Mengumpulkan log F5 ASM

Versi Parser: 33.0

Didukung di:

Google SecOps SIEM

Dokumen ini menjelaskan cara menyerap log F5 Application Security Manager (ASM) ke Google Security Operations menggunakan agen Bindplane.

F5 BIG-IP ASM adalah firewall aplikasi web (WAF) yang menghasilkan pesan syslog untuk pelanggaran permintaan HTTP, tindakan penegakan kebijakan, dan peristiwa keamanan. Parser mendukung beberapa format log (CEF, syslog, CSV, Splunk, JSON) dan memetakannya ke Model Data Terpadu (UDM).

Sebelum memulai

Pastikan Anda memiliki prasyarat berikut:

• Instance Google SecOps
• Windows Server 2016 atau yang lebih baru, atau host Linux dengan systemd
• Konektivitas jaringan antara agen Bindplane dan perangkat F5 BIG-IP
• Jika beroperasi dari balik proxy, pastikan port firewall terbuka sesuai dengan persyaratan agen Bindplane
• Akses istimewa ke tmsh F5 BIG-IP

Mendapatkan kredensial Google SecOps untuk agen Bindplane

Untuk mengautentikasi agen Bindplane ke Google SecOps, pilih salah satu metode berikut:

• Deployment baru: Gunakan Chronicle API (Opsi 1).
• Deployment lama: Terus gunakan file autentikasi penyerapan (Opsi 2) hingga Ingestion API dihentikan pada 20 Juli 2027.

Opsi 1: Buat akun layanan untuk Chronicle API (direkomendasikan)

1. Login ke konsolGoogle Cloud dan pilih project Google Cloud yang ditautkan ke instance Google SecOps Anda.
2. Buka IAM & Admin > Service Accounts.
3. Klik Create service account.
4. Berikan detail konfigurasi berikut:
   • Service account name: Masukkan nama akun (misalnya, bindplane-ingest).
   • Deskripsi akun layanan: Masukkan deskripsi (misalnya, Bindplane agent log ingestion).
5. Klik Create and continue.
6. Di bagian Grant this service account access to project, klik Select a role, lalu pilih Chronicle Editor.
7. Klik Continue lalu klik Done.
8. Klik akun layanan yang Anda buat, lalu buka tab Keys.
9. Klik Add key > Create new key.
10. Pilih JSON, lalu klik Create. File kunci akan didownload ke komputer Anda.
11. Simpan file kunci sebagai ingestion-auth.json di direktori Bindplane collector (/opt/observiq-otel-collector/ingestion-auth.json di Linux atau C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json di Windows), atau perbarui creds_file_path di config.yaml agar sesuai dengan jalur tempat Anda menyimpannya.
12. Buka IAM & Admin > Settings dan salin Project number. Anda akan memerlukannya untuk konfigurasi pengekspor.

Catatan: Kunci JSON adalah kredensial. Batasi akses ke file di host Bindplane dan rotasikan kunci sesuai dengan kebijakan organisasi Anda.

Opsi 2: Mendownload file autentikasi penyerapan (lama)

1. Login ke konsol Google SecOps.
2. Buka SIEM Settings > Collection Agents.
3. Download file autentikasi penyerapan.
4. Simpan file dengan aman di sistem tempat agen BindPlane akan diinstal.

Catatan: File ini mengautentikasi agen ke Ingestion API lama (malachiteingestion-pa.googleapis.com), yang dijadwalkan Google untuk dihentikan pada 20 Juli 2027. Berencana beralih ke Opsi 1 sebelum tanggal tersebut.

Mendapatkan ID pelanggan Google SecOps

1. Login ke konsol Google SecOps.
2. Buka Setelan SIEM > Profil.

3. Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.

   Catatan: ID pelanggan diperlukan untuk mengonfigurasi pengekspor agen Bindplane.

Menginstal agen Bindplane

Instal agen Bindplane di sistem operasi Windows atau Linux Anda sesuai dengan petunjuk berikut.

Penginstalan Windows

1. Buka Command Prompt atau PowerShell sebagai administrator.

2. Jalankan perintah berikut:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. Tunggu hingga penginstalan selesai.

4. Verifikasi penginstalan dengan menjalankan:

   sc query observiq-otel-collector
   

   Layanan akan ditampilkan sebagai RUNNING.

Penginstalan Linux

1. Buka terminal dengan hak istimewa root atau sudo.

2. Jalankan perintah berikut:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

3. Tunggu hingga penginstalan selesai.

4. Verifikasi penginstalan dengan menjalankan:

   sudo systemctl status observiq-otel-collector
   

   Layanan akan ditampilkan sebagai aktif (berjalan).

Referensi penginstalan tambahan

Untuk mengetahui opsi penginstalan dan pemecahan masalah tambahan, lihat Panduan penginstalan agen Bindplane.

Catatan: Konfigurasi pengekspor Chronicle API memerlukan Bindplane collector v1.106.0 atau yang lebih baru. Perintah sebelumnya akan menginstal rilis terbaru. Jika Anda mengupdate penginstalan yang ada, upgrade kolektor sebelum mengubah konfigurasi.

Mengonfigurasi agen Bindplane untuk menyerap syslog dan mengirimkannya ke Google SecOps

Menemukan file konfigurasi

• Linux:

  sudo nano /opt/observiq-otel-collector/config.yaml
  

• Windows:

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

Mengedit file konfigurasi

• Ganti seluruh konten config.yaml dengan konfigurasi berikut:

  receivers:
    udplog:
      listen_address: "0.0.0.0:514"
  
  exporters:
    chronicle/f5_asm:
      protocol: https
      # Region of your instance, for example us, europe, asia-southeast1
      location: <LOCATION>
      # Project number of the Google Cloud project linked to the instance
      project: '<PROJECT_NUMBER>'
      compression: gzip
      creds_file_path: '/opt/observiq-otel-collector/ingestion-auth.json'
      customer_id: '<customer_id>'
      endpoint: chronicle.googleapis.com
      log_type: F5_ASM
      raw_log_field: body
  
  service:
    pipelines:
      logs/f5_asm_to_chronicle:
        receivers:
          - udplog
        exporters:
          - chronicle/f5_asm
  

Parameter konfigurasi

Ganti placeholder berikut:

• Konfigurasi penerima:

  • listen_address: Alamat IP dan port untuk diproses:
    • 0.0.0.0 untuk memproses semua antarmuka (direkomendasikan)
    • Port 514 adalah port syslog standar (memerlukan root di Linux; gunakan 1514 untuk non-root)

• Konfigurasi pengekspor:

  • creds_file_path: Jalur lengkap ke file kunci JSON akun layanan (Opsi 1):
    • Linux: /opt/observiq-otel-collector/ingestion-auth.json
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • customer_id: ID Pelanggan yang disalin dari konsol Google SecOps
  • location: Ganti <LOCATION> dengan region instance Google SecOps Anda (misalnya, us, europe, atau asia-southeast1). Pengekspor mengawali chronicle.googleapis.com dengan nilai ini. Lihat Endpoint Regional untuk mengetahui daftar lengkapnya.
  • project: Ganti <PROJECT_NUMBER> dengan nomor project dari IAM & Admin > Settings.
  • endpoint: Tetap tetapkan ke chronicle.googleapis.com.

Pengekspor API penyerapan lama

• Jika Anda menggunakan file autentikasi penyerapan dari Opsi 2, ganti blok exporters dengan kode berikut. Tetapkan creds_file_path ke jalur ke file autentikasi penyerapan, dan jika instance Anda berada di luar AS, ganti malachiteingestion-pa.googleapis.com dengan endpoint regional Anda (misalnya, europe-malachiteingestion-pa.googleapis.com).

  exporters:
    chronicle/f5_asm:
      compression: gzip
      creds_file_path: '/opt/observiq-otel-collector/ingestion-auth.json'
      customer_id: '<customer_id>'
      endpoint: malachiteingestion-pa.googleapis.com
      log_type: F5_ASM
      raw_log_field: body
  

Catatan: Pengekspor ini akan berhenti berfungsi saat Ingestion API dihentikan pada 20 Juli 2027.

Menyimpan file konfigurasi

• Setelah mengedit, simpan file:
  • Linux: Tekan Ctrl+O, lalu Enter, lalu Ctrl+X
  • Windows: Klik File > Save

Mulai ulang agen Bindplane untuk menerapkan perubahan

• Untuk memulai ulang agen Bindplane di Linux, jalankan perintah berikut:

  sudo systemctl restart observiq-otel-collector
  

  1. Pastikan layanan sedang berjalan:

     sudo systemctl status observiq-otel-collector
     

  2. Periksa log untuk mengetahui error:

     sudo journalctl -u observiq-otel-collector -f
     

• Untuk memulai ulang agen Bindplane di Windows, pilih salah satu opsi berikut:

  • Command Prompt atau PowerShell sebagai administrator:

    net stop observiq-otel-collector && net start observiq-otel-collector
    

  • Konsol Services:

    1. Tekan Win+R, ketik services.msc, lalu tekan Enter.
    2. Cari observIQ OpenTelemetry Collector.
    3. Klik kanan, lalu pilih Mulai ulang.

    4. Pastikan layanan sedang berjalan:

       sc query observiq-otel-collector
       

    5. Periksa log untuk mengetahui error:

       type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
       

Mengonfigurasi syslog di F5 ASM

1. Login ke instance tmsh dengan mengetik perintah berikut:

   tmsh
   

2. Edit konfigurasi syslog menggunakan perintah berikut:

   edit /sys syslog all-properties
   

3. Konfigurasi syslog akan terbuka di editor teks vi dan terlihat mirip dengan contoh berikut:

   modify syslog {
       auth-priv-from notice
       auth-priv-to emerg
       cron-from warning
       cron-to emerg
       daemon-from notice
       daemon-to emerg
       description none
       include none
       iso-date disabled
       kern-from notice
       kern-to emerg
       mail-from notice
       mail-to emerg
       messages-from notice
       messages-to warning
       remote-servers none
       user-log-from notice
       user-log-to emerg
   }
   

4. Ganti baris include none dengan filter syslog berikut:

   include `
       filter f_audit{
           match(AUDIT);
       };
       destination d_syslog_server {
           udp(\`<bindplane-ip>\` port (<bindplane-port>));
       };
       log {
           source(s_syslog_pipe);
           filter(f_audit);
           destination(d_syslog_server);
       };
   `
   

5. Ganti <bindplane-ip> dan <bindplane-port> dengan alamat IP dan nomor port sebenarnya yang dikonfigurasi untuk agen Bindplane Anda.

6. Keluar dari vi dengan mengetik urutan tombol berikut:

   :wq!
   

7. Pada perintah berikut, ketik y untuk menyimpan perubahan pada file:

   Save changes? (y/n/e)
   

8. Simpan konfigurasi dengan mengetik perintah berikut:

   save /sys config
   

Tabel pemetaan UDM

Nama kolom	UDM
/BAD_MSG/request-violations/violation[n]/actual_value_length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_pattern	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/blocking_mask	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/buffer	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/offset	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/expected_value_length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/extension	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/flg_disallowed_file_type	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sanity_checks_status	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation_status	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_code	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_violation_details	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/enforcement_level	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/post_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/query_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/blocking_mask	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/buffer	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/offset	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/sig_id	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/specific_desc	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/value_length_type	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/wildcard_entity	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/cfg_target	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/leakage_type	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/pattern_type	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/response_code	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_index	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_name	security_result.detection_fields
/BAD_MSG/violation_masks/alarm	security_result.detection_fields
/BAD_MSG/violation_masks/block	security_result.detection_fields
/BAD_MSG/violation_masks/learn	security_result.detection_fields
/BAD_MSG/violation_masks/staging	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/accessCode	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/companyId	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/txnPin	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/user	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/accessCode	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/companyId	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/txnPin	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/user	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/accessCode	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/companyId	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/txnPin	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/user	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/user	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/user	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/user	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/user	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/user	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/user	security_result.detection_fields
_csrfToken	security_result.detection_fields
Accept	additional.fields
accept	additional.fields
Accept-Charset	additional.fields
Accept-Encoding	additional.fields
accept-encoding	additional.fields
acceptEncoding	security_result.detection_fields
Accept-Language	additional.fields
accept-language	additional.fields
acceptLanguage	security_result.detection_fields
Access-Control-Request-Headers	security_result.detection_fields
Access-Control-Request-Method	network.http.method
AccountSid	target.resource.product_object_id
AccountType	target.user.attribute.roles.description
act	security_result.action security_result.action_details
act1	security_result.action
Action	additional.fields
action	security_result.action security_result.action_details
action_summary	security_result.detection_fields
additional_bot_signatures	security_result.detection_fields
actual_mitigation_action	security_result.detection_fields
actual_mitigation_action_reason	security_result.detection_fields
alert_level	security_result.severity
anomalies	additional.fields
anomaly_categories	additional.fields
apache_module	security_result.detection_fields
ApiVersion	security_result.detection_fields
App-Name	target.application
Application	target.application
Application-Type	security_result.detection_fields
application_display_name	additional.fields
application_version	security_result.detection_fields
appID	security_result.detection_fields
app_protocol	network.application_protocol
app-version	security_result.detection_fields
attack_type	metadata.description
attacktype	security_result.category_details
audit_component	additional.fields
auth	principal.user.userid
authCode	security_result.detection_fields
auth_level	principal.user.attribute.roles.name
auth_status	security_result.action security_result.summary
batchKey	security_result.detection_fields
batchNo	security_result.detection_fields
BEAuthenticator	security_result.detection_fields
bigip_mgmt_ip	intermediary.ip
bigip_mgmt_ip2	intermediary.ip
bill.isRecurring	security_result.detection_fields
bill.productId	security_result.detection_fields
blocking_exception_reason	security_result.detection_fields
bot_name	additional.fields
bot_signature	additional.fields
bot_signature_category	additional.fields
browser_actual_verification_action	additional.fields
browser_configured_verification_action	additional.fields
browser_verification_status	security_result.detection_fields
bundle-version	additional.fields
bytes_in	network.received_bytes
bytes_out	network.sent_bytes
c6a1	intermediary.ip Kondisi: [c6a1Label] == "device_address"
c6a2	principal.ip principal.asset.ip Kondisi: [c6a2Label] == "source_address"
c6a3	target.ip target.asset.ip Kondisi: [c6a3Label] == "destination_address"
c6a4	security_result.about.ip security_result.about.asset.ip Kondisi: [c6a4Label] == "ip_address_intelligence"
Cache-Control	additional.fields
captcha_result	security_result.detection_fields
captcha_status	security_result.detection_fields
category	security_result.category_details
cdn-loop	security_result.detection_fields
CF-Connecting-IP	principal.ip principal.asset.ip
cf-cert-presented	principal.asset.attribute.labels
cf-cert-revoked	principal.asset.attribute.labels
cf-cert-verified	principal.asset.attribute.labels
cf-ipcity	principal.location.city
CF-IPCountry	principal.location.country_or_region
cf-ipcountry	principal.location.country_or_region
cf-ipcontinent	principal.asset.attribute.labels
cf-iplatitude	principal.location.region_coordinates.latitude
cf-iplongitude	principal.location.region_coordinates.longitude
cf-ipmetro-code	principal.asset.attribute.labels
cf-ipostal-code	principal.asset.attribute.labels
cf-iregion	principal.location.state
cf-iregion-code	principal.asset.attribute.labels
cf-itimezone	principal.asset.attribute.labels
cf-ray	principal.asset.attribute.labels
CF-Visitor	security_result.detection_fields
CF-Visitor.scheme	principal.asset.attribute.labels
challenge_failure_reason	additional.fields
Channel	security_result.detection_fields
channel	security_result.detection_fields
Check-Id	additional.fields
childTableRef	security_result.detection_fields
CIPHER	network.tls.cipher
city	principal.location.city
class	additional.fields
classification_reason	security_result.detection_fields
clearGadgetId	security_result.detection_fields
client-request-id	additional.fields
client_id	security_result.detection_fields
client_ip	principal.ip
client_ip_geo_location	principal.location.country_or_region
client_port	principal.port
client_request_uri	target.url
client_type	additional.fields
Client-Version	security_result.detection_fields
cmd_data	principal.process.command_line
cn2 and cn2label	security_result.detection_fields
cn3	principal.asset_id Kondisi: [cn3Label] == "device_id" Jika tidak: security_result.detection_fields
cn4 and cn4label	additional.fields Kondisi: [cs4label] == "whitelistData"
cn5 and cn5label	additional.fields
collected_time	metadata.collected_timestamp
component	additional.fields
COMPRESSION	security_result.detection_fields
configured_mitigation_action	security_result.detection_fields
configured_mitigation_action_reason	security_result.detection_fields
configuration_date_time	security_result.detection_fields
Connection	additional.fields
connection	additional.fields
contactNo	principal.user.phone_numbers
Content-Length	additional.fields
content-length	additional.fields
Content-Type	additional.fields
content-type	additional.fields
context_name	additional.fields
context_type	additional.fields
contextPath	security_result.detection_fields
Correlation-Id	security_result.detection_fields
country	principal.location.country_or_region
cs1	security_result.rule_id
cs2	security_result.summary Kondisi: [cs2Label] == "reason" Jika tidak: security_result.detection_fields
cs3	security_result.detection_fields
cs4 and cs4label	additional.fields
cs5	principal.ip principal.asset.ip
currency	security_result.detection_fields
currency_type	security_result.detection_fields
current_monitor_state_1	security_result.detection_fields
current_monitor_state_2	security_result.detection_fields
currentFormName	security_result.detection_fields
custMobile	security_result.detection_fields
data.bits	network.sent_bytes
data.name	network.tls.cipher
data.sessionid	network.session_id
data.version	network.tls.version
data_mwh_requestId	security_result.detection_fields
data_renegotiation	security_result.detection_fields
datosReto	security_result.detection_fields
DATE	metadata.event_timestamp
date_time	metadata.event_timestamp
dependentInfo.DependentRel2Name	security_result.detection_fields
dependentInfo.MasterObjectId	security_result.detection_fields
dependentInfo.MasterObjectTableRef	security_result.detection_fields
dependentInfo.RelationshipTag	security_result.detection_fields
desc	security_result.description
description	metadata.description
DEST_IP	target.ip
dest_ip	target.ip
DEST_PORT	target.port
dest_port	target.port
DeviceBrand	principal.asset.hardware.manufacturer (hanya menerima string) principal.asset.attribute.labels (digunakan saat DeviceBrand berisi bilangan bulat, bukan string)
device.app_signature	principal.asset.attribute.labels
device.app_version	principal.asset.platform_software.platform_version
device_blade	intermediary.asset.attribute.labels
device.build_number	principal.asset.attribute.labels
device.device_id	principal.asset_id
device_id	principal.asset_id
device_id_action	security_result.detection_fields
device_id_status	security_result.detection_fields
device.manufacturer	principal.asset.hardware.manufacturer
DeviceModel	principal.asset.hardware.model
device.model	principal.asset.hardware.model
DeviceName	principal.asset.attribute.labels
DeviceOsFamily	principal.asset.platform_software.platform
device.os_version	principal.platform_version
DeviceOsVersion	principal.platform_version
device.platform	principal.asset.platform_software.platform
device_product	additional.fields
device.sdk_int	principal.asset.attribute.labels
DeviceScreenDensity	principal.asset.attribute.labels
DeviceScreenH	principal.asset.attribute.labels
DeviceScreenW	principal.asset.attribute.labels
DeviceSerial	principal.asset.hardware.serial_number
deviceSerialNo	principal.asset.hardware.serial_number
DeviceUnique	principal.asset.product_object_id
DeviceVendorId	principal.asset.attribute.labels
device_version	metadata.product_version
dimensioneLista	security_result.detection_fields
DNT	security_result.detection_fields
dos_attack_detection_mode	security_result.detection_fields
dos_attack_event	security_result.detection_fields
dos_attack_id	security_result.detection_fields
dos_attack_latency	security_result.detection_fields
dos_attack_name	security_result.detection_fields
dos_attack_tps	security_result.detection_fields
dos_baseline_latency	additional.fields
dos_baseline_tps	additional.fields
dos_dropped_requests_count	additional.fields
dos_incoming_requests_count	additional.fields
dos_mitigation_action	security_result.detection_fields
dos_mitigation_reason	security_result.detection_fields
dpt	target.port
dhost	target.hostname
dst	target.ip
dvc	intermediary.ip
dvchost	intermediary.hostname
ECID-Context	security_result.detection_fields
EE_I_ConsultaListadoProcesosCRM.codigoEntidad	security_result.detection_fields
EE_I_VerificacionBeneficiario.codigoEntidad	security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanBeneficiario	security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanOrdenante	security_result.detection_fields
EE_I_VerificacionBeneficiario.nombreBeneficiario	security_result.detection_fields
email	principal.user.email_addresses
end	additional.fields
enforced_by	additional.fields
environment	security_result.detection_fields
errorcode	security_result.action security_result.rule_id
error_message	security_result.summary
errdefs_msg_name	additional.fields
errdefs_msgno	additional.fields
eventId	security_result.detection_fields
event_time	metadata.event_timestamp
expected_state	security_result.detection_fields
expDate	security_result.detection_fields
expires_in	security_result.detection_fields
externalId	additional.fields
f5_action	security_result.action
f5_file	security_result.detection_fields
f5_http_method	network.http.method
f5_id	security_result.rule_id
f5_line	security_result.detection_fields
f5_name	additional.fields
f5_path	security_result.detection_fields
f5_rev	security_result.rule_version
f5_rule_accuracy	security_result.detection_fields
f5_rule_maturity	security_result.detection_fields
f5_rule_version	security_result.detection_fields
f5_signature	security_result.rule_name
f5_sig_two	security_result.threat_id
f5_tag	security_result.detection_fields
f5_unique_id	network.session_id
f5_uri	target.url
f5_waf_msg	security_result.summary
facility	additional.fields
family_name	principal.user.last_name
Fixed-Device-Id	security_result.detection_fields
flavor	security_result.detection_fields
folder	principal.file.full_path
form_data	additional.fields
From	principal.user.phone_numbers
fragment	security_result.detection_fields
geo_info	security_result.detection_fields
geo_location	principal.location.country_or_region
given_name	principal.user.first_name
grant_type	security_result.detection_fields
hashing_cf	security_result.detection_fields
hashingCF	security_result.detection_fields
headless_signatures	security_result.detection_fields
header-one	additional.fields
Host	target.hostname target.asset.hostname
Hostname	principal.hostname
http_class_name	security_result.detection_fields
http_method	network.http.method
http_protocol_indication	network.application_protocol
http_request	network.http.referral_url
http_version	network.application_protocol_version
human_behaviour	security_result.detection_fields
id	additional.fields
idApp	target.resource.product_object_id
identificativointermediariopa	security_result.detection_fields
identificativoStazioneIntermediarioPA	security_result.detection_fields
idExterno	security_result.detection_fields
idReto	security_result.detection_fields
id_token	security_result.detection_fields
I-Twilio-Idempotency-Token	security_result.detection_fields
If-Modified-Since	security_result.detection_fields
ifModifiedSince	security_result.detection_fields
If-None-Match	security_result.detection_fields
ifNoneMatch	security_result.detection_fields
Image	target.file.full_path
imei	security_result.detection_fields
incap-client-ip	principal.ip principal.asset.ip
inquiretransaction_accessCode	security_result.detection_fields
inquiretransaction_companyId	security_result.detection_fields
inquiretransaction_txnPin	security_result.detection_fields
inquiretransaction_user	security_result.detection_fields
internal_timestamp	metadata.event_timestamp
intermediary_Ip	intermediary.ip
intermediary_port	intermediary.port
invoiceNo	security_result.detection_fields
ip	security_result.about.ip
IP_ADDRESS	principal.ip principal.asset.ip
ip_addr_int	security_result.detection_fields
ip_addr_intelli	security_result.detection_fields
IP_CLIENT	principal.ip
ip_client	principal.ip
IpIntelligenceCategory	additional.fields
ip_route_domain	principal.ip principal.asset.ip
Ipv4AddressIntelligence	additional.fields
irule	security_result.rule_name
irule-version	security_result.rule_version
isDccTransaction	security_result.detection_fields
isDebugConnected	security_result.detection_fields
isDebuggable	security_result.detection_fields
isHooked	security_result.detection_fields
isRunningInEmulator	security_result.detection_fields
isSignedWithDebugKey	security_result.detection_fields
isTamperedApk	security_result.detection_fields
is_trunct	security_result.detection_fields
isWrongCert	security_result.detection_fields
jailbroken_or_rooted_device	security_result.detection_fields
Keep-Alive	additional.fields
lat	security_result.detection_fields
lbCookie	security_result.detection_fields
level	security_result.severity
link	target.url
listener	security_result.detection_fields
lng	security_result.detection_fields
Locale	security_result.detection_fields
log_event	security_result.detection_fields
manage_ip_addr	intermediary.ip
management_ip_address	intermediary.ip
management_ip_address_2	intermediary.ip
max_amount	security_result.detection_fields
member_with_port	security_result.detection_fields
MessageSid	security_result.detection_fields
MessageStatus	security_result.detection_fields
meta_data.object_type	security_result.detection_fields
METHOD	network.http.method
method	network.http.method
micro_service_hostname	additional.fields
micro_service_matched_wildcard_url	additional.fields
micro_service_name	additional.fields
micro_service_type	additional.fields
microservice	additional.fields
min_amount	security_result.detection_fields
mobile_application_name	security_result.detection_fields
mobile_application_version	security_result.detection_fields
mobile_debugger_enabled_device	security_result.detection_fields
mobile_in_emulation_mode	security_result.detection_fields
mobile_is_app	additional.fields
mock	security_result.detection_fields
model	principal.asset.hardware.model
module	security_result.detection_fields
monitor_details	security_result.detection_fields
monitor_status	security_result.detection_fields
monitor_type_1	security_result.detection_fields
monitor_type_2	security_result.detection_fields
msg	security_result.summary
msgg	security_result.description
msg_type	security_result.detection_fields
Name	principal.user.user_display_name
nativeDeviceId	principal.asset.product_object_id
net.host.ip	principal.ip principal.asset.ip
net.host.name	principal.hostname principal.asset.hostname
net.host.port	principal.port
net.peer.ip	principal.ip principal.asset.ip
net.peer.name	target.hostname target.asset.hostname
net.peer.port	target.port
net.transport	network.ip_protocol
network_http_method	network.http.method
new_request_status	additional.fields
nickname	security_result.detection_fields
nii	security_result.detection_fields
nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
num_of_attempts	additional.fields
num_trans	security_result.detection_fields
oauth_server	security_result.detection_fields
Ocp-Apim-Subscription-Key	security_result.detection_fields
ODJFS-AUTH-TOKEN	security_result.detection_fields
Opcode	security_result.severity
Origin	additional.fields
origin	additional.fields
originId	security_result.detection_fields
os	principal.asset.platform_software.platform
Os-Version	principal.platform_version
os_name	security_result.detection_fields
packageName	security_result.detection_fields
partition	additional.fields
partition_name	intermediary.asset.attribute.labels
path	target.url
pathContext	target.application
paymentMode	security_result.detection_fields
phost	security_result.detection_fields
pideUsuario	security_result.detection_fields
platform	principal.asset.platform_software.platform
POLICY	security_result.rule_name
policy	security_result.rule_name
policy_apply_date	security_result.detection_fields
policy_name	security_result.rule_name
pool	security_result.detection_fields
pool_name	security_result.detection_fields
postalCode	principal.asset.attribute.labels
post_len	security_result.detection_fields
Pragma	additional.fields
pragma	additional.fields
previous_action	additional.fields
previous_initiated_action	security_result.detection_fields
previous_initiated_action_status	security_result.detection_fields
previous_request_date_time	security_result.detection_fields
previous_state	security_result.detection_fields
previous_support_id	security_result.detection_fields
principal_data.hostname	principal.hostname principal.asset.hostname
principal_data.ip	principal.ip principal.asset.ip
principal_ipv6	principal.ip principal.asset.ip
principal_mail	principal.user.email_addresses
Priority	additional.fields
priority	additional.fields
priority_value	additional.fields
process	target.application
process_id	principal.process.pid
processtransaction_accessCode	security_result.detection_fields
processtransaction_companyId	security_result.detection_fields
processtransaction_txnPin	security_result.detection_fields
processtransaction_user	security_result.detection_fields
product_name	security_result.rule_type
prod_id	metadata.product_log_id
properties.branch	target.resource.attribute.labels
properties.build	target.resource.attribute.labels
properties.commit	target.resource.attribute.labels
properties.deployment-environment	target.resource.attribute.labels
properties.issueId	target.resource.attribute.labels
properties.issueMatchesProjectContext	target.resource.attribute.labels
properties.projectId	target.resource.attribute.labels
properties.projectType	target.resource.attribute.labels
properties.pullrequest	target.resource.attribute.labels
properties.review	target.resource.attribute.labels
properties.timeDelta	target.resource.attribute.labels
PROTO	network.application_protocol
protocol	network.application_protocol
ProviderGuid	target.resource.id
Proxy-Authorization	security_result.detection_fields
Proxy-Connection	security_result.detection_fields
proxy_errorcode	security_result.detection_fields
proxy_id	security_result.rule_id
proxy_message	security_result.detection_fields
pushNotificationEnabled	security_result.detection_fields
Qualys-Scan	security_result.detection_fields
QUERY_STR	additional.fields
query	security_result.detection_fields
query_string	additional.fields
query_str	security_result.detection_fields
QUOTEDATA	security_result.detection_fields
rangeDa	security_result.detection_fields
rating	security_result.severity_details
RawDlrDoneDate	security_result.detection_fields
rawrequest	target.url
received_bytes	network.received_bytes
received_state	security_result.detection_fields
Referer	network.http.referral_url
referer	network.http.referral_url
referrer	network.http.referral_url
registerDevice	security_result.detection_fields
related_pid	additional.fields
remote_request_ip	principal.ip principal.asset.ip
reputation	security_result.detection_fields
REQ	additional.fields
REQ_STATUS	security_result.action
req_status	security_result.action security_result.action_details security_result.detection_fields
req_status_value	security_result.action security_result.action_details
request	target.url
request_body_size	additional.fields
Request-Context	security_result.detection_fields
request_date_time	security_result.detection_fields
Request-Id	security_result.detection_fields
request_id	additional.fields
requestClientApplication	network.http.user_agent network.http.parsed_user_agent
requestMethod	network.http.method
request_status	security_result.action security_result.action_details
request_side	security_result.detection_fields
resource_name	target.resource.name
RESP_CODE	network.http.response_code
resp	security_result.detection_fields
resp_code	network.http.response_code
response	security_result.summary
response_code	network.http.response_code
riskIT.deviceSignature.browser.userAgent	network.http.user_agent network.http.parsed_user_agent
riskIT.deviceSignature.camera.autoFocus	principal.asset.attribute.labels
riskIT.deviceSignature.camera.flash	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCamera	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedFormats	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedSizes	principal.asset.attribute.labels
riskIT.deviceSignature.camera.numberOfCameras	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCamera	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedFormats	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedSizes	principal.asset.attribute.labels
riskIT.deviceSignature.collector	principal.asset.attribute.labels
riskIT.deviceSignature.collectorVersion	principal.asset.attribute.labels
riskIT.deviceSignature.extra.account	principal.asset.attribute.labels
riskIT.deviceSignature.extra.securityPolicy	principal.asset.attribute.labels
riskIT.deviceSignature.location.latitude	principal.location.region_coordinates.latitude
riskIT.deviceSignature.location.longitude	principal.location.region_coordinates.longitude
riskIT.deviceSignature.screen.displayId	principal.asset.attribute.labels
riskIT.deviceSignature.screen.height	principal.asset.attribute.labels
riskIT.deviceSignature.screen.orientation	principal.asset.attribute.labels
riskIT.deviceSignature.screen.width	principal.asset.attribute.labels
riskIT.deviceSignature.system.androidId	principal.asset.attribute.labels
riskIT.deviceSignature.system.board	principal.asset.attribute.labels
riskIT.deviceSignature.system.brand	principal.asset.hardware.manufacturer
riskIT.deviceSignature.system.cpuAbi	principal.asset.hardware.cpu_platform
riskIT.deviceSignature.system.debuggerAttached	principal.asset.attribute.labels
riskIT.deviceSignature.system.deviceName	principal.asset.attribute.labels
riskIT.deviceSignature.system.hardware	principal.asset.attribute.labels
riskIT.deviceSignature.system.host	principal.asset.attribute.labels
riskIT.deviceSignature.system.id	principal.asset.attribute.labels
riskIT.deviceSignature.system.jailBroken	principal.asset.attribute.labels
riskIT.deviceSignature.system.locale	principal.asset.attribute.labels
riskIT.deviceSignature.system.model	principal.asset.hardware.model
riskIT.deviceSignature.system.numberOfProcessors	principal.asset.hardware.cpu_number_cores
riskIT.deviceSignature.system.osVersion	principal.platform_version
riskIT.deviceSignature.system.platform	principal.asset.platform_software.platform
riskIT.deviceSignature.system.processName	principal.asset.attribute.labels
riskIT.deviceSignature.system.radio	principal.asset.attribute.labels
riskIT.deviceSignature.system.tags	principal.asset.attribute.labels
riskIT.deviceSignature.system.timeZone	principal.asset.attribute.labels
riskIT.deviceSignature.system.totalDiskSpace	principal.asset.attribute.labels
riskIT.deviceSignature.system.totalMemory	principal.asset.hardware.ram
riskIT.deviceSignature.system.type	principal.asset.attribute.labels
riskIT.deviceSignature.system.user	principal.user.userid
riskIT.deviceSignature.telephony.carrierIsoCountryCode	principal.location.country_or_region
riskIT.deviceSignature.telephony.carrierMobileCountryCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierMobileNetworkCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierName	principal.network.carrier_name
riskIT.deviceSignature.telephony.cellIpAddress	principal.ip principal.asset.ip
riskIT.deviceSignature.telephony.isRoamingNetwork	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.networkType	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.phoneType	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simIsoCountryCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simOperatorName	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simSerialNumber	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.broadcastAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.connected	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.gatewayAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.macAddress	principal.mac principal.asset.mac
riskIT.deviceSignature.wifi.netmaskAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.userEnabled	principal.asset.attribute.labels
riskIT.ipAddress	principal.ip principal.asset.ip
rrn	security_result.detection_fields
RS_VISITOR_ID	security_result.detection_fields
rt	metadata.event_timestamp
rule_name	security_result.rule_name
rule_summary	security_result.summary
rule_version	metadata.product_version
save_payee	security_result.detection_fields
schedule_frequency	security_result.detection_fields
schedule_occurrence	security_result.detection_fields
scope_details	additional.fields
sec-ch-ua	security_result.detection_fields
sec-ch-ua-mobile	additional.fields
sec-ch-ua-platform	principal.asset.platform_software.platform
sec-fetch-dest	additional.fields
Sec-Fetch-Dest	additional.fields
sec-fetch-mode	additional.fields
Sec-Fetch-Mode	additional.fields
sec-fetch-site	additional.fields
Sec-Fetch-Site	additional.fields
Sec-Fetch-Storage-Access	security_result.detection_fields
sec-fetch-user	additional.fields
Sec-Fetch-User	additional.fields
Sec-Fetch-User	additional.fields
sequence_id	additional.fields
server_ip	target.ip
server_port	target.port
service_id	target.resource.product_object_id
SESS_ID	network.session_id
session_id	network.session_id
session_status	security_result.detection_fields
sessionDataId	security_result.detection_fields
sessionDataKey	security_result.detection_fields
Set-Cookie	security_result.detection_fields
set_cookie	security_result.detection_fields
severity	security_result.severity
severity_number	security_result.severity
sg_event_id	security_result.detection_fields
sg_message_id	security_result.detection_fields
sg_template_id	security_result.detection_fields
sg_template_name	security_result.detection_fields
Shield	security_result.detection_fields
signature	security_result.detection_fields
SIG_IDS	security_result.rule_id
sig_cves	security_result.detection_fields
sig_ids	security_result.detection_fields
SIG_NAMES	security_result.rule_name Kondisi: [policy_name] == ""
SmsSid	security_result.detection_fields
SmsStatus	security_result.detection_fields
snat_ip	principal.nat_ip
snat_port	principal.nat_port
SOAPAction	additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/user	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnData	additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/user	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/user	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/companyId	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/user	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/companyId	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/user	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/companyId	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/user	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/companyId	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/user	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/companyId	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/user	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/companyId	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/user	security_result.detection_fields
sort_order	security_result.detection_fields
SourceModuleName	target.resource.name
SourceModuleType	observer.application
source_host	principal.hostname principal.asset.hostname
source_ip	principal.ip principal.asset.ip
spt	principal.port
src	principal.nat_ip Kondisi: [src] != [cs5]
SRC_PORT	principal.port
src_port	principal.port
srcport	principal.port
SSL_Client_Cert	security_result.detection_fields
ssl_error_code	security_result.detection_fields
ssl_routine	security_result.detection_fields
staged_sig_cves	security_result.detection_fields
staged_sig_ids	security_result.detection_fields
staged_sig_names	security_result.detection_fields
stagedThreatCampaignNames	additional.fields
staged_threat_campaign_names	security_result.detection_fields
start	additional.fields
start_date	security_result.detection_fields
state	principal.location.state
status	security_result.summary
SUB_VIOLATIONS	additional.fields
sub_process	additional.fields
sub_violates	security_result.summary
sub_violations	security_result.detection_fields
suid	principal.user.userid
summary	security_result.summary
SUPPORT_ID	additional.fields
suser	principal.user.user_display_name
tap_event_id	security_result.detection_fields
tap_vid	security_result.detection_fields
target_data.application	target.application
target_data.ip	target.ip target.asset.ip
target_url	target.url
taxCode	security_result.detection_fields
terminalId	security_result.detection_fields
threat_campaign_names	security_result.detection_fields
thread_id	security_result.detection_fields
tls	network.tls.version
tls_version	network.tls.version
tmm_unit	security_result.detection_fields
To	target.user.phone_numbers
token	security_result.detection_fields
t_port	target.port
traceNo	security_result.detection_fields
traceparent	security_result.detection_fields
Transfer-Encoding	security_result.detection_fields
transfer_type	security_result.detection_fields
transType	security_result.detection_fields
True-Client-IP	principal.ip principal.asset.i
true-client-ip	principal.ip principal.asset.ip
tty	additional.fields
TYPE	security_result.category security_result.category_details
type	metadata.product_event_type
uniqueId	security_result.detection_fields
Upgrade-Insecure-Requests	security_result.detection_fields
URI	target.url
url	principal.url
user	principal.user.userid
USER_AGENT	network.http.user_agent network.http.parsed_user_agent
User-Agent	network.http.user_agent network.http.parsed_user_agent
user_display_name	principal.user.user_display_name
UserID	principal.user.userid
user_id	principal.user.userid
user_name	principal.user.userid
userName	principal.user.email_addresses
user_remarks	security_result.detection_fields
user_type	principal.asset.attribute.labels
usuarioBE	security_result.detection_fields
uuid	security_result.detection_fields
validateaccountnumber_accessCode	security_result.detection_fields
validateaccountnumber_companyId	security_result.detection_fields
validateaccountnumber_txnPin	security_result.detection_fields
validateaccountnumber_user	security_result.detection_fields
vAT	security_result.detection_fields
verb	network.http.method
versionCode	security_result.detection_fields
versionName	security_result.detection_fields
VFPJSESSION	security_result.detection_fields
Via	security_result.detection_fields
VIP	security_result.detection_fields
VIRTUAL	network.tls.client.server_name
VIRTUAL_address	target.resource.name
virtual_server_name	network.tls.client.server_name
virtualserver	network.tls.client.server_name
violation_mask_alarm	security_result.detection_fields
violation_mask_block	security_result.detection_fields
violation_mask_learn	security_result.detection_fields
violation_mask_staging	security_result.detection_fields
violation_rating	security_result.detection_fields
violations	security_result.description
virus_name	security_result.threat_name
vs_ip	intermediary.ip
vs_name	target.resource.name
vs_port	intermediary.port
web_application_name	target.application
websocket_direction	network.direction = Inbound Kondisi: (jika [websocket_direction] == "clientToServer") network.direction = OUTBOUND Kondisi: (jika [websocket_direction] == "ServerToclient")
websocket_message_type	security_result.detection_fields
wm_client_ip	principal.ip principal.asset.ip
WORKIDENTIFIER	security_result.detection_fields
wtfpc	security_result.detection_fields
X-Amzn-Trace-Id	security_result.detection_fields
X-Bug-Bounty	security_result.detection_fields
X-Bug-Bounty-Contact	security_result.detection_fields
X-Bug-Bounty-Purpose	security_result.detection_fields
X-Client-Ip	principal.ip principal.asset.ip
x-codsecent	security_result.detection_fields
X-Cnection	security_result.detection_fields
X-Correlation-ID	security_result.detection_fields
x-correlation-id	security_result.detection_fields
x-country-code	principal.location.country_or_region
x-dtpc	security_result.detection_fields
X-Environment	security_result.detection_fields
X-EVENT-TYPE	metadata.product_event_type
X-F5-VIP	target.ip target.asset.ip
XFF	principal.ip
X-FORWARDED-PORT	target.port
X-FORWARDED-PROTO	network.application_protocol
X-Forwarded-For	principal.ip principal.asset.ip
X-Forwarded-Proto	network.application_protocol
x-forwarded-client-cert	security_result.detection_fields
x-fwd-hdr-val	security_result.detection_fields
X-header-postpay-addons-uri	security_result.detection_fields
X-Home-Region	security_result.detection_fields
x-iapp-real-ip	principal.ip principal.asset.ip
X-ma-bid	security_result.detection_fields
X-ma-did	security_result.detection_fields
X-ma-hostname	security_result.detection_fields
X-ma-pid	security_result.detection_fields
X-ma-sid	security_result.detection_fields
X-MicrosoftAjax	security_result.detection_fields
x-msisdnToken	security_result.detection_fields
X-msisdnToken	security_result.detection_fields
X-OAUTH-IDENTITY-DOMAIN-NAME	security_result.detection_fields
X-ORIGINAL-HOST	principal.hostname
X-Original-URL	principal.url
X-OWA-ActionId	additional.fields
X-OWA-ActionName	additional.fields
X-OWA-Attempt	additional.fields
X-OWA-CANARY	additional.fields
X-OWA-ClientBuildVersion	security_result.detection_fields
X-OWA-CorrelationId	metadata.product_log_id
X-OWA-ExplicitLogonUser	principal.user.email_addresses
X-OWA-UrlPostData	security_result.detection_fields
X-Requested-With	additional.fields
x-request-application	metadata.product_event_type
X-ROBOT-AGENT	security_result.detection_fields
X-ROBOT-LICENSE	security_result.detection_fields
X-ROBOT-MACHINE-ENCODED	security_result.detection_fields
X-ROBOT-SERVICE-USERNAME-ENCODED	security_result.detection_fields
X-ROBOT-VERSION	security_result.detection_fields
X-Remote-Addr	principal.ip principal.asset.ip
x-session	security_result.detection_fields
X-Twilio-Email-Event-Webhook-Signature	security_result.detection_fields
X-Twilio-Email-Event-Webhook-Timestamp	security_result.detection_fields
X-Twilio-Signature	security_result.detection_fields
X-UIPATH-INSTALLATION-ID	security_result.detection_fields
X-UIPATH-INSTALLATION-VERSION	security_result.detection_fields
X-UIPATH-Localization	security_result.detection_fields
X-wa-sid	security_result.detection_fields
xWpammRequestId	security_result.detection_fields
X-XSRF-TOKEN	additional.fields
X-xforwarded-client-cert	security_result.detection_fields

Log CSV

Kolom Input	Kolom Tujuan	Kondisi
IF [column4] != "asm-policy"
JIKA column5 bukan IP yang valid
column1	target_ip
column2	target_port
column3	geo_location	[column3] tidak ada di ["N/A", ""]
column3	target_ip	[column3] != "" AND [column3] =~ "^[0-9.]"
column5	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6	VIOLATION_DETAILS	[column6] =~ ".*xml"
column7	intermediary_Ip	[column7] != "" AND GROK %{IP:column7} berhasil
column8	network_http_method	[column8] di ["GET","POST","PUT","DELETE","PATCH","HEAD","OPTIONS"]
column7	network_http_method	ELSE IF [column7] di ["GET","POST", ...]
column9	event.idm.read_only_udm.additional.fields	[column9] tidak dalam ["", "N/A"] DAN BUKAN TimeStamp
column9	policy_apply_date	[column9] not in ["", "N/A"] AND IS TimeStamp
column10	security_result.rule_name	![column10_is_ip] AND [column10] == [column3] AND [column10] != ""
column11	app_protocol	[column11] != ""
column13	Bervariasi (KV)	[column13] != ""
column14	req_status_value	[column14] di ["blocked", "allowed", "alerted", "passed"]
column18	request_id	[column18] != ""
column19	severity_level	[column19] =~ "(?i)(Informational
column22	principal_port	[column22] tidak ada dalam ["", "N/A"] DAN [column22] adalah numerik
column23	event.idm.read_only_udm.metadata.product_log_id	[column23] tidak ada di ["", "N/A"]
column25	syslog_host	[syslog_host] == "" AND [column25] != ""
column26	event.idm.read_only_udm.network.http.referral_url	[column26] tidak ada di ["", "N/A"]
column27	VIOLATION_DETAILS	[column27] =~ ".*xml"
column28	VIOLATION_DETAILS	[column27] !~ ".xml" AND [column28] =~ ".xml"
column28	security_result.description	[column27] !~ ".xml" AND [column28] !~ ".xml" AND [column28] not in ["", "N/A"] AND [column28] is NOT numeric
column15	response	IF [column27] !~ ".*xml": [column15] != ""
column16	network_http_response_code	IF [column27] !~ ".*xml": [column16] not in ["","-"]
column24	session_id	IF [column27] !~ ".*xml": [column24] != ""
column29	security_result.summary	IF [column27] !~ ".*xml": [column29] != ""
column24	resource_name	IF [column27] =~ ".*xml": [column24] != ""
column31	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
Jika kolom5 adalah IP yang valid
column1	target_ip
column2	target_port
column3	geo_location	[column3] BUKAN IP yang valid
column3	target_ip	[column3] != "" AND [column3] adalah IP yang valid
column6	principal_ip	[column6] != "" AND GROK %{IP:column6} succeeds
column7	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column7	VIOLATION_DETAILS	[column7] =~ ".*xml"
column8	intermediary_Ip	[column8] tidak ada di ["", "N/A"] DAN GROK %{IP:column8} berhasil
column9	network_http_method	[column9] di ["GET","POST", ...]
column8	network_http_method	ELSE IF [column8] in ["GET","POST", ...]
column9	collected_time	[column9] =~ "^[0-9]+"
column22	request_body_size	[column22] =~ "^[0-9]+$"
column10	event.idm.read_only_udm.additional.fields	[column10] tidak dalam ["", "N/A"] DAN BUKAN TimeStamp
column10	policy_apply_date	[column10] tidak ada di ["", "N/A"] DAN IS TimeStamp
column11	security_result.rule_name	[column11_is_ip] AND [column11] == [column4] AND [column11] != ""
column4	policy_name	ELSE IF [column11] != [column4] AND [column4] != "" AND [column4] is NOT numeric
column4	target_port	ELSE IF [column4] is numeric
column12	app_protocol
column13	Bervariasi (KV)	[column13] != ""
column15	req_status_value	[column15] di ["blocked", "allowed", "alerted", "passed"]
column19	request_id
column20	severity_level	[column20] =~ "(?i)(Informasional
column23	principal_port	[column23] tidak ada di ["", "N/A"] DAN [column23] adalah angka
column26	syslog_host	[syslog_host] == "" AND [column26] != ""
column27	event.idm.read_only_udm.network.http.referral_url	[column27] tidak ada di ["", "N/A"]
column28	VIOLATION_DETAILS	[column28] =~ ".*xml"
column29	VIOLATION_DETAILS	[column28] !~ ".xml" AND [column29] =~ ".xml"
column29	security_result.description	[column28] !~ ".xml" AND [column29] !~ ".xml" AND [column29] not in ["", "N/A"] AND [column29] is NOT numeric
column16	response	IF [column28] !~ ".*xml": [column16] != ""
column17	network_http_response_code	IF [column28] !~ ".*xml": [column17] tidak ada di ["","-"]
column25	session_id	IF [column28] !~ ".*xml": [column25] != ""
column30	security_result.summary	IF [column28] !~ ".*xml": [column30] != ""
column25	principal_ip	IF [column28] =~ ".*xml": [column25] != "" AND ![column25_is_ip]
column16	network_http_response_code	IF [column28] =~ ".*xml": [column25] != "" AND [column16] != ""
column19	severity_level	IF [column28] =~ ".*xml": [column25] != "" AND [column19] =~ "(?i)(Informational...)"
column24	session_id	IF [column28] =~ ".*xml": [column25] != "" AND [column24] not in ["", "N/A"]
column25	resource_name	IF [column28] =~ ".*xml" AND [column25] == "": [column25] != ""
column24	event.idm.read_only_udm.metadata.product_log_id	IF [column28] =~ ".*xml" AND [column25] == "": [column24] tidak ada di ["", "N/A"]
column32	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column33	request
column34	response
IF [column4] == "asm-policy"
column1	principal_ip	[column1] != "" AND [column1] =~ "^[0-9.]"
column2	principal_port	[column2] tidak ada di ["","N/A","none"]
column3	principal_ip	[column3] != "" AND [column3] =~ "^[0-9.]"
column4	event.idm.read_only_udm.metadata.product_event_type	[column4] != ""
column6	principal_ip	[column6] != "" AND [column6] adalah IP yang valid
column6	req_status_value	ELSE IF [column6] di ["blocked", "allowed", ...]
column6	support_id	ELSE [column6] != ""
column7	severity_level	[column7] =~ "(?i)(Informational...)"
column8	geo_location	[column8] tidak ada di ["N/A", ""]
column9	VIOLATION_DETAILS	[column9] =~ ".*xml"
column9	event.idm.read_only_udm.target.application	ELSE IF [column9] != ""
column11	intermediary_Ip	GROK %{IP:column11} berhasil
column16	target_ip	%{IP:column16} GROK berhasil
column18	network_http_method	[column18] tidak ada di ["","N/A","none"]
column24	policy_apply_date
column26	app_protocol
column29	target_url	[column29] != "" AND Grok match
column29	Bervariasi (KV)	[column29] != "" AND Grok match
column30	req_status_value	[column30] di ["blocked", "allowed", ...]
column31	security_result.summary
column32	network_http_response_code	[column32] != ""
column35	severity
column55	VIOLATION_DETAILS	[column55] =~ ".*xml"
column58	VIOLATION_DETAILS	[column58] =~ ".*xml"
column60	security_result.description	[column60] tidak ada di ["","N/A","none"]
column62	event.idm.read_only_udm.target.resource.name
IF ![utf_error] (Seluruh blok berada dalam kondisi ini. Jika [utf_error] bernilai benar, pesan akan dihapus) IF ![utf_error]
column2	principalIp	(di dalam ![utf_error])
column1	column1	(di dalam ![utf_error])
"IF [no_ip_address] (Grok on column2 failed)"
column1	date_time
column2	attackType
column3	principalIp
column11	method
column12	url
column13	app_protocol
column10	targetIp
column9	intermediaryIp
column19	rating
column15	req_status
column5	geo_location
column27	VIOLATION_DETAILS	jika [column27] mirip dengan data xml
column25	VIOLATION_DETAILS	jika [column27] tidak mirip dengan data xml
"ELSE (of [no_ip_address]) (Grok on column2 succeeded)"
column1	date_time
attack_type	attackType
column10	method
column11	url
column12	app_protocol
column9	targetIp
column8	intermediaryIp
column18	rating
column14	req_status
column5	geo_location	![no_ip_address] DAN [column5] tidak ada di ["N/A", ""]
column17	severity	![no_ip_address] DAN [column17] tidak ada di ["N/A", ""]
column20	request_id	![no_ip_address] DAN [column20] tidak ada di ["N/A", ""]
column26	x_forwarded_for	![no_ip_address] DAN [column26] tidak ada di ["N/A", ""]
column4	dest_port	[column3] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
column3	dest_port	ELSE (pemeriksaan IP [column3])
column15	resp_code	T/A
column16	resp_code	IF [column15_not_resp_code]
column17	resp_code	IF [column15_not_resp_code] AND [column16_not_resp_code]
attackType	attack_type	[attackType] tidak ada di ["N/A", ""]
intermediaryIp	intermediary_Ip	[intermediaryIp] != ""
principalIp	principal_ip	[principalIp] != ""
targetIp	target_ip	[targetIp] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
resp_code	network_http_response_code	[resp_code] != ""
dest_port	target_port	[dest_port] != ""
url	target_url	[url] != ""
intermediary_Ip	intermediary.ip	[intermediary_Ip] != ""
ELSE (dari ![utf_error])
Menghapus pesan dengan TAG_UNSUPPORTED

Delta rilis

Google SecOps merilis versi baru parser F5 ASM, yang mencakup perubahan signifikan pada pemetaan kolom log Parser_Name ke kolom UDM dan perubahan pada pemetaan jenis peristiwa.

Delta pemetaan kolom log

Kolom Log	Pemetaan yang Ada	Baru
Accept	"security_result.about.resource.attribute.label\nsecurity_result.about.labels"	additional.fields
Accept-Charset	security_result.about.resource.attribute.labels	additional.fields
Accept-Encoding	"security_result.about.resource.attribute.labels\nsecurity_result.about.labels"	additional.fields
Accept-Language	security_result.detection_fields	additional.fields
Accept-Language	"security_result.detection_fields\nsecurity_result.aboit.labels"	additional.fields
AccountType	target.user.role_description	target.user.attribute.roles.description
act	security_result.action == ALLOW	security_result.action == QUARATINE
action1	security_result.detection_fields	security_result.action_details
actual_mitigation_action	security_result.detection_fields	menghapus nilai "Tidak Ada"
actual_mitigation_action_reason	security_result.detection_fields	menghapus nilai "None"
attack_type	intermediary.hostname and security_result.category_details	security_result.category_details
Cache-Control	security_result.about.resource.attribute.labels	additional.fields
Cache-Control	security_result.detection_fields	additional.fields
cn2 (rating)	security_result.severity	security_result.detection_fields
Connection	"security_result.about.resource.attribute.labels\nsecurity_result.about.labels"	additional.fields
Connection	security_result.detection_fields	additional.fields
Content-Length	security_result.about.labels	additional.fields
Content-Type	security_result.about.labels	additional.fields
date_time	metadata.event_timestamp	Menghapus pemetaan yang redundan
descrip	metadata.descrption	Menghapus pemetaan yang redundan
device_id	target.asset.id	principal.asset.id
device_product	security_result.detection_fields	additional.fields
dvchost	intermediary.ip and intermedairy.asset.ip	intermediary.ip
event_id (memahami nilai yang diekstrak)	additional.fields	principal.process.pid
Keep-Alive	security_result.about.resource.attribute.labels	additional.fields
net.host.port	principal.port and additional.fields	additional.fields
net.peer.name	"target.hostname, target.asset.hostname\nadditional.fields"	target.hostname
net.peer.port	target.port and additional.fields	additional.fields
policy_name	about.resource.name	security_result.rule_name
policy_name	security_result.about.resource.name	security_result.rule_name
Pragma	security_result.about.resource.attribute.labels	additional.fields
Pragma	security_result.detection_fields	additional.fields
rating	security_result.severity	Menghapus pemetaan yang redundan
Reason	security_resultsummary and securtiy_result.detetction_fields	security_result.detection_fields
resp_code	security_result.severity	Menghapus pemetaan yang redundan
response_code	additional.fields and network.http.response_code	network.http.response_code
sig_names	security_result.rule_name	security_result.detection_fields
sub_violations	security_result.about.resource.attribute.labels	security_result.detection_fields
support_id	additional.fields and metadata.product_log_id	metadata.product_log_id
SYSLOG headers	principal.ip	intermediary.ip
uri	principal.url and target.url	traget.url
violation_rating	security_result.about.resource.attribute.labels	security_result.detection_fields
X-Forwarded-For	security_result.about.resource.attribute.labels	principal.ip
XFF	intermediary.ip	principal.ip
x_forwarded_for_header_value	additional.fields	principal.ip

Perubahan lainnya

• Menghapus Pemetaan Nilai "Tidak Ada":

  • Nilai "T/A" tidak lagi dipetakan untuk principal.location.country_or_region.
  • Nilai "T/A" tidak lagi dipetakan untuk principal.user.userid.

• Pemetaan Protokol/Arah Langsung yang Dihapus:

  • Pemetaan langsung pesan yang berisi "UDP" ke network.ip_protocol telah dihapus.
  • Pemetaan langsung pesan yang berisi "HTTPS" ke network.application_protocol telah dihapus.
  • Setelan statis network.direction ke INBOUND telah dihapus.
  • Pemetaan langsung pesan yang berisi "HTTPS/1.1" ke network.network.tls.version telah dihapus.

• Pemetaan URL yang Diperbarui:

  • Sebelumnya, req_host dan req_uri digabungkan untuk dipetakan ke target.url. Hal ini telah diperbarui untuk memetakan hanya req_uri ke target.url.

• Setelan Tindakan yang Diubah:

  • Tindakan menyetel security_result.action ke ALLOW saat "num_of_attempts" tidak null telah dihapus.

• Pemetaan IP Statis yang Dihapus:

  • Pemetaan statis dvc_ip ke 0.0.0.0 telah dihapus.
  • Pemetaan statis target_ip ke 0.0.0.0 telah dihapus.

• Pemetaan externalid yang Direvisi:

  • Pemetaan untuk externalid kini mengisi additional.fields, dengan nama kunci diubah dari Support_id menjadi externalid.

• Pemetaan Tingkat Keparahan yang Diperbarui:

  • Nilai [severity_level] numerik (misalnya, "1", "2", "3") kini dipetakan ulang ke "RENDAH". Hal ini menstandardisasi kode tingkat keparahan numerik ke skala yang konsisten.
  • Log "peringatan" kini digabungkan dan dipetakan ke "SEDANG", sehingga menyederhanakan kategorisasi tingkat keparahan.
  • Urutan pemeriksaan tingkat keparahan telah disesuaikan untuk memprioritaskan dari yang paling parah hingga yang paling tidak parah: ERROR, CRITICAL, HIGH, MEDIUM, LOW, dan terakhir INFORMATIONAL.

• Menghapus Nilai Tidak Valid:

  • Nilai yang berisi tanda petik ganda literal (\") telah dihapus dari principal.url.
  • Nilai yang tidak valid (yang dimulai dengan * atau $) telah dihapus dari network.http.parsed_user_agent.

Log Perubahan

Melihat Log Perubahan untuk parser ini

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.