Recopila registros de Zscaler Webproxy

Compatible con:

Google SecOps SIEM

En este documento, se describe cómo puedes exportar registros de Zscaler Webproxy configurando un feed de Google Security Operations y cómo los campos de registro se asignan a los campos del Modelo de datos unificado (UDM) de Google SecOps.

Para obtener más información, consulta Descripción general de la transferencia de datos a Google SecOps.

Una implementación típica consta de Zscaler Webproxy y el feed de webhook de Google SecOps configurados para enviar registros a Google SecOps. Cada implementación para el cliente puede ser diferente y más compleja.

La implementación contiene los siguientes componentes:

• Zscaler Webproxy: Es la plataforma desde la que recopilas registros.

• Feed de Google SecOps: Es el feed de Google SecOps que recupera registros de Zscaler Webproxy y los escribe en Google SecOps.

• Google SecOps: Retiene y analiza los registros.

Una etiqueta de transferencia identifica el analizador que normaliza los datos de registro sin procesar en formato UDM estructurado. La información de este documento se aplica al analizador con la etiqueta de transferencia ZSCALER_WEBPROXY.

Antes de comenzar

Asegúrate de cumplir con los siguientes requisitos previos:

• Acceso a la consola de Zscaler Internet Access Para obtener más información, consulta la Ayuda de ZIA para el acceso seguro a Internet y SaaS.
• Zscaler Webproxy 2024 o versiones posteriores
• Todos los sistemas de la arquitectura de implementación están configurados con la zona horaria UTC.
• Es la clave de API necesaria para completar la configuración del feed en Google Security Operations. Para obtener más información, consulta Cómo configurar claves de API.

Configura feeds

Existen dos puntos de entrada diferentes para configurar feeds en la plataforma de Google SecOps:

• Configuración de SIEM > Feeds
• Content Hub > Paquetes de contenido

Nota: El Centro de contenido no está disponible en la plataforma independiente del SIEM. Para actualizar, comunícate con tu representante de Google SecOps.

Configura feeds desde Configuración de SIEM > Feeds

Para configurar varios feeds para diferentes tipos de registros dentro de esta familia de productos, consulta Cómo configurar feeds por producto.

Para configurar un solo feed, sigue estos pasos:

1. Ve a Configuración de SIEM > Feeds.
2. Haz clic en Agregar feed nuevo.
3. En la siguiente página, haz clic en Configurar un solo feed.
4. En el campo Nombre del feed, ingresa un nombre para el feed, por ejemplo, Registros de proxy web de Zscaler.
5. Selecciona Webhook como el Tipo de origen.
6. Selecciona Zscaler como el Tipo de registro.
7. Haz clic en Siguiente.
8. Opcional: Ingresa valores para los siguientes parámetros de entrada:
   1. Delimitador de división: Es el delimitador que se usa para separar las líneas de registro. Déjalo en blanco si no se usa un delimitador.
   2. Espacio de nombres del recurso: Es el espacio de nombres del recurso.
   3. Etiquetas de transmisión: Es la etiqueta que se aplicará a los eventos de este feed.
9. Haz clic en Siguiente.
10. Revisa la nueva configuración del feed y, luego, haz clic en Enviar.
11. Haz clic en Generate Secret Key para generar una clave secreta que permita autenticar este feed.

Configura feeds desde el Centro de contenido

Especifica valores para los siguientes campos:

• Delimitador de división: Es el delimitador que se usa para separar las líneas de registro, como \n.

Opciones avanzadas

• Nombre del feed: Es un valor completado previamente que identifica el feed.
• Tipo de fuente: Es el método que se usa para recopilar registros en Google SecOps.
• Espacio de nombres del recurso: Es el espacio de nombres del recurso.
• Etiquetas de transmisión: Es la etiqueta que se aplica a los eventos de este feed.
• Haz clic en Siguiente.
• Revisa la configuración del feed en la pantalla Finalizar y, luego, haz clic en Enviar.
• Haz clic en Generar clave secreta para generar una clave secreta que autentique este feed.

Configura el proxy web de Zscaler

1. En la consola de Zscaler Internet Access, haz clic en Administración > Servicio de transmisión de Nanolog > Feeds de NSS de Cloud y, luego, en Agregar feed de NSS de Cloud.
2. Aparecerá la ventana Add Cloud NSS Feed. En la ventana Add Cloud NSS Feed, ingresa los detalles.
3. Ingresa un nombre para el feed en el campo Nombre del feed.
4. Selecciona NSS para la Web en Tipo de NSS.
5. Selecciona el estado en la lista Estado para activar o desactivar el feed del NSS.
6. Mantén el valor Ilimitado en el menú desplegable Tasa de SIEM. Cambia el valor para suprimir el flujo de salida debido a licencias o a otras restricciones.
7. Selecciona Otro en la lista Tipo de SIEM.
8. Selecciona Inhabilitada en la lista Autenticación de OAuth 2.0.
9. Ingresa un límite de tamaño para la carga útil de una solicitud HTTP individual según la práctica recomendada del SIEM en Max Batch Size. Por ejemplo, 512 KB.

10. Ingresa la URL HTTPS del extremo de API de Chronicle en la URL de la API con el siguiente formato:

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    

    • CHRONICLE_REGION: Es la región en la que se aloja tu instancia de Chronicle. Por ejemplo, US.
    • GOOGLE_PROJECT_NUMBER: Es el número del proyecto de BYOP. Obtén esta información de C4.
    • LOCATION: Región de Chronicle. Por ejemplo, US.
    • CUSTOMER_ID: ID de cliente de Chronicle. Obtén el C4.
    • FEED_ID: ID del feed que se muestra en la IU del feed en el webhook nuevo que se creó
    • URL de API de ejemplo:

    https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
    

11. Haz clic en Agregar encabezado HTTP y, luego, agrega encabezados HTTP con el siguiente formato:

    • Header 1: Key1: X-goog-api-key y Value1: Clave de API generada en las credenciales de API de Google Cloud BYOP.
    • Header 2: Key2: X-Webhook-Access-Key y Value2: clave secreta de la API generada en la "CLAVE SECRETA" del webhook.

12. Selecciona Registros web en la lista Tipos de registros.

13. Selecciona JSON en la lista Tipo de salida del feed.

14. Inhabilita la notación de matriz JSON.

15. Establece Feed Escape Character en , \ ".

16. Para agregar un campo nuevo al Formato de salida del feed, selecciona Personalizado en la lista Tipo de salida del feed.

17. Copia y pega el Formato de salida del feed y agrega campos nuevos. Asegúrate de que los nombres de las claves coincidan con los nombres de los campos reales.

18. A continuación, se muestra el formato de salida del feed predeterminado:

      \{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%d{yy}-%02d{mth}-%02d{dd} %02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{sip}","requestmethod":"%s{reqmethod}","refererURL":"%s{ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zscaler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malwarecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}","app_status":"%s{app_status}","pagerisk":"%d{riskscore}","threatseverity":"%s{threatseverity}","department":"%s{edepartment}","urlsupercategory":"%s{urlsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclass}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fileclass}","bwthrottle":"%s{bwthrottle}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","keyprotectiontype":"%s{keyprotectiontype}"\}\}
    

19. Selecciona la zona horaria para el campo Hora en el archivo de salida en la lista Zona horaria. De forma predeterminada, la zona horaria se establece en la de tu organización.

20. Revisa la configuración.

21. Haz clic en Guardar para probar la conectividad. Si la conexión se realiza correctamente, aparecerá una marca de verificación verde junto con el mensaje Test Connectivity Successful: OK (200).

Para obtener más información sobre los feeds de Google SecOps, consulta la documentación sobre los feeds de Google SecOps. Para obtener información sobre los requisitos de cada tipo de feed, consulta Configuración de feeds por tipo.

Si tienes problemas para crear feeds, comunícate con el equipo de asistencia de Google SecOps.

Formatos de registro de Zscaler Webproxy admitidos

El analizador de Zscaler Webproxy admite registros en formato JSON.

Registros de muestra de Zscaler Webproxy compatibles

• JSON

    {
      "event": {
        "ClientIP": "198.51.100.0",
        "action": "Allowed",
        "appclass": "Sales and Marketing",
        "appname": "Trend Micro",
        "bwthrottle": "NO",
        "clientpublicIP": "198.51.100.1",
        "contenttype": "Other",
        "datetime": "2024-05-06 10:56:04",
        "department": "Mid-Continent%20Companies",
        "devicehostname": "dummyhostname",
        "deviceowner": "dummydeviceowner",
        "dlpdictionaries": "None",
        "dlpengine": "None",
        "event_id": "7365838693731467265",
        "fileclass": "None",
        "filetype": "None",
        "hostname": "dummyhostname.com",
        "keyprotectiontype": "N/A",
        "location": "Road%20Warrior",
        "pagerisk": "0",
        "product": "NSS",
        "protocol": "HTTP_PROXY",
        "reason": "Allowed",
        "refererURL": "None",
        "requestmethod": "CONNECT",
        "requestsize": "606",
        "responsesize": "65",
        "serverip": "198.51.10.2",
        "status": "200",
        "threatcategory": "None",
        "threatclass": "None",
        "threatname": "None",
        "threatseverity": "None",
        "transactionsize": "671",
        "unscannabletype": "None",
        "url": "dummyurl.com:443",
        "urlcategory": "SSL - DNI - Bypass",
        "urlclass": "Bandwidth Loss",
        "urlsupercategory": "User-defined",
        "user": "[e-mail]",
        "useragent": "dummyuseragent",
        "vendor": "Zscaler"
      },
      "sourcetype": "zscalernss-web"
    }
  
  

Referencia de la asignación de campos

En la siguiente tabla, se enumeran los campos de registro del tipo de registro ZSCALER_WEBPROXY y sus campos de UDM correspondientes.

Log field	UDM mapping	Logic
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Zscaler.
	metadata.event_type	If the ClientIP log field value is not empty and the serverip log field value is not empty and the proto log field value contain one of the following values, then the metadata.event_type UDM field is set to NETWORK_HTTP. HTTPS HTTP Else, if the ClientIP log field value is not empty and the serverip log field value is not empty, then the metadata.event_type UDM field is set to NETWORK_CONNECTION. Else, if the user log field value is not empty or the deviceowner log field value is not empty, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else, the metadata.event_type UDM field is set to GENERIC_EVENT.
	metadata.product_name	The metadata.product_name UDM field is set to Web Proxy.
sourcetype	additional.fields[sourcetype]
datetime	metadata.event_timestamp
tz	additional.fields[tz]
ss	additional.fields[ss]
mm	additional.fields[mm]
hh	additional.fields[hh]
dd	additional.fields[dd]
mth	additional.fields[mth]
yyyy	additional.fields[yyyy]
mon	additional.fields[mon]
day	additional.fields[day]
department	principal.user.department
b64dept	principal.user.department
edepartment	principal.user.department
user	principal.user.email_addresses
user	principal.user.userid	The EMAILLOCALPART field is extracted from user log field using the Grok pattern, and the EMAILLOCALPART log field is mapped to the principal.user.userid UDM field.
b64login	principal.user.email_addresses
elogin	principal.user.email_addresses
ologin	additional.fields[ologin]
cloudname	principal.user.attribute.labels[cloudname]
company	principal.user.company_name
throttlereqsize	security_result.detection_fields[throttlereqsize]
throttlerespsize	security_result.detection_fields[throttlerespsize]
bwthrottle	security_result.detection_fields[bwthrottle]
	security_result.category	If the bwthrottle log field value is equal to Yes, then the security_result.category UDM field is set to POLICY_VIOLATION.
bwclassname	security_result.detection_fields[bwclassname]
obwclassname	security_result.detection_fields[obwclassname]
bwrulename	security_result.rule_name
appname	target.application
appclass	target.security_result.detection_fields[appclass]
module	target.security_result.detection_fields[module]
app_risk_score	target.security_result.risk_score	If the app_risk_score log field value matches the regular expression pattern [0-9]+, then the app_risk_score log field is mapped to the security_result.risk_score UDM field.
datacenter	target.location.name
datacentercity	target.location.city
datacentercountry	target.location.country_or_region
dlpdictionaries	security_result.detection_fields[dlpdictionaries]
odlpdict	security_result.detection_fields[odlpdict]
dlpdicthitcount	security_result.detection_fields[dlpdicthitcount]
dlpengine	security_result.detection_fields[dlpengine]
odlpeng	security_result.detection_fields[odlpeng]
dlpidentifier	security_result.detection_fields[dlpidentifier]
dlpmd5	security_result.detection_fields[dlpmd5]
dlprulename	security_result.rule_name
odlprulename	security_result.detection_fields[odlprulename]
fileclass	additional.fields[fileclass]
filetype	target.file.file_type	If the filetype log field value matches the regular expression (?i)(xlsx), then the target.file.file_type UDM field is set to FILE_TYPE_XLSX. Else, if the filetype log field value matches the regular expression (?i)(xls), then the target.file.file_type UDM field is set to FILE_TYPE_XLS. Else, if the filetype log field value matches the regular expression (?i)(cab), then the target.file.file_type UDM field is set to FILE_TYPE_CAB. Else, if the filetype log field value matches the regular expression (?i)(pcapng|pcap|cap), then the target.file.file_type UDM field is set to FILE_TYPE_CAP. Else, if the filetype log field value matches the regular expression (?i)(tar.gz|egg), then the target.file.file_type UDM field is set to FILE_TYPE_PYTHON_PKG. Else, if the filetype log field value matches the regular expression (?i)(gzip|tgz|gz), then the target.file.file_type UDM field is set to FILE_TYPE_GZIP. Else, if the filetype log field value matches the regular expression (?i)(zip), then the target.file.file_type UDM field is set to FILE_TYPE_ZIP. Else, if the filetype log field value matches the regular expression (?i)(gif), then the target.file.file_type UDM field is set to FILE_TYPE_GIF. Else, if the log message matches the regular expression (?i)(\\bdos\\b) AND the filetype log field value matches the regular expression (?i)(exe|com), then the target.file.file_type UDM field is set to FILE_TYPE_DOS_EXE. Else, if the log message matches the regular expression (?i)(\\bne_exe\\b) AND the filetype log field value matches the regular expression (?i)(exe), then the target.file.file_type UDM field is set to FILE_TYPE_NE_EXE. Else, if the filetype log field value matches the regular expression (?i)(exe), then the target.file.file_type UDM field is set to FILE_TYPE_PE_EXE. Else, if the filetype log field value matches the regular expression (?i)(msi), then the target.file.file_type UDM field is set to FILE_TYPE_MSI. Else, if the filetype log field value matches the regular expression (?i)(ocx|sys), then the target.file.file_type UDM field is set to FILE_TYPE_PE_DLL. Else, if the filetype log field value matches the regular expression (?i)(pdf|(portable\\s*document\\s*format)), then the target.file.file_type UDM field is set to FILE_TYPE_PDF. Else, if the filetype log field value matches the regular expression (?i)(docx), then the target.file.file_type UDM field is set to FILE_TYPE_DOCX. Else, if the filetype log field value matches the regular expression (?i)(doc), then the target.file.file_type UDM field is set to FILE_TYPE_DOC. Else, if the filetype log field value matches the regular expression (?i)(html|htm), then the target.file.file_type UDM field is set to FILE_TYPE_HTML. Else, if the filetype log field value matches the regular expression (?i)(jar), then the target.file.file_type UDM field is set to FILE_TYPE_JAR. Else, if the filetype log field value matches the regular expression (?i)(jpeg|jpg), then the target.file.file_type UDM field is set to FILE_TYPE_JPEG. Else, if the filetype log field value matches the regular expression (?i)(mov), then the target.file.file_type UDM field is set to FILE_TYPE_MOV. Else, if the filetype log field value matches the regular expression (?i)(mp3), then the target.file.file_type UDM field is set to FILE_TYPE_MP3. Else, if the filetype log field value matches the regular expression (?i)(mp4), then the target.file.file_type UDM field is set to FILE_TYPE_MP4. Else, if the filetype log field value matches the regular expression (?i)(png), then the target.file.file_type UDM field is set to FILE_TYPE_PNG. Else, if the filetype log field value matches the regular expression (?i)(pptx), then the target.file.file_type UDM field is set to FILE_TYPE_PPTX. Else, if the filetype log field value matches the regular expression (?i)(ppt), then the target.file.file_type UDM field is set to FILE_TYPE_PPT. Else, if the filetype log field value matches the regular expression (?i)(rar), then the target.file.file_type UDM field is set to FILE_TYPE_RAR. Else, if the filetype log field value matches the regular expression (?i)(ace), then the target.file.file_type UDM field is set to FILE_TYPE_ACE. Else, if the filetype log field value matches the regular expression (?i)(apk|aar|dex), then the target.file.file_type UDM field is set to FILE_TYPE_ANDROID. Else, if the filetype log field value matches the regular expression (?i)(plist), then the target.file.file_type UDM field is set to FILE_TYPE_APPLE_PLIST. Else, if the filetype log field value matches the regular expression (?i)(applescript), then the target.file.file_type UDM field is set to FILE_TYPE_APPLESCRIPT. Else, if the filetype log field value matches the regular expression (?i)(app), then the target.file.file_type UDM field is set to FILE_TYPE_APPLE. Else, if the filetype log field value matches the regular expression (?i)(scpt), then the target.file.file_type UDM field is set to FILE_TYPE_APPLESCRIPT_COMPILED. Else, if the filetype log field value matches the regular expression (?i)(arc), then the target.file.file_type UDM field is set to FILE_TYPE_ARC. Else, if the filetype log field value matches the regular expression (?i)(arj), then the target.file.file_type UDM field is set to FILE_TYPE_ARJ. Else, if the filetype log field value matches the regular expression (?i)(asd), then the target.file.file_type UDM field is set to FILE_TYPE_ASD. Else, if the filetype log field value matches the regular expression (?i)(asf), then the target.file.file_type UDM field is set to FILE_TYPE_ASF. Else, if the filetype log field value matches the regular expression (?i)(avi), then the target.file.file_type UDM field is set to FILE_TYPE_AVI. Else, if the filetype log field value matches the regular expression (?i)(awk), then the target.file.file_type UDM field is set to FILE_TYPE_AWK. Else, if the filetype log field value matches the regular expression (?i)(bmp), then the target.file.file_type UDM field is set to FILE_TYPE_BMP. Else, if the filetype log field value matches the regular expression (?i)(dib), then the target.file.file_type UDM field is set to FILE_TYPE_DIB. Else, if the filetype log field value matches the regular expression (?i)(bz2), then the target.file.file_type UDM field is set to FILE_TYPE_BZIP. Else, if the filetype log field value matches the regular expression (?i)(chm), then the target.file.file_type UDM field is set to FILE_TYPE_CHM. Else, if the filetype log field value matches the regular expression (?i)(cljc|cljs|clj), then the target.file.file_type UDM field is set to FILE_TYPE_CLJ. Else, if the filetype log field value matches the regular expression (?i)(crt|cer), then the target.file.file_type UDM field is set to FILE_TYPE_CRT. Else, if the filetype log field value matches the regular expression (?i)(crx), then the target.file.file_type UDM field is set to FILE_TYPE_CRX. Else, if the filetype log field value matches the regular expression (?i)(csv), then the target.file.file_type UDM field is set to FILE_TYPE_CSV. Else, if the filetype log field value matches the regular expression (?i)(deb), then the target.file.file_type UDM field is set to FILE_TYPE_DEB. Else, if the filetype log field value matches the regular expression (?i)(dmg), then the target.file.file_type UDM field is set to FILE_TYPE_DMG. Else, if the filetype log field value matches the regular expression (?i)(divx), then the target.file.file_type UDM field is set to FILE_TYPE_DIVX. Else, if the filetype log field value matches the regular expression (?i)(com), then the target.file.file_type UDM field is set to FILE_TYPE_DOS_COM. Else, if the filetype log field value matches the regular expression (?i)(dwg), then the target.file.file_type UDM field is set to FILE_TYPE_DWG. Else, if the filetype log field value matches the regular expression (?i)(dxf), then the target.file.file_type UDM field is set to FILE_TYPE_DXF. Else, if the filetype log field value matches the regular expression (?i)(dyalog), then the target.file.file_type UDM field is set to FILE_TYPE_DYALOG. Else, if the filetype log field value matches the regular expression (?i)(dzip), then the target.file.file_type UDM field is set to FILE_TYPE_DZIP. Else, if the filetype log field value matches the regular expression (?i)(epub|mobi|azw), then the target.file.file_type UDM field is set to FILE_TYPE_EBOOK. Else, if the filetype log field value matches the regular expression (?i)(elf), then the target.file.file_type UDM field is set to FILE_TYPE_ELF. Else, if the filetype log field value matches the regular expression (?i)(eml), then the target.file.file_type UDM field is set to FILE_TYPE_EMAIL_TYPE. Else, if the filetype log field value matches the regular expression (?i)(emf), then the target.file.file_type UDM field is set to FILE_TYPE_EMF. Else, if the filetype log field value matches the regular expression (?i)(eot), then the target.file.file_type UDM field is set to FILE_TYPE_EOT. Else, if the filetype log field value matches the regular expression (?i)(eps), then the target.file.file_type UDM field is set to FILE_TYPE_EPS. Else, if the filetype log field value matches the regular expression (?i)(flac), then the target.file.file_type UDM field is set to FILE_TYPE_FLAC. Else, if the filetype log field value matches the regular expression (?i)(fla), then the target.file.file_type UDM field is set to FILE_TYPE_FLA. Else, if the filetype log field value matches the regular expression (?i)(fli), then the target.file.file_type UDM field is set to FILE_TYPE_FLI. Else, if the filetype log field value matches the regular expression (?i)(flc), then the target.file.file_type UDM field is set to FILE_TYPE_FLC. Else, if the filetype log field value matches the regular expression (?i)(flv), then the target.file.file_type UDM field is set to FILE_TYPE_FLV. Else, if the filetype log field value matches the regular expression (?i)(fpx), then the target.file.file_type UDM field is set to FILE_TYPE_FPX. Else, if the filetype log field value matches the regular expression (?i)(xcf), then the target.file.file_type UDM field is set to FILE_TYPE_GIMP. Else, if the filetype log field value matches the regular expression (?i)(go), then the target.file.file_type UDM field is set to FILE_TYPE_GOLANG. Else, if the filetype log field value matches the regular expression (?i)(gul), then the target.file.file_type UDM field is set to FILE_TYPE_GUL. Else, if the filetype log field value matches the regular expression (?i)(hwp), then the target.file.file_type UDM field is set to FILE_TYPE_HWP. Else, if the filetype log field value matches the regular expression (?i)(ico), then the target.file.file_type UDM field is set to FILE_TYPE_ICO. Else, if the filetype log field value matches the regular expression (?i)(indd|idml), then the target.file.file_type UDM field is set to FILE_TYPE_IN_DESIGN. Else, if the filetype log field value matches the regular expression (?i)(ipa), then the target.file.file_type UDM field is set to FILE_TYPE_IPHONE. Else, if the filetype log field value matches the regular expression (?i)(ips), then the target.file.file_type UDM field is set to FILE_TYPE_IPS. Else, if the filetype log field value matches the regular expression (?i)(iso), then the target.file.file_type UDM field is set to FILE_TYPE_ISOIMAGE. Else, if the filetype log field value matches the regular expression (?i)(java) AND the filetype log field value does NOT match the regular expression (?i)(javascript), then the target.file.file_type UDM field is set to FILE_TYPE_JAVA. Else, if the filetype log field value matches the regular expression (?i)(class), then the target.file.file_type UDM field is set to FILE_TYPE_JAVA_BYTECODE. Else, if the filetype log field value matches the regular expression (?i)(jmod), then the target.file.file_type UDM field is set to FILE_TYPE_JMOD. Else, if the filetype log field value matches the regular expression (?i)(jng), then the target.file.file_type UDM field is set to FILE_TYPE_JNG. Else, if the filetype log field value matches the regular expression (?i)(json), then the target.file.file_type UDM field is set to FILE_TYPE_JSON. Else, if the filetype log field value matches the regular expression (?i)(js), then the target.file.file_type UDM field is set to FILE_TYPE_JAVASCRIPT. Else, if the filetype log field value matches the regular expression (?i)(kgb), then the target.file.file_type UDM field is set to FILE_TYPE_KGB. Else, if the filetype log field value matches the regular expression (?i)(tex), then the target.file.file_type UDM field is set to FILE_TYPE_LATEX. Else, if the filetype log field value matches the regular expression (?i)(lzfse), then the target.file.file_type UDM field is set to FILE_TYPE_LZFSE. Else, if the filetype log field value matches the regular expression (?i)(vmlinuz|ko), then the target.file.file_type UDM field is set to FILE_TYPE_LINUX_KERNEL. Else, if the filetype log field value matches the regular expression (?i)(bundle|framework), then the target.file.file_type UDM field is set to FILE_TYPE_MACH_O. Else, if the log message matches the regular expression (?i)(\\bmach\\b) AND the filetype log field value matches the regular expression (?i)(dylib|o), then the target.file.file_type UDM field is set to FILE_TYPE_MACH_O. Else, if the filetype log field value matches the regular expression (?i)(so|initrd|vmlinux|pkg.tar.zst|ext4|ext3|ext2|swap), then the target.file.file_type UDM field is set to FILE_TYPE_LINUX. Else, if the filetype log field value matches the regular expression (?i)(ini), then the target.file.file_type UDM field is set to FILE_TYPE_INI. Else, if the log message matches the regular expression (?i)(\\blinux\\b) AND the filetype log field value matches the regular expression sfs, then the target.file.file_type UDM field is set to FILE_TYPE_LINUX. Else, if the filetype log field value matches the regular expression (?i)(lnk), then the target.file.file_type UDM field is set to FILE_TYPE_LNK. Else, if the filetype log field value matches the regular expression (?i)(m4), then the target.file.file_type UDM field is set to FILE_TYPE_M4. Else, if the filetype log field value matches the regular expression (?i)(midi|mid), then the target.file.file_type UDM field is set to FILE_TYPE_MIDI. Else, if the filetype log field value matches the regular expression (?i)(mkv), then the target.file.file_type UDM field is set to FILE_TYPE_MKV. Else, if the filetype log field value matches the regular expression (?i)(mpg|mpeg), then the target.file.file_type UDM field is set to FILE_TYPE_MPEG. Else, if the filetype log field value matches the regular expression (?i)(sz_), then the target.file.file_type UDM field is set to FILE_TYPE_MSCOMPRESS. Else, if the filetype log field value matches the regular expression (?i)(dll), then the target.file.file_type UDM field is set to FILE_TYPE_NE_DLL. Else, if the filetype log field value matches the regular expression (?i)(odg), then the target.file.file_type UDM field is set to FILE_TYPE_ODG. Else, if the filetype log field value matches the regular expression (?i)(odp), then the target.file.file_type UDM field is set to FILE_TYPE_ODP. Else, if the filetype log field value matches the regular expression (?i)(ods), then the target.file.file_type UDM field is set to FILE_TYPE_ODS. Else, if the filetype log field value matches the regular expression (?i)(odt), then the target.file.file_type UDM field is set to FILE_TYPE_ODT. Else, if the filetype log field value matches the regular expression (?i)(ogg|oga|ogv), then the target.file.file_type UDM field is set to FILE_TYPE_OGG. Else, if the filetype log field value matches the regular expression (?i)(one) AND the filetype log field value does NOT match the regular expression (?i)(none), then the target.file.file_type UDM field is set to FILE_TYPE_ONE_NOTE. Else, if the filetype log field value matches the regular expression (?i)(pst|ost), then the target.file.file_type UDM field is set to FILE_TYPE_OUTLOOK. Else, if the log message matches the regular expression (?i)(\\boutlook\\b) AND the filetype log field value matches the regular expression (?i)(msg), then the target.file.file_type UDM field is set to FILE_TYPE_OUTLOOK. Else, if the log message matches the regular expression (?i)(\\bemail\\b) AND the filetype log field value matches the regular expression (?i)(msg), then the target.file.file_type UDM field is set to FILE_TYPE_EMAIL_TYPE. Else, if the filetype log field value matches the regular expression (?i)(prc), then the target.file.file_type UDM field is set to FILE_TYPE_PALMOS. Else, if the filetype log field value matches the regular expression (?i)(pdb), then the target.file.file_type UDM field is set to FILE_TYPE_PDB. Else, if the filetype log field value matches the regular expression (?i)(pem), then the target.file.file_type UDM field is set to FILE_TYPE_PEM. Else, if the filetype log field value matches the regular expression (?i)(pgp|gpg|asc), then the target.file.file_type UDM field is set to FILE_TYPE_PGP. Else, if the filetype log field value matches the regular expression (?i)(php), then the target.file.file_type UDM field is set to FILE_TYPE_PHP. Else, if the filetype log field value matches the regular expression (?i)(pkg), then the target.file.file_type UDM field is set to FILE_TYPE_PKG. Else, if the filetype log field value matches the regular expression (?i)(ps1|psm1), then the target.file.file_type UDM field is set to FILE_TYPE_POWERSHELL. Else, if the filetype log field value matches the regular expression (?i)(ppsx), then the target.file.file_type UDM field is set to FILE_TYPE_PPSX. Else, if the filetype log field value matches the regular expression (?i)(psd), then the target.file.file_type UDM field is set to FILE_TYPE_PSD. Else, if the filetype log field value matches the regular expression (?i)(ps), then the target.file.file_type UDM field is set to FILE_TYPE_PS. Else, if the filetype log field value matches the regular expression (?i)(pyc), then the target.file.file_type UDM field is set to FILE_TYPE_PYC. Else, if the filetype log field value matches the regular expression (?i)(py|pyw), then the target.file.file_type UDM field is set to FILE_TYPE_PYTHON. Else, if the filetype log field value matches the regular expression (?i)(whl), then the target.file.file_type UDM field is set to FILE_TYPE_PYTHON_WHL. Else, if the filetype log field value matches the regular expression (?i)(qt), then the target.file.file_type UDM field is set to FILE_TYPE_QUICKTIME. Else, if the filetype log field value matches the regular expression (?i)(rm|rmvb), then the target.file.file_type UDM field is set to FILE_TYPE_RM. Else, if the filetype log field value matches the regular expression (?i)(rom|bin), then the target.file.file_type UDM field is set to FILE_TYPE_ROM. Else, if the filetype log field value matches the regular expression (?i)(rpm), then the target.file.file_type UDM field is set to FILE_TYPE_RPM. Else, if the filetype log field value matches the regular expression (?i)(rtf), then the target.file.file_type UDM field is set to FILE_TYPE_RTF. Else, if the filetype log field value matches the regular expression (?i)(rb), then the target.file.file_type UDM field is set to FILE_TYPE_RUBY. Else, if the filetype log field value matches the regular expression (?i)(rz), then the target.file.file_type UDM field is set to FILE_TYPE_RZIP. Else, if the filetype log field value matches the regular expression (?i)(7z), then the target.file.file_type UDM field is set to FILE_TYPE_SEVENZIP. Else, if the filetype log field value matches the regular expression (?i)(sgml|sgm), then the target.file.file_type UDM field is set to FILE_TYPE_SGML. Else, if the filetype log field value matches the regular expression (?i)(bash|csh|zsh), then the target.file.file_type UDM field is set to FILE_TYPE_SHELLSCRIPT. Else, if the filetype log field value matches the regular expression (?i)(sql), then the target.file.file_type UDM field is set to FILE_TYPE_SQL. Else, if the filetype log field value matches the regular expression (?i)(sqfs|sfs), then the target.file.file_type UDM field is set to FILE_TYPE_SQUASHFS. Else, if the filetype log field value matches the regular expression (?i)(svg), then the target.file.file_type UDM field is set to FILE_TYPE_SVG. Else, if the filetype log field value matches the regular expression (?i)(swf), then the target.file.file_type UDM field is set to FILE_TYPE_SWF. Else, if the filetype log field value matches the regular expression (?i)(sis|sisx), then the target.file.file_type UDM field is set to FILE_TYPE_SYMBIAN. Else, if the filetype log field value matches the regular expression (?i)(3gp), then the target.file.file_type UDM field is set to FILE_TYPE_T3GP. Else, if the filetype log field value matches the regular expression (?i)(tar), then the target.file.file_type UDM field is set to FILE_TYPE_TAR. Else, if the filetype log field value matches the regular expression (?i)(tga), then the target.file.file_type UDM field is set to FILE_TYPE_TARGA. Else, if the filetype log field value matches the regular expression (?i)(3ds|max), then the target.file.file_type UDM field is set to FILE_TYPE_THREEDS. Else, if the filetype log field value matches the regular expression (?i)(tif|tiff), then the target.file.file_type UDM field is set to FILE_TYPE_TIFF. Else, if the filetype log field value matches the regular expression (?i)(torrent), then the target.file.file_type UDM field is set to FILE_TYPE_TORRENT. Else, if the filetype log field value matches the regular expression (?i)(ttf), then the target.file.file_type UDM field is set to FILE_TYPE_TTF. Else, if the filetype log field value matches the regular expression (?i)(vba), then the target.file.file_type UDM field is set to FILE_TYPE_VBA. Else, if the filetype log field value matches the regular expression (?i)(vhd|vhdx), then the target.file.file_type UDM field is set to FILE_TYPE_VHD. Else, if the filetype log field value matches the regular expression (?i)(wav), then the target.file.file_type UDM field is set to FILE_TYPE_WAV. Else, if the filetype log field value matches the regular expression (?i)(webm), then the target.file.file_type UDM field is set to FILE_TYPE_WEBM. Else, if the filetype log field value matches the regular expression (?i)(webp), then the target.file.file_type UDM field is set to FILE_TYPE_WEBP. Else, if the filetype log field value matches the regular expression (?i)(wer), then the target.file.file_type UDM field is set to FILE_TYPE_WER. Else, if the filetype log field value matches the regular expression (?i)(wma), then the target.file.file_type UDM field is set to FILE_TYPE_WMA. Else, if the filetype log field value matches the regular expression (?i)(wmv), then the target.file.file_type UDM field is set to FILE_TYPE_WMV. Else, if the filetype log field value matches the regular expression (?i)(woff|woff2), then the target.file.file_type UDM field is set to FILE_TYPE_WOFF. Else, if the filetype log field value matches the regular expression (?i)(xml), then the target.file.file_type UDM field is set to FILE_TYPE_XML. Else, if the filetype log field value matches the regular expression (?i)(xpi), then the target.file.file_type UDM field is set to FILE_TYPE_XPI. Else, if the filetype log field value matches the regular expression (?i)(xwd), then the target.file.file_type UDM field is set to FILE_TYPE_XWD. Else, if the filetype log field value matches the regular expression (?i)(zst), then the target.file.file_type UDM field is set to FILE_TYPE_ZST. Else, if the filetype log field value matches the regular expression (?i)(Makefile|makefile|mk), then the target.file.file_type UDM field is set to FILE_TYPE_MAKEFILE. Else, if the filetype log field value matches the regular expression (?i)(zlib), then the target.file.file_type UDM field is set to FILE_TYPE_ZLIB. Else, if the filetype log field value matches the regular expression (?i)(hqx), then the target.file.file_type UDM field is set to FILE_TYPE_MACINTOSH. Else, if the filetype log field value matches the regular expression (?i)(hfs|dsk|toast), then the target.file.file_type UDM field is set to FILE_TYPE_MACINTOSH_HFS. Else, if the filetype log field value matches the regular expression (?i)(bh|log|dat), then the target.file.file_type UDM field is set to FILE_TYPE_BLACKHOLE. Else, if the log message matches the regular expression (?i)(\\bcookie\\b) AND the filetype log field value matches the regular expression (?i)(txt), then the target.file.file_type UDM field is set to FILE_TYPE_COOKIE. Else, if the filetype log field value matches the regular expression (?i)(txt), then the target.file.file_type UDM field is set to FILE_TYPE_TEXT. Else, if the filetype log field value matches the regular expression (?i)(docx|xlsx|pptx), then the target.file.file_type UDM field is set to FILE_TYPE_OOXML. Else, if the filetype log field value matches the regular expression (?i)(odt|ods|odp|odg), then the target.file.file_type UDM field is set to FILE_TYPE_ODF. Else, if the filetype log field value matches the regular expression (?i)(for|f90|f95), then the target.file.file_type UDM field is set to FILE_TYPE_FORTRAN. Else, if the log message matches the regular expression (?i)(\\bwince\\b) AND the filetype log field value matches the regular expression (?i)(exe|cab|dll), then the target.file.file_type UDM field is set to FILE_TYPE_WINCE. Else, if the log message matches the regular expression (?i)(\\bscript\\b) AND the filetype log field value matches the regular expression (?i)(py|js|pl|rb), then the target.file.file_type UDM field is set to FILE_TYPE_SCRIPT. Else, if the log message matches the regular expression (?i)(\\bapplesingle\\b) AND the filetype log field value matches the regular expression (?i)(as|bin), then the target.file.file_type UDM field is set to FILE_TYPE_APPLESINGLE. Else, if the log message matches the regular expression (?i)(\\bmacintosh\\b) AND the filetype log field value matches the regular expression (?i)(dylib|a), then the target.file.file_type UDM field is set to FILE_TYPE_MACINTOSH_LIB. Else, if the log message matches the regular expression (?i)(\\bappledouble\\b) AND the filetype log field value matches the regular expression (?i)(ad|._), then the target.file.file_type UDM field is set to FILE_TYPE_APPLEDOUBLE. Else, if the log message matches the regular expression (?i)(\\bobjetivec\\b) AND the filetype log field value matches the regular expression (?i)(m|mm|h), then the target.file.file_type UDM field is set to FILE_TYPE_OBJETIVEC. Else, if the filetype log field value matches the regular expression (?i)(obj|lib), then the target.file.file_type UDM field is set to FILE_TYPE_COFF. Else, if the log message matches the regular expression (?i)(\\bcpp\\b) AND the filetype log field value matches the regular expression (?i)(hpp|cpp|cc|cxx|h), then the target.file.file_type UDM field is set to FILE_TYPE_CPP. Else, if the filetype log field value matches the regular expression (?i)(pas|pp), then the target.file.file_type UDM field is set to FILE_TYPE_PASCAL. Else, if the filetype log field value matches the regular expression (?i)(pl|pm), then the target.file.file_type UDM field is set to FILE_TYPE_PERL. Else, if the filetype log field value matches the regular expression (?i)\\bsh\\b, then the target.file.file_type UDM field is set to FILE_TYPE_SHELLSCRIPT. Else, if the filetype log field value matches the regular expression (?i)\\bc\\b$, then the target.file.file_type UDM field is set to FILE_TYPE_C. Else, if the filetype log field value matches the regular expression (?i)\\bn\\b$, then the target.file.file_type UDM field is set to FILE_TYPE_NEKO. Else, if the filetype log field value matches the regular expression (?i)\\bf\\b, then the target.file.file_type UDM field is set to FILE_TYPE_FORTRAN. Else, the UDM field additional.fields.key is set to file_type and the log field value filetype is mapped to the additional.fields.value UDM field, provided the filetype value is not empty.
filename	target.file.full_path
b64filename	target.file.full_path
efilename	target.file.full_path
filesubtype	additional.fields[filesubtype]
upload_fileclass	additional.fields[upload_fileclass]
upload_filetype	target.file.file_type	If the filetype log field value is empty or equal to None and the upload_filetype log field value is not empty and not equal to None, then: If the upload_filetype log field value matches the regular expression (?i)(xlsx), then the target.file.file_type UDM field is set to FILE_TYPE_XLSX. Else, if the upload_filetype log field value matches the regular expression (?i)(xls), then the target.file.file_type UDM field is set to FILE_TYPE_XLS. Else, if the upload_filetype log field value matches the regular expression (?i)(cab), then the target.file.file_type UDM field is set to FILE_TYPE_CAB. Else, if the upload_filetype log field value matches the regular expression (?i)(pcapng|pcap|cap), then the target.file.file_type UDM field is set to FILE_TYPE_CAP. Else, if the upload_filetype log field value matches the regular expression (?i)(tar.gz|egg), then the target.file.file_type UDM field is set to FILE_TYPE_PYTHON_PKG. Else, if the upload_filetype log field value matches the regular expression (?i)(gzip|tgz|gz), then the target.file.file_type UDM field is set to FILE_TYPE_GZIP. Else, if the upload_filetype log field value matches the regular expression (?i)(zip), then the target.file.file_type UDM field is set to FILE_TYPE_ZIP. Else, if the upload_filetype log field value matches the regular expression (?i)(gif), then the target.file.file_type UDM field is set to FILE_TYPE_GIF. Else, if the log message matches the regular expression (?i)(\\bdos\\b) AND the upload_filetype log field value matches the regular expression (?i)(exe|com), then the target.file.file_type UDM field is set to FILE_TYPE_DOS_EXE. Else, if the log message matches the regular expression (?i)(\\bne_exe\\b) AND the upload_filetype log field value matches the regular expression (?i)(exe), then the target.file.file_type UDM field is set to FILE_TYPE_NE_EXE. Else, if the upload_filetype log field value matches the regular expression (?i)(exe), then the target.file.file_type UDM field is set to FILE_TYPE_PE_EXE. Else, if the upload_filetype log field value matches the regular expression (?i)(msi), then the target.file.file_type UDM field is set to FILE_TYPE_MSI. Else, if the upload_filetype log field value matches the regular expression (?i)(ocx|sys), then the target.file.file_type UDM field is set to FILE_TYPE_PE_DLL. Else, if the upload_filetype log field value matches the regular expression (?i)(pdf|(portable\\s*document\\s*format)), then the target.file.file_type UDM field is set to FILE_TYPE_PDF. Else, if the upload_filetype log field value matches the regular expression (?i)(docx), then the target.file.file_type UDM field is set to FILE_TYPE_DOCX. Else, if the upload_filetype log field value matches the regular expression (?i)(doc), then the target.file.file_type UDM field is set to FILE_TYPE_DOC. Else, if the upload_filetype log field value matches the regular expression (?i)(html|htm), then the target.file.file_type UDM field is set to FILE_TYPE_HTML. Else, if the upload_filetype log field value matches the regular expression (?i)(jar), then the target.file.file_type UDM field is set to FILE_TYPE_JAR. Else, if the upload_filetype log field value matches the regular expression (?i)(jpeg|jpg), then the target.file.file_type UDM field is set to FILE_TYPE_JPEG. Else, if the upload_filetype log field value matches the regular expression (?i)(mov), then the target.file.file_type UDM field is set to FILE_TYPE_MOV. Else, if the upload_filetype log field value matches the regular expression (?i)(mp3), then the target.file.file_type UDM field is set to FILE_TYPE_MP3. Else, if the upload_filetype log field value matches the regular expression (?i)(mp4), then the target.file.file_type UDM field is set to FILE_TYPE_MP4. Else, if the upload_filetype log field value matches the regular expression (?i)(png), then the target.file.file_type UDM field is set to FILE_TYPE_PNG. Else, if the upload_filetype log field value matches the regular expression (?i)(pptx), then the target.file.file_type UDM field is set to FILE_TYPE_PPTX. Else, if the upload_filetype log field value matches the regular expression (?i)(ppt), then the target.file.file_type UDM field is set to FILE_TYPE_PPT. Else, if the upload_filetype log field value matches the regular expression (?i)(rar), then the target.file.file_type UDM field is set to FILE_TYPE_RAR. Else, if the upload_filetype log field value matches the regular expression (?i)(ace), then the target.file.file_type UDM field is set to FILE_TYPE_ACE. Else, if the upload_filetype log field value matches the regular expression (?i)(apk|aar|dex), then the target.file.file_type UDM field is set to FILE_TYPE_ANDROID. Else, if the upload_filetype log field value matches the regular expression (?i)(plist), then the target.file.file_type UDM field is set to FILE_TYPE_APPLE_PLIST. Else, if the upload_filetype log field value matches the regular expression (?i)(applescript), then the target.file.file_type UDM field is set to FILE_TYPE_APPLESCRIPT. Else, if the upload_filetype log field value matches the regular expression (?i)(app), then the target.file.file_type UDM field is set to FILE_TYPE_APPLE. Else, if the upload_filetype log field value matches the regular expression (?i)(scpt), then the target.file.file_type UDM field is set to FILE_TYPE_APPLESCRIPT_COMPILED. Else, if the upload_filetype log field value matches the regular expression (?i)(arc), then the target.file.file_type UDM field is set to FILE_TYPE_ARC. Else, if the upload_filetype log field value matches the regular expression (?i)(arj), then the target.file.file_type UDM field is set to FILE_TYPE_ARJ. Else, if the upload_filetype log field value matches the regular expression (?i)(asd), then the target.file.file_type UDM field is set to FILE_TYPE_ASD. Else, if the upload_filetype log field value matches the regular expression (?i)(asf), then the target.file.file_type UDM field is set to FILE_TYPE_ASF. Else, if the upload_filetype log field value matches the regular expression (?i)(avi), then the target.file.file_type UDM field is set to FILE_TYPE_AVI. Else, if the upload_filetype log field value matches the regular expression (?i)(awk), then the target.file.file_type UDM field is set to FILE_TYPE_AWK. Else, if the upload_filetype log field value matches the regular expression (?i)(bmp), then the target.file.file_type UDM field is set to FILE_TYPE_BMP. Else, if the upload_filetype log field value matches the regular expression (?i)(dib), then the target.file.file_type UDM field is set to FILE_TYPE_DIB. Else, if the upload_filetype log field value matches the regular expression (?i)(bz2), then the target.file.file_type UDM field is set to FILE_TYPE_BZIP. Else, if the upload_filetype log field value matches the regular expression (?i)(chm), then the target.file.file_type UDM field is set to FILE_TYPE_CHM. Else, if the upload_filetype log field value matches the regular expression (?i)(cljc|cljs|clj), then the target.file.file_type UDM field is set to FILE_TYPE_CLJ. Else, if the upload_filetype log field value matches the regular expression (?i)(crt|cer), then the target.file.file_type UDM field is set to FILE_TYPE_CRT. Else, if the upload_filetype log field value matches the regular expression (?i)(crx), then the target.file.file_type UDM field is set to FILE_TYPE_CRX. Else, if the upload_filetype log field value matches the regular expression (?i)(csv), then the target.file.file_type UDM field is set to FILE_TYPE_CSV. Else, if the upload_filetype log field value matches the regular expression (?i)(deb), then the target.file.file_type UDM field is set to FILE_TYPE_DEB. Else, if the upload_filetype log field value matches the regular expression (?i)(dmg), then the target.file.file_type UDM field is set to FILE_TYPE_DMG. Else, if the upload_filetype log field value matches the regular expression (?i)(divx), then the target.file.file_type UDM field is set to FILE_TYPE_DIVX. Else, if the upload_filetype log field value matches the regular expression (?i)(com), then the target.file.file_type UDM field is set to FILE_TYPE_DOS_COM. Else, if the upload_filetype log field value matches the regular expression (?i)(dwg), then the target.file.file_type UDM field is set to FILE_TYPE_DWG. Else, if the upload_filetype log field value matches the regular expression (?i)(dxf), then the target.file.file_type UDM field is set to FILE_TYPE_DXF. Else, if the upload_filetype log field value matches the regular expression (?i)(dyalog), then the target.file.file_type UDM field is set to FILE_TYPE_DYALOG. Else, if the upload_filetype log field value matches the regular expression (?i)(dzip), then the target.file.file_type UDM field is set to FILE_TYPE_DZIP. Else, if the upload_filetype log field value matches the regular expression (?i)(epub|mobi|azw), then the target.file.file_type UDM field is set to FILE_TYPE_EBOOK. Else, if the upload_filetype log field value matches the regular expression (?i)(elf), then the target.file.file_type UDM field is set to FILE_TYPE_ELF. Else, if the upload_filetype log field value matches the regular expression (?i)(eml), then the target.file.file_type UDM field is set to FILE_TYPE_EMAIL_TYPE. Else, if the upload_filetype log field value matches the regular expression (?i)(emf), then the target.file.file_type UDM field is set to FILE_TYPE_EMF. Else, if the upload_filetype log field value matches the regular expression (?i)(eot), then the target.file.file_type UDM field is set to FILE_TYPE_EOT. Else, if the upload_filetype log field value matches the regular expression (?i)(eps), then the target.file.file_type UDM field is set to FILE_TYPE_EPS. Else, if the upload_filetype log field value matches the regular expression (?i)(flac), then the target.file.file_type UDM field is set to FILE_TYPE_FLAC. Else, if the upload_filetype log field value matches the regular expression (?i)(fla), then the target.file.file_type UDM field is set to FILE_TYPE_FLA. Else, if the upload_filetype log field value matches the regular expression (?i)(fli), then the target.file.file_type UDM field is set to FILE_TYPE_FLI. Else, if the upload_filetype log field value matches the regular expression (?i)(flc), then the target.file.file_type UDM field is set to FILE_TYPE_FLC. Else, if the upload_filetype log field value matches the regular expression (?i)(flv), then the target.file.file_type UDM field is set to FILE_TYPE_FLV. Else, if the upload_filetype log field value matches the regular expression (?i)(fpx), then the target.file.file_type UDM field is set to FILE_TYPE_FPX. Else, if the upload_filetype log field value matches the regular expression (?i)(xcf), then the target.file.file_type UDM field is set to FILE_TYPE_GIMP. Else, if the upload_filetype log field value matches the regular expression (?i)(go), then the target.file.file_type UDM field is set to FILE_TYPE_GOLANG. Else, if the upload_filetype log field value matches the regular expression (?i)(gul), then the target.file.file_type UDM field is set to FILE_TYPE_GUL. Else, if the upload_filetype log field value matches the regular expression (?i)(hwp), then the target.file.file_type UDM field is set to FILE_TYPE_HWP. Else, if the upload_filetype log field value matches the regular expression (?i)(ico), then the target.file.file_type UDM field is set to FILE_TYPE_ICO. Else, if the upload_filetype log field value matches the regular expression (?i)(indd|idml), then the target.file.file_type UDM field is set to FILE_TYPE_IN_DESIGN. Else, if the upload_filetype log field value matches the regular expression (?i)(ipa), then the target.file.file_type UDM field is set to FILE_TYPE_IPHONE. Else, if the upload_filetype log field value matches the regular expression (?i)(ips), then the target.file.file_type UDM field is set to FILE_TYPE_IPS. Else, if the upload_filetype log field value matches the regular expression (?i)(iso), then the target.file.file_type UDM field is set to FILE_TYPE_ISOIMAGE. Else, if the upload_filetype log field value matches the regular expression (?i)(java) AND the upload_filetype log field value does NOT match the regular expression (?i)(javascript), then the target.file.file_type UDM field is set to FILE_TYPE_JAVA. Else, if the upload_filetype log field value matches the regular expression (?i)(class), then the target.file.file_type UDM field is set to FILE_TYPE_JAVA_BYTECODE. Else, if the upload_filetype log field value matches the regular expression (?i)(jmod), then the target.file.file_type UDM field is set to FILE_TYPE_JMOD. Else, if the upload_filetype log field value matches the regular expression (?i)(jng), then the target.file.file_type UDM field is set to FILE_TYPE_JNG. Else, if the upload_filetype log field value matches the regular expression (?i)(json), then the target.file.file_type UDM field is set to FILE_TYPE_JSON. Else, if the upload_filetype log field value matches the regular expression (?i)(js), then the target.file.file_type UDM field is set to FILE_TYPE_JAVASCRIPT. Else, if the upload_filetype log field value matches the regular expression (?i)(kgb), then the target.file.file_type UDM field is set to FILE_TYPE_KGB. Else, if the upload_filetype log field value matches the regular expression (?i)(tex), then the target.file.file_type UDM field is set to FILE_TYPE_LATEX. Else, if the upload_filetype log field value matches the regular expression (?i)(lzfse), then the target.file.file_type UDM field is set to FILE_TYPE_LZFSE. Else, if the upload_filetype log field value matches the regular expression (?i)(vmlinuz|ko), then the target.file.file_type UDM field is set to FILE_TYPE_LINUX_KERNEL. Else, if the upload_filetype log field value matches the regular expression (?i)(bundle|framework), then the target.file.file_type UDM field is set to FILE_TYPE_MACH_O. Else, if the log message matches the regular expression (?i)(\\bmach\\b) AND the upload_filetype log field value matches the regular expression (?i)(dylib|o), then the target.file.file_type UDM field is set to FILE_TYPE_MACH_O. Else, if the upload_filetype log field value matches the regular expression (?i)(so|initrd|vmlinux|pkg.tar.zst|ext4|ext3|ext2|swap), then the target.file.file_type UDM field is set to FILE_TYPE_LINUX. Else, if the upload_filetype log field value matches the regular expression (?i)(ini), then the target.file.file_type UDM field is set to FILE_TYPE_INI. Else, if the log message matches the regular expression (?i)(\\blinux\\b) AND the upload_filetype log field value matches the regular expression sfs, then the target.file.file_type UDM field is set to FILE_TYPE_LINUX. Else, if the upload_filetype log field value matches the regular expression (?i)(lnk), then the target.file.file_type UDM field is set to FILE_TYPE_LNK. Else, if the upload_filetype log field value matches the regular expression (?i)(m4), then the target.file.file_type UDM field is set to FILE_TYPE_M4. Else, if the upload_filetype log field value matches the regular expression (?i)(midi|mid), then the target.file.file_type UDM field is set to FILE_TYPE_MIDI. Else, if the upload_filetype log field value matches the regular expression (?i)(mkv), then the target.file.file_type UDM field is set to FILE_TYPE_MKV. Else, if the upload_filetype log field value matches the regular expression (?i)(mpg|mpeg), then the target.file.file_type UDM field is set to FILE_TYPE_MPEG. Else, if the upload_filetype log field value matches the regular expression (?i)(sz_), then the target.file.file_type UDM field is set to FILE_TYPE_MSCOMPRESS. Else, if the upload_filetype log field value matches the regular expression (?i)(dll), then the target.file.file_type UDM field is set to FILE_TYPE_NE_DLL. Else, if the upload_filetype log field value matches the regular expression (?i)(odg), then the target.file.file_type UDM field is set to FILE_TYPE_ODG. Else, if the upload_filetype log field value matches the regular expression (?i)(odp), then the target.file.file_type UDM field is set to FILE_TYPE_ODP. Else, if the upload_filetype log field value matches the regular expression (?i)(ods), then the target.file.file_type UDM field is set to FILE_TYPE_ODS. Else, if the upload_filetype log field value matches the regular expression (?i)(odt), then the target.file.file_type UDM field is set to FILE_TYPE_ODT. Else, if the upload_filetype log field value matches the regular expression (?i)(ogg|oga|ogv), then the target.file.file_type UDM field is set to FILE_TYPE_OGG. Else, if the upload_filetype log field value matches the regular expression (?i)(one) AND the upload_filetype log field value does NOT match the regular expression (?i)(none), then the target.file.file_type UDM field is set to FILE_TYPE_ONE_NOTE. Else, if the upload_filetype log field value matches the regular expression (?i)(pst|ost), then the target.file.file_type UDM field is set to FILE_TYPE_OUTLOOK. Else, if the log message matches the regular expression (?i)(\\boutlook\\b) AND the upload_filetype log field value matches the regular expression (?i)(msg), then the target.file.file_type UDM field is set to FILE_TYPE_OUTLOOK. Else, if the log message matches the regular expression (?i)(\\bemail\\b) AND the upload_filetype log field value matches the regular expression (?i)(msg), then the target.file.file_type UDM field is set to FILE_TYPE_EMAIL_TYPE. Else, if the upload_filetype log field value matches the regular expression (?i)(prc), then the target.file.file_type UDM field is set to FILE_TYPE_PALMOS. Else, if the upload_filetype log field value matches the regular expression (?i)(pdb), then the target.file.file_type UDM field is set to FILE_TYPE_PDB. Else, if the upload_filetype log field value matches the regular expression (?i)(pem), then the target.file.file_type UDM field is set to FILE_TYPE_PEM. Else, if the upload_filetype log field value matches the regular expression (?i)(pgp|gpg|asc), then the target.file.file_type UDM field is set to FILE_TYPE_PGP. Else, if the upload_filetype log field value matches the regular expression (?i)(php), then the target.file.file_type UDM field is set to FILE_TYPE_PHP. Else, if the upload_filetype log field value matches the regular expression (?i)(pkg), then the target.file.file_type UDM field is set to FILE_TYPE_PKG. Else, if the upload_filetype log field value matches the regular expression (?i)(ps1|psm1), then the target.file.file_type UDM field is set to FILE_TYPE_POWERSHELL. Else, if the upload_filetype log field value matches the regular expression (?i)(ppsx), then the target.file.file_type UDM field is set to FILE_TYPE_PPSX. Else, if the upload_filetype log field value matches the regular expression (?i)(psd), then the target.file.file_type UDM field is set to FILE_TYPE_PSD. Else, if the upload_filetype log field value matches the regular expression (?i)(ps), then the target.file.file_type UDM field is set to FILE_TYPE_PS. Else, if the upload_filetype log field value matches the regular expression (?i)(pyc), then the target.file.file_type UDM field is set to FILE_TYPE_PYC. Else, if the upload_filetype log field value matches the regular expression (?i)(py|pyw), then the target.file.file_type UDM field is set to FILE_TYPE_PYTHON. Else, if the upload_filetype log field value matches the regular expression (?i)(whl), then the target.file.file_type UDM field is set to FILE_TYPE_PYTHON_WHL. Else, if the upload_filetype log field value matches the regular expression (?i)(qt), then the target.file.file_type UDM field is set to FILE_TYPE_QUICKTIME. Else, if the upload_filetype log field value matches the regular expression (?i)(rm|rmvb), then the target.file.file_type UDM field is set to FILE_TYPE_RM. Else, if the upload_filetype log field value matches the regular expression (?i)(rom|bin), then the target.file.file_type UDM field is set to FILE_TYPE_ROM. Else, if the upload_filetype log field value matches the regular expression (?i)(rpm), then the target.file.file_type UDM field is set to FILE_TYPE_RPM. Else, if the upload_filetype log field value matches the regular expression (?i)(rtf), then the target.file.file_type UDM field is set to FILE_TYPE_RTF. Else, if the upload_filetype log field value matches the regular expression (?i)(rb), then the target.file.file_type UDM field is set to FILE_TYPE_RUBY. Else, if the upload_filetype log field value matches the regular expression (?i)(rz), then the target.file.file_type UDM field is set to FILE_TYPE_RZIP. Else, if the upload_filetype log field value matches the regular expression (?i)(7z), then the target.file.file_type UDM field is set to FILE_TYPE_SEVENZIP. Else, if the upload_filetype log field value matches the regular expression (?i)(sgml|sgm), then the target.file.file_type UDM field is set to FILE_TYPE_SGML. Else, if the upload_filetype log field value matches the regular expression (?i)(bash|csh|zsh), then the target.file.file_type UDM field is set to FILE_TYPE_SHELLSCRIPT. Else, if the upload_filetype log field value matches the regular expression (?i)(sql), then the target.file.file_type UDM field is set to FILE_TYPE_SQL. Else, if the upload_filetype log field value matches the regular expression (?i)(sqfs|sfs), then the target.file.file_type UDM field is set to FILE_TYPE_SQUASHFS. Else, if the upload_filetype log field value matches the regular expression (?i)(svg), then the target.file.file_type UDM field is set to FILE_TYPE_SVG. Else, if the upload_filetype log field value matches the regular expression (?i)(swf), then the target.file.file_type UDM field is set to FILE_TYPE_SWF. Else, if the upload_filetype log field value matches the regular expression (?i)(sis|sisx), then the target.file.file_type UDM field is set to FILE_TYPE_SYMBIAN. Else, if the upload_filetype log field value matches the regular expression (?i)(3gp), then the target.file.file_type UDM field is set to FILE_TYPE_T3GP. Else, if the upload_filetype log field value matches the regular expression (?i)(tar), then the target.file.file_type UDM field is set to FILE_TYPE_TAR. Else, if the upload_filetype log field value matches the regular expression (?i)(tga), then the target.file.file_type UDM field is set to FILE_TYPE_TARGA. Else, if the upload_filetype log field value matches the regular expression (?i)(3ds|max), then the target.file.file_type UDM field is set to FILE_TYPE_THREEDS. Else, if the upload_filetype log field value matches the regular expression (?i)(tif|tiff), then the target.file.file_type UDM field is set to FILE_TYPE_TIFF. Else, if the upload_filetype log field value matches the regular expression (?i)(torrent), then the target.file.file_type UDM field is set to FILE_TYPE_TORRENT. Else, if the upload_filetype log field value matches the regular expression (?i)(ttf), then the target.file.file_type UDM field is set to FILE_TYPE_TTF. Else, if the upload_filetype log field value matches the regular expression (?i)(vba), then the target.file.file_type UDM field is set to FILE_TYPE_VBA. Else, if the upload_filetype log field value matches the regular expression (?i)(vhd|vhdx), then the target.file.file_type UDM field is set to FILE_TYPE_VHD. Else, if the upload_filetype log field value matches the regular expression (?i)(wav), then the target.file.file_type UDM field is set to FILE_TYPE_WAV. Else, if the upload_filetype log field value matches the regular expression (?i)(webm), then the target.file.file_type UDM field is set to FILE_TYPE_WEBM. Else, if the upload_filetype log field value matches the regular expression (?i)(webp), then the target.file.file_type UDM field is set to FILE_TYPE_WEBP. Else, if the upload_filetype log field value matches the regular expression (?i)(wer), then the target.file.file_type UDM field is set to FILE_TYPE_WER. Else, if the upload_filetype log field value matches the regular expression (?i)(wma), then the target.file.file_type UDM field is set to FILE_TYPE_WMA. Else, if the upload_filetype log field value matches the regular expression (?i)(wmv), then the target.file.file_type UDM field is set to FILE_TYPE_WMV. Else, if the upload_filetype log field value matches the regular expression (?i)(woff|woff2), then the target.file.file_type UDM field is set to FILE_TYPE_WOFF. Else, if the upload_filetype log field value matches the regular expression (?i)(xml), then the target.file.file_type UDM field is set to FILE_TYPE_XML. Else, if the upload_filetype log field value matches the regular expression (?i)(xpi), then the target.file.file_type UDM field is set to FILE_TYPE_XPI. Else, if the upload_filetype log field value matches the regular expression (?i)(xwd), then the target.file.file_type UDM field is set to FILE_TYPE_XWD. Else, if the upload_filetype log field value matches the regular expression (?i)(zst), then the target.file.file_type UDM field is set to FILE_TYPE_ZST. Else, if the upload_filetype log field value matches the regular expression (?i)(Makefile|makefile|mk), then the target.file.file_type UDM field is set to FILE_TYPE_MAKEFILE. Else, if the upload_filetype log field value matches the regular expression (?i)(zlib), then the target.file.file_type UDM field is set to FILE_TYPE_ZLIB. Else, if the upload_filetype log field value matches the regular expression (?i)(hqx), then the target.file.file_type UDM field is set to FILE_TYPE_MACINTOSH. Else, if the upload_filetype log field value matches the regular expression (?i)(hfs|dsk|toast), then the target.file.file_type UDM field is set to FILE_TYPE_MACINTOSH_HFS. Else, if the upload_filetype log field value matches the regular expression (?i)(bh|log|dat), then the target.file.file_type UDM field is set to FILE_TYPE_BLACKHOLE. Else, if the log message matches the regular expression (?i)(\\bcookie\\b) AND the upload_filetype log field value matches the regular expression (?i)(txt), then the target.file.file_type UDM field is set to FILE_TYPE_COOKIE. Else, if the upload_filetype log field value matches the regular expression (?i)(txt), then the target.file.file_type UDM field is set to FILE_TYPE_TEXT. Else, if the upload_filetype log field value matches the regular expression (?i)(docx|xlsx|pptx), then the target.file.file_type UDM field is set to FILE_TYPE_OOXML. Else, if the upload_filetype log field value matches the regular expression (?i)(odt|ods|odp|odg), then the target.file.file_type UDM field is set to FILE_TYPE_ODF. Else, if the upload_filetype log field value matches the regular expression (?i)(for|f90|f95), then the target.file.file_type UDM field is set to FILE_TYPE_FORTRAN. Else, if the log message matches the regular expression (?i)(\\bwince\\b) AND the upload_filetype log field value matches the regular expression (?i)(exe|cab|dll), then the target.file.file_type UDM field is set to FILE_TYPE_WINCE. Else, if the log message matches the regular expression (?i)(\\bscript\\b) AND the upload_filetype log field value matches the regular expression (?i)(py|js|pl|rb), then the target.file.file_type UDM field is set to FILE_TYPE_SCRIPT. Else, if the log message matches the regular expression (?i)(\\bapplesingle\\b) AND the upload_filetype log field value matches the regular expression (?i)(as|bin), then the target.file.file_type UDM field is set to FILE_TYPE_APPLESINGLE. Else, if the log message matches the regular expression (?i)(\\bmacintosh\\b) AND the upload_filetype log field value matches the regular expression (?i)(dylib|a), then the target.file.file_type UDM field is set to FILE_TYPE_MACINTOSH_LIB. Else, if the log message matches the regular expression (?i)(\\bappledouble\\b) AND the upload_filetype log field value matches the regular expression (?i)(ad|._), then the target.file.file_type UDM field is set to FILE_TYPE_APPLEDOUBLE. Else, if the log message matches the regular expression (?i)(\\bobjetivec\\b) AND the upload_filetype log field value matches the regular expression (?i)(m|mm|h), then the target.file.file_type UDM field is set to FILE_TYPE_OBJETIVEC. Else, if the upload_filetype log field value matches the regular expression (?i)(obj|lib), then the target.file.file_type UDM field is set to FILE_TYPE_COFF. Else, if the log message matches the regular expression (?i)(\\bcpp\\b) AND the upload_filetype log field value matches the regular expression (?i)(hpp|cpp|cc|cxx|h), then the target.file.file_type UDM field is set to FILE_TYPE_CPP. Else, if the upload_filetype log field value matches the regular expression (?i)(pas|pp), then the target.file.file_type UDM field is set to FILE_TYPE_PASCAL. Else, if the upload_filetype log field value matches the regular expression (?i)(pl|pm), then the target.file.file_type UDM field is set to FILE_TYPE_PERL. Else, if the upload_filetype log field value matches the regular expression (?i)\\bsh\\b, then the target.file.file_type UDM field is set to FILE_TYPE_SHELLSCRIPT. Else, if the upload_filetype log field value matches the regular expression (?i)\\bc\\b$, then the target.file.file_type UDM field is set to FILE_TYPE_C. Else, if the upload_filetype log field value matches the regular expression (?i)\\bn\\b$, then the target.file.file_type UDM field is set to FILE_TYPE_NEKO. Else, if the upload_filetype log field value matches the regular expression (?i)\\bf\\b, then the target.file.file_type UDM field is set to FILE_TYPE_FORTRAN. Else, the UDM field additional.fields.key is set to file_type and the log field value upload_filetype is mapped to the additional.fields.value UDM field, provided the upload_filetype value is not empty.
upload_filename	target.file.full_path	If the filename log field value is equal to None and the upload_filename log field value is not equal to None, then the upload_filename log field is mapped to the target.file.full_path UDM field. Else, if the filename log field value is not equal to None and the upload_filename log field value is not equal to None, then the upload_filename log field is mapped to the target.resource.attribute.labels[upload_filename] UDM field.
b64upload_filename	target.file.full_path	If the filename log field value is equal to None and the b64upload_filename log field value is not equal to None, then the b64upload_filename log field is mapped to the target.file.full_path UDM field. Else, if the filename log field value is not equal to None and the b64upload_filename log field value is not equal to None, then the b64upload_filename log field is mapped to the target.resource.attribute.labels[upload_filename] UDM field.
eupload_filename	target.file.full_path	If the filename log field value is equal to None and the eupload_filename log field value is not equal to None, then the eupload_filename log field is mapped to the target.file.full_path UDM field. Else, if the filename log field value is not equal to None and the eupload_filename log field value is not equal to None, then the eupload_filename log field is mapped to the target.resource.attribute.labels[upload_filename] UDM field.
upload_filesubtype	additional.fields[upload_filesubtype]
upload_doctypename	additional.fields[upload_doctypename]
unscannabletype	security_result.detection_fields[unscannabletype]
rdr_rulename	intermediary.security_result.rule_name
b64rdr_rulename	intermediary.security_result.rule_name
	intermediary.resource.resource_type	If the rdr_rulename log field value is not empty, then the intermediary.resource.resource_type UDM field is set to GATEWAY.
ordr_rulename	additional.fields[ordr_rulename]
fwd_type	intermediary.resource.attribute.labels[fwd_type]
fwd_gw_name	intermediary.resource.name
b64fwd_gw_name	intermediary.resource.name
ofwd_gw_name	security_result.detection_fields[ofwd_gw_name]
fwd_gw_ip	intermediary.ip
zpa_app_seg_name	additional.fields[zpa_app_seg_name]
b64zpa_app_seg_name	additional.fields[zpa_app_seg_name]
ozpa_app_seg_name	additional.fields[ozpa_app_seg_name]
reqdatasize	additional.fields[reqdatasize]
reqhdrsize	additional.fields[reqhdrsize]
requestsize	network.sent_bytes
respdatasize	additional.fields[respdatasize]
resphdrsize	additional.fields[resphdrsize]
responsesize	network.received_bytes
transactionsize	additional.fields[transactionsize]
contenttype	target.file.mime_type
df_hosthead	security_result.detection_fields[df_hosthead]
df_hostname	security_result.detection_fields[df_hostname]
hostname	target.hostnametarget.asset.hostname
b64host	target.hostnametarget.asset.hostname
ehost	target.hostnametarget.asset.hostname
refererURL	network.http.referral_url
b64referer	network.http.referral_url
ereferer	network.http.referral_url
erefererpath	additional.fields[erefererpath]
refererhost	additional.fields[refererhost]
erefererhost	additional.fields[refererhost]
requestmethod	network.http.method
reqversion	additional.fields[reqversion]
status	network.http.response_code
respversion	additional.fields[respversion]
ua_token	additional.fields[ua_token]
useragent	network.http.user_agent
b64ua	network.http.user_agent
eua	network.http.user_agent
useragent	network.http.parsed_user_agent
b64ua	network.http.parsed_user_agent
eua	network.http.parsed_user_agent
uaclass	additional.fields[uaclass]
url	target.url
b64url	target.url
eurl	target.url
eurlpath	additional.fields[eurlpath]
mobappname	additional.fields[mobappname]
b64mobappname	additional.fields[mobappname]
emobappname	additional.fields[mobappname]
mobappcat	additional.fields[mobappcat]
mobdevtype	additional.fields[mobdevtype]
clt_sport	principal.port
ClientIP	principal.ip
ocip	security_result.detection_fields[ocip]
cpubip	additional.fields[cpubip]
ocpubip	additional.fields[ocpubip]
clientpublicIP	principal.nat_ip
serverip	target.ip
	network.application_protocol	If the protocol log field value contain one of the following values, then the network.application_protocol UDM field is set to HTTP. HTTP HTTP_PROXY Else, if the protocol log field value contain one of the following values, then the network.application_protocol UDM field is set to HTTPS. HTTPS SSL TUNNEL_SSL DNSOVERHTTPS TUNNEL Else, the network.application_protocol UDM field is set to UNKNOWN_APPLICATION_PROTOCOL.
alpnprotocol	additional.fields[alpnprotocol]
trafficredirectmethod	intermediary.resource.attribute.labels[trafficredirectmethod]
location	principal.location.name
elocation	principal.location.name
userlocationname	principal.location.name	If the userlocationname log field value is not equal to None, then the userlocationname log field is mapped to the principal.location.name UDM field.
b64userlocationname	principal.location.name
euserlocationname	principal.location.name
rulelabel	security_result.rule_name	If the action log field value is equal to Blocked, then the rulelabel log field is mapped to the security_result.rule_name UDM field.
b64rulelabel	security_result.rule_name
erulelabel	security_result.rule_name
ruletype	security_result.rule_type
reason	security_result.description	If the action log field value is equal to Blocked, then the reason log field is mapped to the security_result.description UDM field.
action	security_result.action_details
	security_result.action	If the action log field value is equal to Allowed, then the security_result.action UDM field is set to ALLOW. Else, if the action log field value is equal to Blocked, then the security_result.action UDM field is set to BLOCK.
urlfilterrulelabel	security_result.rule_name
b64urlfilterrulelabel	security_result.rule_name
eurlfilterrulelabel	security_result.rule_name
ourlfilterrulelabel	security_result.detection_fields[ourlfilterrulelabel]
apprulelabel	target.security_result.rule_name
b64apprulelabel	target.security_result.rule_name
oapprulelabel	security_result.detection_fields[oapprulelabel]
bamd5	target.file.md5
sha256	target.file.sha256
ssldecrypted	security_result.detection_fields[ssldecrypted]
externalspr	security_result.about.artifact.last_https_certificate.extension.certificate_policies
keyprotectiontype	security_result.about.artifact.last_https_certificate.extension.key_usage
clientsslcipher	network.tls.client.supported_ciphers
clienttlsversion	network.tls.version
clientsslsessreuse	security_result.detection_fields[clientsslsessreuse]
cltsslfailreason	security_result.detection_fields[cltsslfailreason]
cltsslfailcount	security_result.detection_fields[cltsslfailcount]
srvsslcipher	network.tls.cipher
srvtlsversion	security_result.detection_fields[srvtlsversion]
srvocspresult	security_result.detection_fields[srvocspresult]
srvcertchainvalpass	security_result.detection_fields[srvcertchainvalpass]
srvwildcardcert	security_result.detection_fields[srvwildcardcert]
serversslsessreuse	security_result.detection_fields[server_ssl_sess_reuse]
srvcertvalidationtype	security_result.detection_fields[srvcertvalidationtype]
srvcertvalidityperiod	security_result.detection_fields[srvcertvalidityperiod]
is_ssluntrustedca	security_result.detection_fields[is_ssluntrustedca]
is_sslselfsigned	security_result.detection_fields[is_sslselfsigned]
is_sslexpiredca	security_result.detection_fields[is_sslexpiredca]
pagerisk	security_result.risk_score
	security_result.severity	If the pagerisk log field value is greater than or equal to 90 and the pagerisk log field value is less than or equal to 100, then the security_result.severity UDM field is set to CRITICAL. If the pagerisk log field value is greater than or equal to 75 and the pagerisk log field value is less than or equal to 89, then the security_result.severity UDM field is set to HIGH. If the pagerisk log field value is greater than or equal to 46 and the pagerisk log field value is less than or equal to 74, then the security_result.severity UDM field is set to MEDIUM. If the pagerisk log field value is greater than or equal to 1 and the pagerisk log field value &is less than or equal to 45, then the security_result.severity UDM field is set to LOW. If the pagerisk log field value is equal to 0, then the security_result.severity UDM field is set to NONE.
threatseverity	security_result.severity_details	If the pagerisk log field value is not empty and the threatseverity log field value is not empty, then the security_result.severity_details UDM field is set to %{pagerisk} - %{threatseverity}. Else, if the threatseverity log field value is not empty, then the threatseverity log field is mapped to the security_result.severity_details UDM field.
activity	additional.fields[activity]
is_dst_cntry_risky	additional.fields[is_dst_cntry_risky]
is_src_cntry_risky	additional.fields[is_src_cntry_risky]
prompt_req	additional.fields[prompt_req]
srcip_country	principal.ip_geo_artifact.location.country_or_region
pcapid	security_result.about.file.full_path
all_dlprulenames	security_result.rule_labels[all_dlprulenames]
other_dlprulenames	security_result.rule_labels[other_dlprulenames]
trig_dlprulename	security_result.rule_name
dstip_country	target.ip_geo_artifact.location.country_or_region
srv_dport	target.port
inst_level2_name	target.resource_ancestors.name
inst_level3_name	target.resource_ancestors.name
inst_level2_id	target.resource_ancestors.product_object_id
inst_level3_id	target.resource_ancestors.product_object_id
inst_level2_type	target.resource_ancestors.resource_subtype
inst_level3_type	target.resource_ancestors.resource_subtype
	target.resource_ancestors.resource_type	If the inst_level2_type log field value matches the regular expression pattern organization then, the target.resource_ancestors.resource_type UDM field is set to CLOUD_ORGANIZATION. Else, if inst_level2_type log field value matches the regular expression pattern service then, the target.resource_ancestors.resource_type UDM field is set to BACKEND_SERVICE. Else, if inst_level2_type log field value matches the regular expression pattern policy then, the target.resource_ancestors.resource_type UDM field is set to ACCESS_POLICY. Else, if inst_level2_type log field value matches the regular expression pattern project then, the target.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT. Else, if inst_level2_type log field value matches the regular expression pattern cluster then, the target.resource_ancestors.resource_type UDM field is set to CLUSTER. Else, if inst_level2_type log field value matches the regular expression pattern container then, the target.resource_ancestors.resource_type UDM field is set to CONTAINER. Else, if inst_level2_type log field value matches the regular expression pattern pod then, the target.resource_ancestors.resource_type UDM field is set to POD. Else, if inst_level2_type log field value matches the regular expression pattern repository then, the target.resource_ancestors.resource_type UDM field is set to REPOSITORY. If the inst_level3_type log field value matches the regular expression pattern organization then, the target.resource_ancestors.resource_type UDM field is set to CLOUD_ORGANIZATION. Else, if inst_level3_type log field value matches the regular expression pattern service then, the target.resource_ancestors.resource_type UDM field is set to BACKEND_SERVICE. Else, if inst_level3_type log field value matches the regular expression pattern policy then, the target.resource_ancestors.resource_type UDM field is set to ACCESS_POLICY. Else, if inst_level3_type log field value matches the regular expression pattern project then, the target.resource_ancestors.resource_type UDM field is set to CLOUD_PROJECT. Else, if inst_level3_type log field value matches the regular expression pattern cluster then, the target.resource_ancestors.resource_type UDM field is set to CLUSTER. Else, if inst_level3_type log field value matches the regular expression pattern container then, the target.resource_ancestors.resource_type UDM field is set to CONTAINER. Else, if inst_level3_type log field value matches the regular expression pattern pod then, the target.resource_ancestors.resource_type UDM field is set to POD. Else, if inst_level3_type log field value matches the regular expression pattern repository then, the target.resource_ancestors.resource_type UDM field is set to REPOSITORY.
inst_level1_name	target.resource.name
inst_level1_id	target.resource.product_object_id
inst_level1_type	target.resource.resource_subtype
	target.resource.resource_type	If the inst_level1_type log field value matches the regular expression pattern organization then, the target.resource.resource_type UDM field is set to CLOUD_ORGANIZATION. Else, if inst_level1_type log field value matches the regular expression pattern service then, the target.resource.resource_type UDM field is set to BACKEND_SERVICE. Else, if inst_level1_type log field value matches the regular expression pattern policy then, the target.resource.resource_type UDM field is set to ACCESS_POLICY. Else, if inst_level1_type log field value matches the regular expression pattern project then, the target.resource.resource_type UDM field is set to CLOUD_PROJECT. Else, if inst_level1_type log field value matches the regular expression pattern cluster then, the target.resource.resource_type UDM field is set to CLUSTER. Else, if inst_level1_type log field value matches the regular expression pattern container then, the target.resource.resource_type UDM field is set to CONTAINER. Else, if inst_level1_type log field value matches the regular expression pattern pod then, the target.resource.resource_type UDM field is set to POD. Else, if inst_level1_type log field value matches the regular expression pattern repository then, the target.resource.resource_type UDM field is set to REPOSITORY.
app_status	target.security_result.detection_fields[app_status]
threatname	security_result.threat_name
b64threatname	security_result.threat_name
threatcategory	security_result.associations.name
threatclass	security_result.associations.description
urlclass	security_result.detection_fields[urlclass]
urlsupercategory	security_result.category_details
urlcategory	security_result.category_details
b64urlcat	security_result.category_details
ourlcat	security_result.detection_fields[ourlcat]
urlcatmethod	security_result.detection_fields[urlcatmethod]
bypassed_traffic	security_result.detection_fields[bypassed_traffic]
bypassed_etime	security_result.detection_fields[bypassed_etime]
deviceappversion	additional.fields[deviceappversion]
devicehostname	principal.asset.hostname
odevicehostname	security_result.detection_fields[odevicehostname]
devicemodel	principal.asset.hardware.model
devicename	principal.asset.asset_id
odevicename	security_result.detection_fields[odevicename]
	principal.asset.platform_software.platform	If the deviceostype log field value matches the regular expression pattern (?i)iOS, then the principal.asset.platform_software.platform UDM field is set to IOS. Else, if the deviceostype log field value matches the regular expression pattern (?i)Android, then the principal.asset.platform_software.platform UDM field is set to ANDROID. Else, if the deviceostype log field value matches the regular expression pattern (?i)Windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the deviceostype log field value matches the regular expression pattern (?i)MAC, then the principal.asset.platform_software.platform UDM field is set to MAC. Else, if the deviceostype log field value matches the regular expression pattern (?i)Other, then the principal.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
deviceosversion	principal.asset.software.version
deviceowner	principal.asset.attribute.labels[deviceowner]
odeviceowner	security_result.detection_fields[odeviceowner]
devicetype	principal.asset.category
external_devid	additional.fields[external_devid]
flow_type	additional.fields[flow_type]
ztunnelversion	additional.fields[ztunnelversion]
event_id	metadata.product_log_id
productversion	metadata.product_version
nsssvcip	about.ip
eedone	additional.fields[eedone]
ssl_rulename	security_result.rule_name
client_tls_keyex_pqc_offers	additional.fields[client_tls_keyex_pqc_offers]
client_tls_keyex_hybrid_offers	additional.fields[client_tls_keyex_hybrid_offers]
client_tls_keyex_unknown_offers	additional.fields[client_tls_keyex_unknown_offers]
client_tls_sig_pqc_offers	additional.fields[client_tls_sig_pqc_offers]
client_tls_sig_non_pqc_offers	additional.fields[client_tls_sig_non_pqc_offers]
client_tls_sig_hybrid_offers	additional.fields[client_tls_sig_hybrid_offers]
client_tls_sig_unknown_offers	additional.fields[client_tls_sig_unknown_offers]
client_tls_keyex_alg	additional.fields[client_tls_keyex_alg]
client_tls_sig_alg	additional.fields[client_tls_sig_alg]
server_tls_keyex_alg	additional.fields[server_tls_keyex_alg]
server_tls_sig_alg	additional.fields[server_tls_sig_alg]
time	additional.fields[time]
ft_rulename	security_result.rule_name
upload_doc_sub_type	additional.fields[upload_doc_sub_type]
client_tls_keyex_non_pqc_offers	additional.fields[client_tls_keyex_non_pqc_offers]

¿Necesitas más ayuda? Obtén respuestas de miembros de la comunidad y profesionales de Google SecOps.