_SOURCE]	security_result.about.labels [trigger_source]
trigger_type	security_result.about.labels [trigger_type]
trigger_type	additional.fields [trigger_type]
triggerType	security_result.about.labels [trigger_type]
triggerType	additional.fields [trigger_type]
events.parameters.name [TRIGGER_TYPE]	security_result.about.labels [trigger_type]
trigger_user	security_result.about.labels [trigger_user]
events.parameters.name [TRIGGER_USER]	security_result.about.labels [trigger_user]
events.parameters.name [MALWARE_CATEGORY]	security_result.threat_name
events.parameters.name [MALWARE_FAMILY]	security_result.detection_fields [malware_family]
events.parameters.name [VENDOR_ID]	src.labels [vendor_id]
events.parameters.name [VENDOR_NAME]	src.labels [vendor_name]
events.parameters.name [VIRTUAL_DEVICE_ID]	src.labels [virtual_device_id]
events.parameters.name [VIRTUAL_DEVICE_ID]	additional.fields [virtual_device_id]
events.parameters.name [NEW_BOOT_MODE]	target.asset.attribute.labels [new_boot_mode]
events.parameters.name [PREVIOUS_BOOT_MODE]	target.asset.attribute.labels [previous_boot_mode]
id.time	target.asset.attribute.labels [timestamp]
events.parameters.name [PRODUCT_ID]	target.labels [product_id]	If the events.name log field value contains one of the following values, then the events.parameters.name [PRODUCT_ID] log field is mapped to the target.resource.product_object_id UDM field: CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the events.parameters.name [PRODUCT_ID] log field is mapped to the target.labels UDM field.
	extensions.auth.mechanism	If the events.name log field value contains one of the following values, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD: CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS
events.parameters.name [UNLOCK_TYPE]	target.labels [unlock_type]
extension_description	target.resource.attribute.labels [extension_description]
extension_action	target.resource.attribute.labels [extension_action]
extension_version	target.resource.attribute.labels [extension_version]	If the event log field value is not equal to extensionTelemetryEvent, then the extension_version log field is mapped to the target.resource.attribute.labels[extension_version] UDM field.
extension_source	target.resource.attribute.labels[extension_source]	If the event log field value is not equal to extensionTelemetryEvent, then the extension_source log field is mapped to the target.resource.attribute.labels[extension_source] UDM field.
browser_version	target.resource.attributes.labels [browser_version]
browserVersion	target.resource.attributes.labels [browser_version]
events.parameters.name [BROWSER_VERSION]	target.resource.attributes.labels [browser_version]
profile_user	target.user.email_addresses	If the event log field value contain one of the following values and the profile_user log field value matches the regular expression pattern ^.+@.+$, then the profile_user log field is mapped to the target.user.email_addresses UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
profile_user	principal.user.email_addresses	If the event log field value does not contain one of the following values and the profile_user log field value matches the regular expression pattern ^.+@.+$ and the actor.email log field value is not equal to the profile_user, then the profile_user log field is mapped to the principal.user.email_addresses UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
profile_user	target.user.attribute.labels[profile_user_name]	If the event log field value contain one of the following values and the profile_user log field value does not match the regular expression pattern ^.+@.+$, then the profile_user log field is mapped to the target.user.attribute.labels.profile_user_name UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
profile_user	principal.user.attribute.labels[profile_user_name]	If the event log field value does not contain one of the following values and the profile_user log field value does not match the regular expression pattern ^.+@.+$ or the actor.email log field value is equal to the profile_user, then the profile_user log field is mapped to the principal.user.attribute.labels.profile_user_name UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
events.parameters.name [PROFILE_USER_NAME]	target.user.email_addresses	If the event log field value contain one of the following values and the events.parameters.name [PROFILE_USER_NAME] log field value matches the regular expression pattern ^.+@.+$, then the events.parameters.name [PROFILE_USER_NAME] log field is mapped to the target.user.email_addresses UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
events.parameters.name [PROFILE_USER_NAME]	principal.user.email_addresses	If the event log field value does not contain one of the following values and the events.parameters.name [PROFILE_USER_NAME] log field value matches the regular expression pattern ^.+@.+$ and the actor.email log field value is not equal to the events.parameters.name [PROFILE_USER_NAME], then the events.parameters.name [PROFILE_USER_NAME] log field is mapped to the principal.user.email_addresses UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
events.parameters.name [PROFILE_USER_NAME]	target.user.attribute.labels[profile_user_name]	If the event log field value contain one of the following values and the events.parameters.name [PROFILE_USER_NAME] log field value does not match the regular expression pattern ^.+@.+$, then the events.parameters.name [PROFILE_USER_NAME] log field is mapped to the target.user.attribute.labels.profile_user_name UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
events.parameters.name [PROFILE_USER_NAME]	principal.user.attribute.labels[profile_user_name]	If the event log field value does not contain one of the following values and the events.parameters.name [PROFILE_USER_NAME] log field value does not match the regular expression pattern ^.+@.+$ or the actor.email log field value is equal to the events.parameters.name [PROFILE_USER_NAME], then the events.parameters.name [PROFILE_USER_NAME] log field is mapped to the principal.user.attribute.labels.profile_user_name UDM field. CHROME_OS_LOGIN_EVENT loginEvent CHROME_OS_LOGIN_FAILURE_EVENT CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_LOGOUT_EVENT CHROMEOS_AFFILIATED_LOCK_SUCCESS .
	target.resource.resource_type	If the events.name log field value is equal to DEVICE_BOOT_STATE_CHANGE, then the target.resource.resource_type UDM field is set to SETTING.
url_category	target.labels [url_category]
browser_channel	target.resource.attribute.labels [browser_channel]
report_id	target.labels [report_id]
clickedThrough	target.labels [clickedThrough]
threat_type	security_result.detection_fields [threatType]
triggered_rule_info.action	security_result.action	If the triggered_rule_info.action log field value contains one of the following values, then the triggered_rule_info.action log field is mapped to the security_result.action UDM field: ALLOW ALLOW_WITH_MODIFICATION BLOCK CHALLENGE FAIL QUARANTINE UNKNOWN_ACTION Else, the triggered_rule_info.action log field is mapped to the security_result.rule_labels [triggeredRuleInfo_action] UDM field.
triggered_rule_info.rule_id	security_result.rule_id
triggered_rule_info.rule_name	security_result.rule_name
triggered_rule_info.url_category	security_result.category_details
transfer_method	additional.fields [transfer_method]
extension_name	target.resource_ancestors.name	If the event log field value is equal to extensionTelemetryEvent, then the extension_name log field is mapped to the target.resource_ancestors.name UDM field.
extension_id	target.resource_ancestors.product_object_id	If the event log field value is equal to extensionTelemetryEvent, then the extension_id log field is mapped to the target.resource_ancestors.product_object_id UDM field.
extension_version	target.resource_ancestors.attribute.labels[extension_version]	If the event log field value is equal to extensionTelemetryEvent, then the extension_version log field is mapped to the target.resource_ancestors.attribute.labels[extension_version] UDM field.
extension_source	target.resource_ancestors.attribute.labels[extension_source]	If the event log field value is equal to extensionTelemetryEvent, then the extension_source log field is mapped to the target.resource_ancestors.attribute.labels[extension_source] UDM field.
profile_identifier	additional.fields[profile_identifier]
extension_files_info.file_name	target.resource_ancestors.file.names
extension_files_info.file_hash.hash	target.resource_ancestors.attribute.labels[file_hash]
telemetry_event_signals.count	target.resource.attribute.labels[count]
telemetry_event_signals.tabs_api_method	target.resource.attribute.labels[tabs_api_method]
	target.hostname	If the telemetry_event_signals.url log field value does not match the regular expression pattern the [http:\/\/ or https:\/\/].*, then the telemetry_event_signals.url log field is mapped to the target.hostname UDM field.
telemetry_event_signals.destination	target.resource.attribute.labels[destination]
telemetry_event_signals.source	target.resource.attribute.labels[source]
telemetry_event_signals.domain	target.domain.name
telemetry_event_signals.cookie_name	target.resource.attribute.labels[cookie_name]
telemetry_event_signals.cookie_path	target.resource.attribute.labels[cookie_path]
telemetry_event_signals.cookie_is_secure	target.resource.attribute.labels[cookie_is_secure]
telemetry_event_signals.cookie_store_id	target.resource.attribute.labels[cookie_store_id]
telemetry_event_signals.cookie_is_session	target.resource.attribute.labels[cookie_is_session]
telemetry_event_signals.connection_protocol	network.application_protocol	If the telemetry_event_signals.connection_protocol log field value is equal to HTTP_HTTPS, then the network.application_protocol UDM field is set to HTTP Else, If the telemetry_event_signals.connection_protocol log field value is equal to UNSPECIFIED, then the network.application_protocol UDM field is set to UNKNOWN_APPLICATION_PROTOCOL Else, the telemetry_event_signals.connection_protocol log field is mapped to the target.resource.attribute.labels UDM field.
telemetry_event_signals.contacted_by	target.resource.attribute.labels[contacted_by]
local_ips	principal.ip	If the event log field value is equal to extensionTelemetryEvent, then the local_ips log field is mapped to the principal.ip UDM field.
remote_ip	target.ip	If the event log field value is equal to extensionTelemetryEvent, then the remote_ip log field is mapped to the target.ip UDM field.
device_fqdn	principal.asset.attribute.labels	If the event log field value is equal to extensionTelemetryEvent, then the device_fqdn log field is mapped to the principal.asset.attribute.labels UDM field.
network_name	principal.network.carrier_name	If the event log field value is equal to extensionTelemetryEvent, then the network_name log field is mapped to the principal.network.carrier_name UDM field.
web_app_signed_in_account	target.user.email_addresses	If the event log field value contains one of the following values, then the web_app_signed_in_account log field is mapped to the target.user.email_addresses UDM field: contentTransferEvent sensitiveDataEvent urlFilteringInterstitialEvent

필드 매핑 참조 (미리보기 버전)

모든 필드는 Chrome Enterprise Core 고객과 Chrome Enterprise Premium 고객에게 적용됩니다. Chrome Enterprise Premium 고객에게만 적용되는 필드에는 '[CEP 전용]' 라벨이 지정됩니다.

필드 매핑 참조: CHROME_MANAGEMENT (미리보기 버전)

다음 표에는 CHROME_MANAGEMENT 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field	UDM mapping	Logic
pehash_sha256	about.file.sha256	[CEP Only] The SHA256 file hash (pehash_sha256) reported from a dangerousDownloadEvent or contentTransferEvent.
device_fqdn	principal.asset.attribute.labels	[CEP Only] The device's fully qualified domain name reported in a urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent. Not reported for unmanaged devices with managed user profiles.
network_name	principal.network.carrier_name	[CEP Only] The network name (SSID) the device is connected to reported in a urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent.
content_risk.threat_type	security_result.threat_name	[CEP Only] The threat type of the content reported in a dangerousDownloadEvent or contentTransferEvent.
content_risk_level, content_risk.risk_level	security_result.severity	[CEP Only] The content risk level reported by Safe Browsing in a dangerousDownloadEvent or contentTransferEvent.
content_risk.risk_reasons	security_result.rule_label	[CEP Only] The content risk reason reported by Safe Browsing in a dangerousDownloadEvent or contentTransferEvent.
content_risk.risk_indicators	security_result.detection_fields[content_risk_indicators]	[CEP Only] The list of indicators from the Safe Browsing risk level in a dangerousDownloadEvent or contentTransferEvent.
content_risk.risk_source	security_result.detection_fields[content_risk_source]	[CEP Only] The risk source of the content reported by Safe Browsing in a dangerousDownloadEvent or contentTransferEvent.
is_encrypted	additional.fields[is_encrypted]	[CEP Only] Set to true if the content is encrypted in dangerousDownloadEvent or contentTransferEvent.
server_scan_status	additional.fields[server_scan_status]	[CEP Only] The status of whether the content in dangerousDownloadEvent or contentTransferEvent was successfully scanned by Safe Browsing.
url_info.url	principal.url	[CEP Only] The URL of dangerousDownloadEvent, contentTransferEvent, urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent.
url_info.ip	principal.ip	[CEP Only] The IP address of dangerousDownloadEvent, contentTransferEvent, urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent.
url_info.type	principal.security_result.detection_fields[url_info_type]	[CEP Only] The URL type (download, tab, or redirect) of dangerousDownloadEvent, contentTransferEvent, urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent.
url_info.risk_level	principal.security_result.severity	[CEP Only] The risk level of the URL reported by Safe Browsing.
url_info.risk_infos.risk_level	principal.security_result.severity	[CEP Only] Additional risk information reported by Safe Browsing.
url_info.navigation_initiator.initiator_type	principal.security_result.detection_fields[url_info_initiator_type]	[CEP Only] This maps the url_info_initiator_type in a dangerousDownloadEvent or contentTransferEvent. In a urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent this maps the url_navigation_initiator.
url_info.navigation_initiator.entity	principal.security_result.detection_fields[url_info_entity]	[CEP Only] This maps the url_info_entity in a dangerousDownloadEvent or contentTransferEvent. In a urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent this maps the url_infos_navigation_entity.
url_info.request_http_method	principal.security_result.detection_fields[url_info_request_http_method]	[CEP Only] The HTTP method used to contact the URL.
url_info.url_categories	principal.url_metadata.categories	[CEP Only] The URL category reported by Safe Browsing of urlNavigationEvent or suspiciousUrlEvent.
url_info.risk_infos.risk_indicators	principal.security_result.detection_fields[url_info_risk_infos_risk_indicators_key]	[CEP Only] The URL risk indicators reported by Safe Browsing of urlNavigationEvent or suspiciousUrlEvent.
url_info.risk_infos.risk_reasons	principal.security_result.rule_label[risk_reason]	[CEP Only] The Safe Browsing reason for the URL risk classification of urlNavigationEvent or suspiciousUrlEvent.
url_info.risk_infos.risk_source	principal.security_result.detection_fields[content_risk_source]	[CEP Only] The risk source determination reported by Safe Browsing. This includes URL and file reputation and content scanning results for urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent.
url_info.risk_infos.threat_type	security_result.threat_name	[CEP Only] The threat type reported by Safe Browsing of the URL for urlNavigationEvent, suspiciousUrlEvent, or urlFilteringInterstitialEvent.
tab_url_info.url, tab_url, referrers.url	about.url	[CEP Only] Maps the tab_url_info.url of dangerousDownloadEvent or contentTransferEvent. Maps the referrers.url of a urlNavigationEvent, or suspiciousUrlEvent.
tab_url_info.ip, referrers.ip	about.ip	[CEP Only] Maps the tab_url_info_ip IP address associated with dangerousDownloadEvent or contentTransferEvent. Maps the IP address of referrers.ip in urlNavigationEvent or suspiciousUrlEvent.
remote_ip	target.ip	[CEP Only] If the event log field value contains one of the following values, then the remote_ip log field is mapped to the target.ip UDM field: dangerousDownloadEvent contentTransferEvent urlNavigationEvent suspiciousUrlEvent urlFilteringInterstitialEvent
tab_url_info.type	about.security_result.detection_fields[tab_url_info_type]	[CEP Only] The URL tab type for dangerousDownloadEvent or contentTransferEvent.
tab_url_info.risk_level	about.security_result.severity	[CEP Only] The Safe Browsing risk level associated with the URL from a tab event for dangerousDownloadEvent or contentTransferEvent.
tab_url_info.navigation_initiator.initiator_type	about.security_result.detection_fields[tab_url_info_initiator_type]	[CEP Only] The initiator type of the tab event for dangerousDownloadEvent or contentTransferEvent.
tab_url_info.navigation_initiator.entity	about.security_result.detection_fields[tab_url_info_entity]	[CEP Only] The tab_url_info_entity for dangerousDownloadEvent or contentTransferEvent.
tab_url_info.request_http_method	about.security_result.detection_fields[tab_url_info_request_http_method]	[CEP Only] The HTTP method a tab used to contact the URL of dangerousDownloadEvent or contentTransferEvent.
referrers.navigation_initiator.entity	about.security_result.detection_fields[referrers_navigation_initiator_entity]	[CEP Only] The referrer entity name that initiated the navigation event for urlNavigationEvent or suspiciousUrlEvent.
referrers.navigation_initiator.initiator_type	about.security_result.detection_fields[referrers_navigation_initiator_initiator_type]	[CEP Only] The referrer type that initiated urlNavigationEvent or suspiciousUrlEvent.
referrers.request_http_method	about.security_result.detection_fields[referrers_request_http_method]	[CEP Only] The HTTP method of urlNavigationEvent or suspiciousUrlEvent.
referrers.risk_infos.risk_categories	about.security_result.detection_fields[referrers_risk_infos_risk_categories]	[CEP Only] The URL category of the referrer, as provided by the Safe Browsing service, associated with urlNavigationEvent or suspiciousUrlEvent.
referrers.risk_infos.risk_level, referrers.risk_level	about.security_result.severity	[CEP Only] Maps the risk level provided by Safe Browsing referrers.risk_level for a urlNavigationEvent or suspiciousUrlEvent or referrers.risk_infos.risk_level for urlNavigationEvent or suspiciousUrlEvent.
referrers.type	about.security_result.detection_fields[referrers_type]	[CEP Only] The URL type provided by Safe Browsing of the referrer URL of urlNavigationEvent or suspiciousUrlEvent.
referrers.risk_infos.risk_source	about.security_result.detection_fields[referrers_risk_source]	[CEP Only] The risk source provided by Safe Browsing for the referrer URL of urlNavigationEvent or suspiciousUrlEvent.
referrers.risk_infos.threat_type	about.security_result.threat_name	[CEP Only] The threat type provided by Safe Browsing for the referrer URL of urlNavigationEvent or suspiciousUrlEvent.
referrers.url_categories	about.url_metadata.categories	[CEP Only] The URL category provided by Safe Browsing for the referrer URL of urlNavigationEvent or suspiciousUrlEvent.

도움이 더 필요하신가요? 커뮤니티 회원 및 Google SecOps 전문가에게 문의하여 답변을 받으세요.