F5 ASM 로그 수집

파서 버전: 33.0

다음에서 지원:

Google secops SIEM

이 문서에서는 Bindplane 에이전트를 사용하여 F5 Application Security Manager (ASM) 로그를 Google Security Operations로 수집하는 방법을 설명합니다.

F5 BIG-IP ASM은 HTTP 요청 위반, 정책 시행 작업, 보안 이벤트에 대한 syslog 메시지를 생성하는 웹 애플리케이션 방화벽 (WAF)입니다. 파서는 여러 로그 형식 (CEF, syslog, CSV, Splunk, JSON)을 지원하고 이를 통합 데이터 모델 (UDM)에 매핑합니다.

시작하기 전에

다음 기본 요건이 충족되었는지 확인합니다.

• Google SecOps 인스턴스
• Windows Server 2016 이상 또는 systemd가 설치된 Linux 호스트
• Bindplane 에이전트와 F5 BIG-IP 어플라이언스 간의 네트워크 연결
• 프록시 뒤에서 실행하는 경우 Bindplane 에이전트 요구사항에 따라 방화벽 포트가 열려 있는지 확인합니다.
• F5 BIG-IP tmsh에 대한 권한 액세스

Google SecOps 수집 인증 파일 가져오기

1. Google SecOps 콘솔에 로그인합니다.
2. SIEM 설정 > 수집 에이전트로 이동합니다.
3. 데이터 수집 인증 파일을 다운로드합니다.

4. Bindplane 에이전트가 설치될 시스템에 파일을 안전하게 저장합니다.

   참고: 이 JSON 파일에는 Bindplane 에이전트를 Google SecOps에 인증하기 위한 사용자 인증 정보가 포함되어 있습니다.

Google SecOps 고객 ID 가져오기

1. Google SecOps 콘솔에 로그인합니다.
2. SIEM 설정 > 프로필로 이동합니다.

3. 조직 세부정보 섹션에서 고객 ID를 복사하여 저장합니다.

   참고: Bindplane 에이전트 내보내기를 구성하려면 고객 ID가 필요합니다.

Bindplane 에이전트 설치

다음 안내에 따라 Windows 또는 Linux 운영체제에 Bindplane 에이전트를 설치합니다.

Windows 설치

1. 명령 프롬프트 또는 PowerShell을 관리자로 엽니다.

2. 다음 명령어를 실행합니다.

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. 설치가 완료될 때까지 기다립니다.

4. 다음을 실행하여 설치를 확인합니다.

   sc query observiq-otel-collector
   

   서비스가 실행 중으로 표시되어야 합니다.

Linux 설치

1. 루트 또는 sudo 권한으로 터미널을 엽니다.

2. 다음 명령어를 실행합니다.

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

3. 설치가 완료될 때까지 기다립니다.

4. 다음을 실행하여 설치를 확인합니다.

   sudo systemctl status observiq-otel-collector
   

   서비스가 active (running)으로 표시되어야 합니다.

추가 설치 리소스

추가 설치 옵션 및 문제 해결은 Bindplane 에이전트 설치 가이드를 참고하세요.

syslog를 수집하여 Google SecOps로 전송하도록 Bindplane 에이전트 구성

구성 파일 찾기

• Linux:

  sudo nano /etc/bindplane-agent/config.yaml
  

• Windows:

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

구성 파일 설정

• config.yaml의 전체 콘텐츠를 다음 구성으로 바꿉니다.

  receivers:
      udplog:
          listen_address: "0.0.0.0:514"
  
  exporters:
      chronicle/f5_asm:
          compression: gzip
          creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
          customer_id: '<customer_id>'
          endpoint: malachiteingestion-pa.googleapis.com
          log_type: F5_ASM
          raw_log_field: body
  
  service:
      pipelines:
          logs/f5_asm_to_chronicle:
              receivers:
                  - udplog
              exporters:
                  - chronicle/f5_asm
  

구성 매개변수

다음 자리표시자를 바꿉니다.

• 수신기 구성:

  • listen_address: 리슨할 IP 주소 및 포트입니다.
    • 모든 인터페이스에서 수신 대기하도록 0.0.0.0 (권장)
    • 포트 514는 표준 syslog 포트입니다 (Linux에서 루트 필요, 비루트의 경우 1514 사용).

• 내보내기 도구 구성:

  • creds_file_path: 수집 인증 파일의 전체 경로입니다.
    • Linux: /etc/bindplane-agent/ingestion-auth.json
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • customer_id: Google SecOps 콘솔에서 복사한 고객 ID
  • endpoint: 지역 엔드포인트 URL:
    • 미국: malachiteingestion-pa.googleapis.com
    • 유럽: europe-malachiteingestion-pa.googleapis.com
    • 아시아: asia-southeast1-malachiteingestion-pa.googleapis.com
    • 전체 목록은 리전 엔드포인트를 참고하세요.

구성 파일 저장

• 수정 후 파일을 저장합니다.
  • Linux: Ctrl+O, Enter, Ctrl+X 순서로 누릅니다.
  • Windows: 파일 > 저장을 클릭합니다.

Bindplane 에이전트를 다시 시작하여 변경사항 적용

• Linux에서 Bindplane 에이전트를 다시 시작하려면 다음 명령어를 실행합니다.

  sudo systemctl restart observiq-otel-collector
  

  1. 서비스가 실행 중인지 확인합니다.

     sudo systemctl status observiq-otel-collector
     

  2. 로그에서 오류를 확인합니다.

     sudo journalctl -u observiq-otel-collector -f
     

• Windows에서 Bindplane 에이전트를 다시 시작하려면 다음 옵션 중 하나를 선택하세요.

  • 명령 프롬프트 또는 PowerShell(관리자 권한)

    net stop observiq-otel-collector && net start observiq-otel-collector
    

  • 서비스 콘솔:

    1. Win+R 키를 누르고 services.msc를 입력한 다음 Enter 키를 누릅니다.
    2. observIQ OpenTelemetry Collector를 찾습니다.
    3. 마우스 오른쪽 버튼을 클릭하고 다시 시작을 선택합니다.

    4. 서비스가 실행 중인지 확인합니다.

       sc query observiq-otel-collector
       

    5. 로그에서 오류를 확인합니다.

       type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
       

F5 ASM에서 syslog 구성

1. 다음 명령어를 입력하여 tmsh 인스턴스에 로그인합니다.

   tmsh
   

2. 다음 명령어를 사용하여 syslog 구성을 수정합니다.

   edit /sys syslog all-properties
   

3. Syslog 구성이 vi 텍스트 편집기에서 열리고 다음 예와 비슷하게 표시됩니다.

   modify syslog {
       auth-priv-from notice
       auth-priv-to emerg
       cron-from warning
       cron-to emerg
       daemon-from notice
       daemon-to emerg
       description none
       include none
       iso-date disabled
       kern-from notice
       kern-to emerg
       mail-from notice
       mail-to emerg
       messages-from notice
       messages-to warning
       remote-servers none
       user-log-from notice
       user-log-to emerg
   }
   

4. include none 줄을 다음 syslog 필터로 바꿉니다.

   include `
       filter f_audit{
           match(AUDIT);
       };
       destination d_syslog_server {
           udp(\`<bindplane-ip>\` port (<bindplane-port>));
       };
       log {
           source(s_syslog_pipe);
           filter(f_audit);
           destination(d_syslog_server);
       };
   `
   

5. <bindplane-ip> 및 <bindplane-port>를 Bindplane 에이전트에 구성된 실제 IP 주소와 포트 번호로 바꿉니다.

6. 다음 키 시퀀스를 입력하여 vi를 종료합니다.

   :wq!
   

7. 다음 프롬프트에서 y를 입력하여 파일에 변경사항을 저장합니다.

   Save changes? (y/n/e)
   

8. 다음 명령어를 입력하여 구성을 저장합니다.

   save /sys config
   

UDM 매핑 테이블

필드 이름	UDM
/BAD_MSG/request-violations/violation[n]/actual_value_length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_pattern	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/blocking_mask	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/buffer	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/offset	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/expected_value_length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/extension	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/flg_disallowed_file_type	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sanity_checks_status	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation_status	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_code	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_violation_details	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/enforcement_level	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/post_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/query_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/blocking_mask	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/buffer	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/offset	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/sig_id	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/specific_desc	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/value_length_type	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/wildcard_entity	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/cfg_target	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/leakage_type	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/pattern_type	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/response_code	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_index	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_name	security_result.detection_fields
/BAD_MSG/violation_masks/alarm	security_result.detection_fields
/BAD_MSG/violation_masks/block	security_result.detection_fields
/BAD_MSG/violation_masks/learn	security_result.detection_fields
/BAD_MSG/violation_masks/staging	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/accessCode	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/companyId	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/txnPin	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/user	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/accessCode	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/companyId	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/txnPin	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/user	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/accessCode	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/companyId	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/txnPin	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/user	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/user	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/user	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/user	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/user	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/user	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/user	security_result.detection_fields
_csrfToken	security_result.detection_fields
Accept	additional.fields
accept	additional.fields
Accept-Charset	additional.fields
Accept-Encoding	additional.fields
accept-encoding	additional.fields
acceptEncoding	security_result.detection_fields
Accept-Language	additional.fields
accept-language	additional.fields
acceptLanguage	security_result.detection_fields
Access-Control-Request-Headers	security_result.detection_fields
Access-Control-Request-Method	network.http.method
AccountSid	target.resource.product_object_id
AccountType	target.user.attribute.roles.description
act	security_result.action security_result.action_details
act1	security_result.action
Action	additional.fields
action	security_result.action security_result.action_details
action_summary	security_result.detection_fields
additional_bot_signatures	security_result.detection_fields
actual_mitigation_action	security_result.detection_fields
actual_mitigation_action_reason	security_result.detection_fields
alert_level	security_result.severity
anomalies	additional.fields
anomaly_categories	additional.fields
apache_module	security_result.detection_fields
ApiVersion	security_result.detection_fields
App-Name	target.application
Application	target.application
Application-Type	security_result.detection_fields
application_display_name	additional.fields
application_version	security_result.detection_fields
appID	security_result.detection_fields
app_protocol	network.application_protocol
app-version	security_result.detection_fields
attack_type	metadata.description
attacktype	security_result.category_details
audit_component	additional.fields
auth	principal.user.userid
authCode	security_result.detection_fields
auth_level	principal.user.attribute.roles.name
auth_status	security_result.action security_result.summary
batchKey	security_result.detection_fields
batchNo	security_result.detection_fields
BEAuthenticator	security_result.detection_fields
bigip_mgmt_ip	intermediary.ip
bigip_mgmt_ip2	intermediary.ip
bill.isRecurring	security_result.detection_fields
bill.productId	security_result.detection_fields
blocking_exception_reason	security_result.detection_fields
bot_name	additional.fields
bot_signature	additional.fields
bot_signature_category	additional.fields
browser_actual_verification_action	additional.fields
browser_configured_verification_action	additional.fields
browser_verification_status	security_result.detection_fields
bundle-version	additional.fields
bytes_in	network.received_bytes
bytes_out	network.sent_bytes
c6a1	intermediary.ip 조건: [c6a1Label] == "device_address"
c6a2	principal.ip principal.asset.ip 조건: [c6a2Label] == "source_address"
c6a3	target.ip target.asset.ip 조건: [c6a3Label] == "destination_address"
c6a4	security_result.about.ip security_result.about.asset.ip 조건: [c6a4Label] == "ip_address_intelligence"
Cache-Control	additional.fields
captcha_result	security_result.detection_fields
captcha_status	security_result.detection_fields
category	security_result.category_details
cdn-loop	security_result.detection_fields
CF-Connecting-IP	principal.ip principal.asset.ip
cf-cert-presented	principal.asset.attribute.labels
cf-cert-revoked	principal.asset.attribute.labels
cf-cert-verified	principal.asset.attribute.labels
cf-ipcity	principal.location.city
CF-IPCountry	principal.location.country_or_region
cf-ipcountry	principal.location.country_or_region
cf-ipcontinent	principal.asset.attribute.labels
cf-iplatitude	principal.location.region_coordinates.latitude
cf-iplongitude	principal.location.region_coordinates.longitude
cf-ipmetro-code	principal.asset.attribute.labels
cf-ipostal-code	principal.asset.attribute.labels
cf-iregion	principal.location.state
cf-iregion-code	principal.asset.attribute.labels
cf-itimezone	principal.asset.attribute.labels
cf-ray	principal.asset.attribute.labels
CF-Visitor	security_result.detection_fields
CF-Visitor.scheme	principal.asset.attribute.labels
challenge_failure_reason	additional.fields
Channel	security_result.detection_fields
channel	security_result.detection_fields
Check-Id	additional.fields
childTableRef	security_result.detection_fields
CIPHER	network.tls.cipher
city	principal.location.city
class	additional.fields
classification_reason	security_result.detection_fields
clearGadgetId	security_result.detection_fields
client-request-id	additional.fields
client_id	security_result.detection_fields
client_ip	principal.ip
client_ip_geo_location	principal.location.country_or_region
client_port	principal.port
client_request_uri	target.url
client_type	additional.fields
Client-Version	security_result.detection_fields
cmd_data	principal.process.command_line
cn2 and cn2label	security_result.detection_fields
cn3	principal.asset_id 조건: [cn3Label] == "device_id" 그 외: security_result.detection_fields
cn4 and cn4label	additional.fields 조건: [cs4label] == "whitelistData"
cn5 and cn5label	additional.fields
collected_time	metadata.collected_timestamp
component	additional.fields
COMPRESSION	security_result.detection_fields
configured_mitigation_action	security_result.detection_fields
configured_mitigation_action_reason	security_result.detection_fields
configuration_date_time	security_result.detection_fields
Connection	additional.fields
connection	additional.fields
contactNo	principal.user.phone_numbers
Content-Length	additional.fields
content-length	additional.fields
Content-Type	additional.fields
content-type	additional.fields
context_name	additional.fields
context_type	additional.fields
contextPath	security_result.detection_fields
Correlation-Id	security_result.detection_fields
country	principal.location.country_or_region
cs1	security_result.rule_id
cs2	security_result.summary 조건: [cs2Label] == "reason" 그 외: security_result.detection_fields
cs3	security_result.detection_fields
cs4 and cs4label	additional.fields
cs5	principal.ip principal.asset.ip
currency	security_result.detection_fields
currency_type	security_result.detection_fields
current_monitor_state_1	security_result.detection_fields
current_monitor_state_2	security_result.detection_fields
currentFormName	security_result.detection_fields
custMobile	security_result.detection_fields
data.bits	network.sent_bytes
data.name	network.tls.cipher
data.sessionid	network.session_id
data.version	network.tls.version
data_mwh_requestId	security_result.detection_fields
data_renegotiation	security_result.detection_fields
datosReto	security_result.detection_fields
DATE	metadata.event_timestamp
date_time	metadata.event_timestamp
dependentInfo.DependentRel2Name	security_result.detection_fields
dependentInfo.MasterObjectId	security_result.detection_fields
dependentInfo.MasterObjectTableRef	security_result.detection_fields
dependentInfo.RelationshipTag	security_result.detection_fields
desc	security_result.description
description	metadata.description
DEST_IP	target.ip
dest_ip	target.ip
DEST_PORT	target.port
dest_port	target.port
DeviceBrand	principal.asset.hardware.manufacturer (문자열만 허용) principal.asset.attribute.labels (DeviceBrand에 문자열 대신 정수가 포함된 경우 사용됨)
device.app_signature	principal.asset.attribute.labels
device.app_version	principal.asset.platform_software.platform_version
device_blade	intermediary.asset.attribute.labels
device.build_number	principal.asset.attribute.labels
device.device_id	principal.asset_id
device_id	principal.asset_id
device_id_action	security_result.detection_fields
device_id_status	security_result.detection_fields
device.manufacturer	principal.asset.hardware.manufacturer
DeviceModel	principal.asset.hardware.model
device.model	principal.asset.hardware.model
DeviceName	principal.asset.attribute.labels
DeviceOsFamily	principal.asset.platform_software.platform
device.os_version	principal.platform_version
DeviceOsVersion	principal.platform_version
device.platform	principal.asset.platform_software.platform
device_product	additional.fields
device.sdk_int	principal.asset.attribute.labels
DeviceScreenDensity	principal.asset.attribute.labels
DeviceScreenH	principal.asset.attribute.labels
DeviceScreenW	principal.asset.attribute.labels
DeviceSerial	principal.asset.hardware.serial_number
deviceSerialNo	principal.asset.hardware.serial_number
DeviceUnique	principal.asset.product_object_id
DeviceVendorId	principal.asset.attribute.labels
device_version	metadata.product_version
dimensioneLista	security_result.detection_fields
DNT	security_result.detection_fields
dos_attack_detection_mode	security_result.detection_fields
dos_attack_event	security_result.detection_fields
dos_attack_id	security_result.detection_fields
dos_attack_latency	security_result.detection_fields
dos_attack_name	security_result.detection_fields
dos_attack_tps	security_result.detection_fields
dos_baseline_latency	additional.fields
dos_baseline_tps	additional.fields
dos_dropped_requests_count	additional.fields
dos_incoming_requests_count	additional.fields
dos_mitigation_action	security_result.detection_fields
dos_mitigation_reason	security_result.detection_fields
dpt	target.port
dhost	target.hostname
dst	target.ip
dvc	intermediary.ip
dvchost	intermediary.hostname
ECID-Context	security_result.detection_fields
EE_I_ConsultaListadoProcesosCRM.codigoEntidad	security_result.detection_fields
EE_I_VerificacionBeneficiario.codigoEntidad	security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanBeneficiario	security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanOrdenante	security_result.detection_fields
EE_I_VerificacionBeneficiario.nombreBeneficiario	security_result.detection_fields
email	principal.user.email_addresses
end	additional.fields
enforced_by	additional.fields
environment	security_result.detection_fields
errorcode	security_result.action security_result.rule_id
error_message	security_result.summary
errdefs_msg_name	additional.fields
errdefs_msgno	additional.fields
eventId	security_result.detection_fields
event_time	metadata.event_timestamp
expected_state	security_result.detection_fields
expDate	security_result.detection_fields
expires_in	security_result.detection_fields
externalId	additional.fields
f5_action	security_result.action
f5_file	security_result.detection_fields
f5_http_method	network.http.method
f5_id	security_result.rule_id
f5_line	security_result.detection_fields
f5_name	additional.fields
f5_path	security_result.detection_fields
f5_rev	security_result.rule_version
f5_rule_accuracy	security_result.detection_fields
f5_rule_maturity	security_result.detection_fields
f5_rule_version	security_result.detection_fields
f5_signature	security_result.rule_name
f5_sig_two	security_result.threat_id
f5_tag	security_result.detection_fields
f5_unique_id	network.session_id
f5_uri	target.url
f5_waf_msg	security_result.summary
facility	additional.fields
family_name	principal.user.last_name
Fixed-Device-Id	security_result.detection_fields
flavor	security_result.detection_fields
folder	principal.file.full_path
form_data	additional.fields
From	principal.user.phone_numbers
fragment	security_result.detection_fields
geo_info	security_result.detection_fields
geo_location	principal.location.country_or_region
given_name	principal.user.first_name
grant_type	security_result.detection_fields
hashing_cf	security_result.detection_fields
hashingCF	security_result.detection_fields
headless_signatures	security_result.detection_fields
header-one	additional.fields
Host	target.hostname target.asset.hostname
Hostname	principal.hostname
http_class_name	security_result.detection_fields
http_method	network.http.method
http_protocol_indication	network.application_protocol
http_request	network.http.referral_url
http_version	network.application_protocol_version
human_behaviour	security_result.detection_fields
id	additional.fields
idApp	target.resource.product_object_id
identificativointermediariopa	security_result.detection_fields
identificativoStazioneIntermediarioPA	security_result.detection_fields
idExterno	security_result.detection_fields
idReto	security_result.detection_fields
id_token	security_result.detection_fields
I-Twilio-Idempotency-Token	security_result.detection_fields
If-Modified-Since	security_result.detection_fields
ifModifiedSince	security_result.detection_fields
If-None-Match	security_result.detection_fields
ifNoneMatch	security_result.detection_fields
Image	target.file.full_path
imei	security_result.detection_fields
incap-client-ip	principal.ip principal.asset.ip
inquiretransaction_accessCode	security_result.detection_fields
inquiretransaction_companyId	security_result.detection_fields
inquiretransaction_txnPin	security_result.detection_fields
inquiretransaction_user	security_result.detection_fields
internal_timestamp	metadata.event_timestamp
intermediary_Ip	intermediary.ip
intermediary_port	intermediary.port
invoiceNo	security_result.detection_fields
ip	security_result.about.ip
IP_ADDRESS	principal.ip principal.asset.ip
ip_addr_int	security_result.detection_fields
ip_addr_intelli	security_result.detection_fields
IP_CLIENT	principal.ip
ip_client	principal.ip
IpIntelligenceCategory	additional.fields
ip_route_domain	principal.ip principal.asset.ip
Ipv4AddressIntelligence	additional.fields
irule	security_result.rule_name
irule-version	security_result.rule_version
isDccTransaction	security_result.detection_fields
isDebugConnected	security_result.detection_fields
isDebuggable	security_result.detection_fields
isHooked	security_result.detection_fields
isRunningInEmulator	security_result.detection_fields
isSignedWithDebugKey	security_result.detection_fields
isTamperedApk	security_result.detection_fields
is_trunct	security_result.detection_fields
isWrongCert	security_result.detection_fields
jailbroken_or_rooted_device	security_result.detection_fields
Keep-Alive	additional.fields
lat	security_result.detection_fields
lbCookie	security_result.detection_fields
level	security_result.severity
link	target.url
listener	security_result.detection_fields
lng	security_result.detection_fields
Locale	security_result.detection_fields
log_event	security_result.detection_fields
manage_ip_addr	intermediary.ip
management_ip_address	intermediary.ip
management_ip_address_2	intermediary.ip
max_amount	security_result.detection_fields
member_with_port	security_result.detection_fields
MessageSid	security_result.detection_fields
MessageStatus	security_result.detection_fields
meta_data.object_type	security_result.detection_fields
METHOD	network.http.method
method	network.http.method
micro_service_hostname	additional.fields
micro_service_matched_wildcard_url	additional.fields
micro_service_name	additional.fields
micro_service_type	additional.fields
microservice	additional.fields
min_amount	security_result.detection_fields
mobile_application_name	security_result.detection_fields
mobile_application_version	security_result.detection_fields
mobile_debugger_enabled_device	security_result.detection_fields
mobile_in_emulation_mode	security_result.detection_fields
mobile_is_app	additional.fields
mock	security_result.detection_fields
model	principal.asset.hardware.model
module	security_result.detection_fields
monitor_details	security_result.detection_fields
monitor_status	security_result.detection_fields
monitor_type_1	security_result.detection_fields
monitor_type_2	security_result.detection_fields
msg	security_result.summary
msgg	security_result.description
msg_type	security_result.detection_fields
Name	principal.user.user_display_name
nativeDeviceId	principal.asset.product_object_id
net.host.ip	principal.ip principal.asset.ip
net.host.name	principal.hostname principal.asset.hostname
net.host.port	principal.port
net.peer.ip	principal.ip principal.asset.ip
net.peer.name	target.hostname target.asset.hostname
net.peer.port	target.port
net.transport	network.ip_protocol
network_http_method	network.http.method
new_request_status	additional.fields
nickname	security_result.detection_fields
nii	security_result.detection_fields
nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
num_of_attempts	additional.fields
num_trans	security_result.detection_fields
oauth_server	security_result.detection_fields
Ocp-Apim-Subscription-Key	security_result.detection_fields
ODJFS-AUTH-TOKEN	security_result.detection_fields
Opcode	security_result.severity
Origin	additional.fields
origin	additional.fields
originId	security_result.detection_fields
os	principal.asset.platform_software.platform
Os-Version	principal.platform_version
os_name	security_result.detection_fields
packageName	security_result.detection_fields
partition	additional.fields
partition_name	intermediary.asset.attribute.labels
path	target.url
pathContext	target.application
paymentMode	security_result.detection_fields
phost	security_result.detection_fields
pideUsuario	security_result.detection_fields
platform	principal.asset.platform_software.platform
POLICY	security_result.rule_name
policy	security_result.rule_name
policy_apply_date	security_result.detection_fields
policy_name	security_result.rule_name
pool	security_result.detection_fields
pool_name	security_result.detection_fields
postalCode	principal.asset.attribute.labels
post_len	security_result.detection_fields
Pragma	additional.fields
pragma	additional.fields
previous_action	additional.fields
previous_initiated_action	security_result.detection_fields
previous_initiated_action_status	security_result.detection_fields
previous_request_date_time	security_result.detection_fields
previous_state	security_result.detection_fields
previous_support_id	security_result.detection_fields
principal_data.hostname	principal.hostname principal.asset.hostname
principal_data.ip	principal.ip principal.asset.ip
principal_ipv6	principal.ip principal.asset.ip
principal_mail	principal.user.email_addresses
Priority	additional.fields
priority	additional.fields
priority_value	additional.fields
process	target.application
process_id	principal.process.pid
processtransaction_accessCode	security_result.detection_fields
processtransaction_companyId	security_result.detection_fields
processtransaction_txnPin	security_result.detection_fields
processtransaction_user	security_result.detection_fields
product_name	security_result.rule_type
prod_id	metadata.product_log_id
properties.branch	target.resource.attribute.labels
properties.build	target.resource.attribute.labels
properties.commit	target.resource.attribute.labels
properties.deployment-environment	target.resource.attribute.labels
properties.issueId	target.resource.attribute.labels
properties.issueMatchesProjectContext	target.resource.attribute.labels
properties.projectId	target.resource.attribute.labels
properties.projectType	target.resource.attribute.labels
properties.pullrequest	target.resource.attribute.labels
properties.review	target.resource.attribute.labels
properties.timeDelta	target.resource.attribute.labels
PROTO	network.application_protocol
protocol	network.application_protocol
ProviderGuid	target.resource.id
Proxy-Authorization	security_result.detection_fields
Proxy-Connection	security_result.detection_fields
proxy_errorcode	security_result.detection_fields
proxy_id	security_result.rule_id
proxy_message	security_result.detection_fields
pushNotificationEnabled	security_result.detection_fields
Qualys-Scan	security_result.detection_fields
QUERY_STR	additional.fields
query	security_result.detection_fields
query_string	additional.fields
query_str	security_result.detection_fields
QUOTEDATA	security_result.detection_fields
rangeDa	security_result.detection_fields
rating	security_result.severity_details
RawDlrDoneDate	security_result.detection_fields
rawrequest	target.url
received_bytes	network.received_bytes
received_state	security_result.detection_fields
Referer	network.http.referral_url
referer	network.http.referral_url
referrer	network.http.referral_url
registerDevice	security_result.detection_fields
related_pid	additional.fields
remote_request_ip	principal.ip principal.asset.ip
reputation	security_result.detection_fields
REQ	additional.fields
REQ_STATUS	security_result.action
req_status	security_result.action security_result.action_details security_result.detection_fields
req_status_value	security_result.action security_result.action_details
request	target.url
request_body_size	additional.fields
Request-Context	security_result.detection_fields
request_date_time	security_result.detection_fields
Request-Id	security_result.detection_fields
request_id	additional.fields
requestClientApplication	network.http.user_agent network.http.parsed_user_agent
requestMethod	network.http.method
request_status	security_result.action security_result.action_details
request_side	security_result.detection_fields
resource_name	target.resource.name
RESP_CODE	network.http.response_code
resp	security_result.detection_fields
resp_code	network.http.response_code
response	security_result.summary
response_code	network.http.response_code
riskIT.deviceSignature.browser.userAgent	network.http.user_agent network.http.parsed_user_agent
riskIT.deviceSignature.camera.autoFocus	principal.asset.attribute.labels
riskIT.deviceSignature.camera.flash	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCamera	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedFormats	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedSizes	principal.asset.attribute.labels
riskIT.deviceSignature.camera.numberOfCameras	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCamera	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedFormats	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedSizes	principal.asset.attribute.labels
riskIT.deviceSignature.collector	principal.asset.attribute.labels
riskIT.deviceSignature.collectorVersion	principal.asset.attribute.labels
riskIT.deviceSignature.extra.account	principal.asset.attribute.labels
riskIT.deviceSignature.extra.securityPolicy	principal.asset.attribute.labels
riskIT.deviceSignature.location.latitude	principal.location.region_coordinates.latitude
riskIT.deviceSignature.location.longitude	principal.location.region_coordinates.longitude
riskIT.deviceSignature.screen.displayId	principal.asset.attribute.labels
riskIT.deviceSignature.screen.height	principal.asset.attribute.labels
riskIT.deviceSignature.screen.orientation	principal.asset.attribute.labels
riskIT.deviceSignature.screen.width	principal.asset.attribute.labels
riskIT.deviceSignature.system.androidId	principal.asset.attribute.labels
riskIT.deviceSignature.system.board	principal.asset.attribute.labels
riskIT.deviceSignature.system.brand	principal.asset.hardware.manufacturer
riskIT.deviceSignature.system.cpuAbi	principal.asset.hardware.cpu_platform
riskIT.deviceSignature.system.debuggerAttached	principal.asset.attribute.labels
riskIT.deviceSignature.system.deviceName	principal.asset.attribute.labels
riskIT.deviceSignature.system.hardware	principal.asset.attribute.labels
riskIT.deviceSignature.system.host	principal.asset.attribute.labels
riskIT.deviceSignature.system.id	principal.asset.attribute.labels
riskIT.deviceSignature.system.jailBroken	principal.asset.attribute.labels
riskIT.deviceSignature.system.locale	principal.asset.attribute.labels
riskIT.deviceSignature.system.model	principal.asset.hardware.model
riskIT.deviceSignature.system.numberOfProcessors	principal.asset.hardware.cpu_number_cores
riskIT.deviceSignature.system.osVersion	principal.platform_version
riskIT.deviceSignature.system.platform	principal.asset.platform_software.platform
riskIT.deviceSignature.system.processName	principal.asset.attribute.labels
riskIT.deviceSignature.system.radio	principal.asset.attribute.labels
riskIT.deviceSignature.system.tags	principal.asset.attribute.labels
riskIT.deviceSignature.system.timeZone	principal.asset.attribute.labels
riskIT.deviceSignature.system.totalDiskSpace	principal.asset.attribute.labels
riskIT.deviceSignature.system.totalMemory	principal.asset.hardware.ram
riskIT.deviceSignature.system.type	principal.asset.attribute.labels
riskIT.deviceSignature.system.user	principal.user.userid
riskIT.deviceSignature.telephony.carrierIsoCountryCode	principal.location.country_or_region
riskIT.deviceSignature.telephony.carrierMobileCountryCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierMobileNetworkCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierName	principal.network.carrier_name
riskIT.deviceSignature.telephony.cellIpAddress	principal.ip principal.asset.ip
riskIT.deviceSignature.telephony.isRoamingNetwork	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.networkType	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.phoneType	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simIsoCountryCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simOperatorName	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simSerialNumber	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.broadcastAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.connected	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.gatewayAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.macAddress	principal.mac principal.asset.mac
riskIT.deviceSignature.wifi.netmaskAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.userEnabled	principal.asset.attribute.labels
riskIT.ipAddress	principal.ip principal.asset.ip
rrn	security_result.detection_fields
RS_VISITOR_ID	security_result.detection_fields
rt	metadata.event_timestamp
rule_name	security_result.rule_name
rule_summary	security_result.summary
rule_version	metadata.product_version
save_payee	security_result.detection_fields
schedule_frequency	security_result.detection_fields
schedule_occurrence	security_result.detection_fields
scope_details	additional.fields
sec-ch-ua	security_result.detection_fields
sec-ch-ua-mobile	additional.fields
sec-ch-ua-platform	principal.asset.platform_software.platform
sec-fetch-dest	additional.fields
Sec-Fetch-Dest	additional.fields
sec-fetch-mode	additional.fields
Sec-Fetch-Mode	additional.fields
sec-fetch-site	additional.fields
Sec-Fetch-Site	additional.fields
Sec-Fetch-Storage-Access	security_result.detection_fields
sec-fetch-user	additional.fields
Sec-Fetch-User	additional.fields
Sec-Fetch-User	additional.fields
sequence_id	additional.fields
server_ip	target.ip
server_port	target.port
service_id	target.resource.product_object_id
SESS_ID	network.session_id
session_id	network.session_id
session_status	security_result.detection_fields
sessionDataId	security_result.detection_fields
sessionDataKey	security_result.detection_fields
Set-Cookie	security_result.detection_fields
set_cookie	security_result.detection_fields
severity	security_result.severity
severity_number	security_result.severity
sg_event_id	security_result.detection_fields
sg_message_id	security_result.detection_fields
sg_template_id	security_result.detection_fields
sg_template_name	security_result.detection_fields
Shield	security_result.detection_fields
signature	security_result.detection_fields
SIG_IDS	security_result.rule_id
sig_cves	security_result.detection_fields
sig_ids	security_result.detection_fields
SIG_NAMES	security_result.rule_name 조건: [policy_name] == ""
SmsSid	security_result.detection_fields
SmsStatus	security_result.detection_fields
snat_ip	principal.nat_ip
snat_port	principal.nat_port
SOAPAction	additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/user	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnData	additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/user	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/user	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/companyId	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/user	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/companyId	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/user	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/companyId	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/user	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/companyId	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/user	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/companyId	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/user	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/companyId	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/user	security_result.detection_fields
sort_order	security_result.detection_fields
SourceModuleName	target.resource.name
SourceModuleType	observer.application
source_host	principal.hostname principal.asset.hostname
source_ip	principal.ip principal.asset.ip
spt	principal.port
src	principal.nat_ip 조건: [src] != [cs5]
SRC_PORT	principal.port
src_port	principal.port
srcport	principal.port
SSL_Client_Cert	security_result.detection_fields
ssl_error_code	security_result.detection_fields
ssl_routine	security_result.detection_fields
staged_sig_cves	security_result.detection_fields
staged_sig_ids	security_result.detection_fields
staged_sig_names	security_result.detection_fields
stagedThreatCampaignNames	additional.fields
staged_threat_campaign_names	security_result.detection_fields
start	additional.fields
start_date	security_result.detection_fields
state	principal.location.state
status	security_result.summary
SUB_VIOLATIONS	additional.fields
sub_process	additional.fields
sub_violates	security_result.summary
sub_violations	security_result.detection_fields
suid	principal.user.userid
summary	security_result.summary
SUPPORT_ID	additional.fields
suser	principal.user.user_display_name
tap_event_id	security_result.detection_fields
tap_vid	security_result.detection_fields
target_data.application	target.application
target_data.ip	target.ip target.asset.ip
target_url	target.url
taxCode	security_result.detection_fields
terminalId	security_result.detection_fields
threat_campaign_names	security_result.detection_fields
thread_id	security_result.detection_fields
tls	network.tls.version
tls_version	network.tls.version
tmm_unit	security_result.detection_fields
To	target.user.phone_numbers
token	security_result.detection_fields
t_port	target.port
traceNo	security_result.detection_fields
traceparent	security_result.detection_fields
Transfer-Encoding	security_result.detection_fields
transfer_type	security_result.detection_fields
transType	security_result.detection_fields
True-Client-IP	principal.ip principal.asset.i
true-client-ip	principal.ip principal.asset.ip
tty	additional.fields
TYPE	security_result.category security_result.category_details
type	metadata.product_event_type
uniqueId	security_result.detection_fields
Upgrade-Insecure-Requests	security_result.detection_fields
URI	target.url
url	principal.url
user	principal.user.userid
USER_AGENT	network.http.user_agent network.http.parsed_user_agent
User-Agent	network.http.user_agent network.http.parsed_user_agent
user_display_name	principal.user.user_display_name
UserID	principal.user.userid
user_id	principal.user.userid
user_name	principal.user.userid
userName	principal.user.email_addresses
user_remarks	security_result.detection_fields
user_type	principal.asset.attribute.labels
usuarioBE	security_result.detection_fields
uuid	security_result.detection_fields
validateaccountnumber_accessCode	security_result.detection_fields
validateaccountnumber_companyId	security_result.detection_fields
validateaccountnumber_txnPin	security_result.detection_fields
validateaccountnumber_user	security_result.detection_fields
vAT	security_result.detection_fields
verb	network.http.method
versionCode	security_result.detection_fields
versionName	security_result.detection_fields
VFPJSESSION	security_result.detection_fields
Via	security_result.detection_fields
VIP	security_result.detection_fields
VIRTUAL	network.tls.client.server_name
VIRTUAL_address	target.resource.name
virtual_server_name	network.tls.client.server_name
virtualserver	network.tls.client.server_name
violation_mask_alarm	security_result.detection_fields
violation_mask_block	security_result.detection_fields
violation_mask_learn	security_result.detection_fields
violation_mask_staging	security_result.detection_fields
violation_rating	security_result.detection_fields
violations	security_result.description
virus_name	security_result.threat_name
vs_ip	intermediary.ip
vs_name	target.resource.name
vs_port	intermediary.port
web_application_name	target.application
websocket_direction	network.direction = Inbound 조건: ([websocket_direction] == "clientToServer"인 경우) network.direction = OUTBOUND 조건: ([websocket_direction] == "ServerToclient"인 경우)
websocket_message_type	security_result.detection_fields
wm_client_ip	principal.ip principal.asset.ip
WORKIDENTIFIER	security_result.detection_fields
wtfpc	security_result.detection_fields
X-Amzn-Trace-Id	security_result.detection_fields
X-Bug-Bounty	security_result.detection_fields
X-Bug-Bounty-Contact	security_result.detection_fields
X-Bug-Bounty-Purpose	security_result.detection_fields
X-Client-Ip	principal.ip principal.asset.ip
x-codsecent	security_result.detection_fields
X-Cnection	security_result.detection_fields
X-Correlation-ID	security_result.detection_fields
x-correlation-id	security_result.detection_fields
x-country-code	principal.location.country_or_region
x-dtpc	security_result.detection_fields
X-Environment	security_result.detection_fields
X-EVENT-TYPE	metadata.product_event_type
X-F5-VIP	target.ip target.asset.ip
XFF	principal.ip
X-FORWARDED-PORT	target.port
X-FORWARDED-PROTO	network.application_protocol
X-Forwarded-For	principal.ip principal.asset.ip
X-Forwarded-Proto	network.application_protocol
x-forwarded-client-cert	security_result.detection_fields
x-fwd-hdr-val	security_result.detection_fields
X-header-postpay-addons-uri	security_result.detection_fields
X-Home-Region	security_result.detection_fields
x-iapp-real-ip	principal.ip principal.asset.ip
X-ma-bid	security_result.detection_fields
X-ma-did	security_result.detection_fields
X-ma-hostname	security_result.detection_fields
X-ma-pid	security_result.detection_fields
X-ma-sid	security_result.detection_fields
X-MicrosoftAjax	security_result.detection_fields
x-msisdnToken	security_result.detection_fields
X-msisdnToken	security_result.detection_fields
X-OAUTH-IDENTITY-DOMAIN-NAME	security_result.detection_fields
X-ORIGINAL-HOST	principal.hostname
X-Original-URL	principal.url
X-OWA-ActionId	additional.fields
X-OWA-ActionName	additional.fields
X-OWA-Attempt	additional.fields
X-OWA-CANARY	additional.fields
X-OWA-ClientBuildVersion	security_result.detection_fields
X-OWA-CorrelationId	metadata.product_log_id
X-OWA-ExplicitLogonUser	principal.user.email_addresses
X-OWA-UrlPostData	security_result.detection_fields
X-Requested-With	additional.fields
x-request-application	metadata.product_event_type
X-ROBOT-AGENT	security_result.detection_fields
X-ROBOT-LICENSE	security_result.detection_fields
X-ROBOT-MACHINE-ENCODED	security_result.detection_fields
X-ROBOT-SERVICE-USERNAME-ENCODED	security_result.detection_fields
X-ROBOT-VERSION	security_result.detection_fields
X-Remote-Addr	principal.ip principal.asset.ip
x-session	security_result.detection_fields
X-Twilio-Email-Event-Webhook-Signature	security_result.detection_fields
X-Twilio-Email-Event-Webhook-Timestamp	security_result.detection_fields
X-Twilio-Signature	security_result.detection_fields
X-UIPATH-INSTALLATION-ID	security_result.detection_fields
X-UIPATH-INSTALLATION-VERSION	security_result.detection_fields
X-UIPATH-Localization	security_result.detection_fields
X-wa-sid	security_result.detection_fields
xWpammRequestId	security_result.detection_fields
X-XSRF-TOKEN	additional.fields
X-xforwarded-client-cert	security_result.detection_fields

CSV 로그

입력 열	대상 필드	조건
[column4] != 'asm-policy'인 경우
column5가 유효한 IP가 아닌 경우
column1	target_ip
column2	target_port
column3	geo_location	[column3]이(가) ["N/A", ""]에 없음
column3	target_ip	[column3] != '' AND [column3] =~ '^[0-9.]'
column5	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6	VIOLATION_DETAILS	[column6] =~ '.*xml'
column7	intermediary_Ip	[column7] != "" AND GROK %{IP:column7} succeeds
column8	network_http_method	["GET","POST","PUT","DELETE","PATCH","HEAD","OPTIONS"]의 [column8]
column7	network_http_method	ELSE IF [column7] in ["GET","POST", ...]
column9	event.idm.read_only_udm.additional.fields	[column9]이 ["", "N/A"]에 없고 타임스탬프가 아님
column9	policy_apply_date	[column9]이 ["", "N/A"]에 없으며 타임스탬프임
column10	security_result.rule_name	![column10_is_ip] AND [column10] == [column3] AND [column10] != ""
column11	app_protocol	[column11] != ""
column13	다양함 (KV)	[column13] != ""
column14	req_status_value	["blocked", "allowed", "alerted", "passed"]의 [column14]
column18	request_id	[column18] != ""
column19	severity_level	[column19] =~ "(?i)(Informational
column22	principal_port	[column22]이 ["", "N/A"]에 없으며 [column22]이 숫자임
column23	event.idm.read_only_udm.metadata.product_log_id	[column23]이(가) ["", "N/A"]에 없음
column25	syslog_host	[syslog_host] == "" AND [column25] != ""
column26	event.idm.read_only_udm.network.http.referral_url	[column26]이(가) ["", "N/A"]에 없음
column27	VIOLATION_DETAILS	[column27] =~ '.*xml'
column28	VIOLATION_DETAILS	[column27] !~ ".xml" AND [column28] =~ ".xml"
column28	security_result.description	[column27] !~ ".xml" AND [column28] !~ ".xml" AND [column28] not in ["", "N/A"] AND [column28] is NOT numeric
column15	response	IF [column27] !~ '.*xml': [column15] != ''
column16	network_http_response_code	[column27]이(가) ".*xml"과 일치하지 않는 경우: [column16]이(가) ["","-"]에 없음
column24	session_id	IF [column27] !~ '.*xml': [column24] != ''
column29	security_result.summary	IF [column27] !~ '.*xml': [column29] != ''
column24	resource_name	IF [column27] =~ ".*xml": [column24] != ""
column31	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column5가 유효한 IP인 경우
column1	target_ip
column2	target_port
column3	geo_location	[column3]은(는) 유효한 IP가 아닙니다.
column3	target_ip	[column3] != "" AND [column3]이 유효한 IP임
column6	principal_ip	[column6] != "" AND GROK %{IP:column6} succeeds
column7	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column7	VIOLATION_DETAILS	[column7] =~ '.*xml'
column8	intermediary_Ip	[column8]이 ["", "N/A"]에 포함되지 않고 GROK %{IP:column8}이 성공함
column9	network_http_method	["GET","POST", ...]의 [column9]
column8	network_http_method	ELSE IF [column8] in ["GET","POST", ...]
column9	collected_time	[column9] =~ "^[0-9]+"
column22	request_body_size	[column22] =~ "^[0-9]+$"
column10	event.idm.read_only_udm.additional.fields	[column10]이 ["", "N/A"]에 없고 타임스탬프가 아님
column10	policy_apply_date	[column10]이 ["", "N/A"]에 없으며 타임스탬프임
column11	security_result.rule_name	[column11_is_ip] AND [column11] == [column4] AND [column11] != ""
column4	policy_name	ELSE IF [column11] != [column4] AND [column4] != "" AND [column4] is NOT numeric
column4	target_port	ELSE IF [column4]이 숫자임
column12	app_protocol
column13	다양함 (KV)	[column13] != ""
column15	req_status_value	["blocked", "allowed", "alerted", "passed"]의 [column15]
column19	request_id
column20	severity_level	[column20] =~ "(?i)(Informational
column23	principal_port	[column23]이 ["", "N/A"]에 없으며 [column23]이 숫자임
column26	syslog_host	[syslog_host] == "" AND [column26] != ""
column27	event.idm.read_only_udm.network.http.referral_url	[column27]이(가) ["", "N/A"]에 없음
column28	VIOLATION_DETAILS	[column28] =~ '.*xml'
column29	VIOLATION_DETAILS	[column28] !~ ".xml" AND [column29] =~ ".xml"
column29	security_result.description	[column28] !~ ".xml" AND [column29] !~ ".xml" AND [column29] not in ["", "N/A"] AND [column29] is NOT numeric
column16	response	IF [column28] !~ '.*xml': [column16] != ''
column17	network_http_response_code	[column28]이(가) ".*xml"과 일치하지 않는 경우: [column17]이(가) ["","-"]에 없음
column25	session_id	IF [column28] !~ '.*xml': [column25] != ''
column30	security_result.summary	IF [column28] !~ '.*xml': [column30] != ''
column25	principal_ip	IF [column28] =~ ".*xml": [column25] != "" AND ![column25_is_ip]
column16	network_http_response_code	[column28] =~ ".*xml"인 경우: [column25] != "" 및 [column16] != ""
column19	severity_level	[column28] =~ ".*xml"인 경우: [column25] != "" AND [column19] =~ "(?i)(Informational...)"
column24	session_id	[column28] =~ ".*xml"인 경우: [column25] != "" AND [column24]이(가) ["", "N/A"]에 포함되지 않음
column25	resource_name	[column28] =~ ".*xml" AND [column25] == ""인 경우: [column25] != ""
column24	event.idm.read_only_udm.metadata.product_log_id	[column28] =~ ".*xml" AND [column25] == ""인 경우: [column24]이(가) ["", "N/A"]에 포함되지 않음
column32	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column33	request
column34	response
IF [column4] == "asm-policy"
column1	principal_ip	[column1] != '' AND [column1] =~ '^[0-9.]'
column2	principal_port	[column2]이(가) ["","N/A","none"]에 없음
column3	principal_ip	[column3] != '' AND [column3] =~ '^[0-9.]'
column4	event.idm.read_only_udm.metadata.product_event_type	[column4] != ""
column6	principal_ip	[column6] != "" AND [column6]이 유효한 IP임
column6	req_status_value	ELSE IF [column6] in ["blocked", "allowed", ...]
column6	support_id	ELSE [column6] != ""
column7	severity_level	[column7] =~ "(?i)(Informational...)"
column8	geo_location	[column8]이(가) ["N/A", ""]에 없음
column9	VIOLATION_DETAILS	[column9] =~ '.*xml'
column9	event.idm.read_only_udm.target.application	ELSE IF [column9] != ""
column11	intermediary_Ip	GROK %{IP:column11}가 성공함
column16	target_ip	GROK %{IP:column16}가 성공함
column18	network_http_method	[column18]이(가) ["","N/A","none"]에 없음
column24	policy_apply_date
column26	app_protocol
column29	target_url	[column29] != "" 및 Grok 일치
column29	다양함 (KV)	[column29] != "" 및 Grok 일치
column30	req_status_value	["blocked", "allowed", ...]의 [column30]
column31	security_result.summary
column32	network_http_response_code	[column32] != ""
column35	severity
column55	VIOLATION_DETAILS	[column55] =~ '.*xml'
column58	VIOLATION_DETAILS	[column58] =~ '.*xml'
column60	security_result.description	[column60]이(가) ["","N/A","none"]에 없음
column62	event.idm.read_only_udm.target.resource.name
IF ![utf_error] (전체 블록이 이 조건에 해당합니다. [utf_error]이 true이면 메시지가 삭제됨) IF ![utf_error]
column2	principalIp	(![utf_error] 내부)
column1	column1	(![utf_error] 내부)
'IF [no_ip_address] (column2에서 Grok 실패)'
column1	date_time
column2	attackType
column3	principalIp
column11	method
column12	url
column13	app_protocol
column10	targetIp
column9	intermediaryIp
column19	rating
column15	req_status
column5	geo_location
column27	VIOLATION_DETAILS	[column27]이 XML 데이터와 유사한 경우
column25	VIOLATION_DETAILS	[column27]이 XML 데이터와 유사하지 않은 경우
'ELSE (of [no_ip_address]) (Grok on column2 succeeded)'
column1	date_time
attack_type	attackType
column10	method
column11	url
column12	app_protocol
column9	targetIp
column8	intermediaryIp
column18	rating
column14	req_status
column5	geo_location	[no_ip_address]이 아니고 [column5]이 ["N/A", ""]에 없음
column17	severity	[no_ip_address]이 아니고 [column17]이 ["N/A", ""]에 없음
column20	request_id	[no_ip_address]이 아니고 [column20]이 ["N/A", ""]에 없음
column26	x_forwarded_for	[no_ip_address]이 아니고 [column26]이 ["N/A", ""]에 없음
column4	dest_port	[column3] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
column3	dest_port	ELSE ([column3] IP 확인)
column15	resp_code	해당 사항 없음
column16	resp_code	IF [column15_not_resp_code]
column17	resp_code	[column15_not_resp_code] 및 [column16_not_resp_code]인 경우
attackType	attack_type	[attackType]이(가) ["N/A", ""]에 없음
intermediaryIp	intermediary_Ip	[intermediaryIp] != ""
principalIp	principal_ip	[principalIp] != ""
targetIp	target_ip	[targetIp] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
resp_code	network_http_response_code	[resp_code] != ""
dest_port	target_port	[dest_port] != ""
url	target_url	[url] != ""
intermediary_Ip	intermediary.ip	[intermediary_Ip] != ""
ELSE(![utf_error])
TAG_UNSUPPORTED로 메시지 삭제

출시 델타

Google SecOps에서 F5 ASM 파서의 새 버전을 출시했습니다. 이 버전에는 Parser_Name 로그 필드를 UDM 필드에 매핑하는 방식의 중요한 변경사항과 이벤트 유형 매핑의 변경사항이 포함되어 있습니다.

로그 필드 매핑 델타

로그 필드	기존 매핑	신규
Accept	"security_result.about.resource.attribute.label\nsecurity_result.about.labels"	additional.fields
Accept-Charset	security_result.about.resource.attribute.labels	additional.fields
Accept-Encoding	"security_result.about.resource.attribute.labels\nsecurity_result.about.labels"	additional.fields
Accept-Language	security_result.detection_fields	additional.fields
Accept-Language	"security_result.detection_fields\nsecurity_result.aboit.labels"	additional.fields
AccountType	target.user.role_description	target.user.attribute.roles.description
act	security_result.action == ALLOW	security_result.action == QUARATINE
action1	security_result.detection_fields	security_result.action_details
actual_mitigation_action	security_result.detection_fields	'없음' 값이 삭제됨
actual_mitigation_action_reason	security_result.detection_fields	'없음' 값이 삭제됨
attack_type	intermediary.hostname and security_result.category_details	security_result.category_details
Cache-Control	security_result.about.resource.attribute.labels	additional.fields
Cache-Control	security_result.detection_fields	additional.fields
cn2 (평점)	security_result.severity	security_result.detection_fields
Connection	"security_result.about.resource.attribute.labels\nsecurity_result.about.labels"	additional.fields
Connection	security_result.detection_fields	additional.fields
Content-Length	security_result.about.labels	additional.fields
Content-Type	security_result.about.labels	additional.fields
date_time	metadata.event_timestamp	중복 매핑 삭제
descrip	metadata.descrption	중복 매핑 삭제
device_id	target.asset.id	principal.asset.id
device_product	security_result.detection_fields	additional.fields
dvchost	intermediary.ip and intermedairy.asset.ip	intermediary.ip
event_id (grok 추출 값)	additional.fields	principal.process.pid
Keep-Alive	security_result.about.resource.attribute.labels	additional.fields
net.host.port	principal.port and additional.fields	additional.fields
net.peer.name	"target.hostname, target.asset.hostname\nadditional.fields"	target.hostname
net.peer.port	target.port and additional.fields	additional.fields
policy_name	about.resource.name	security_result.rule_name
policy_name	security_result.about.resource.name	security_result.rule_name
Pragma	security_result.about.resource.attribute.labels	additional.fields
Pragma	security_result.detection_fields	additional.fields
rating	security_result.severity	중복 매핑 삭제
Reason	security_resultsummary and securtiy_result.detetction_fields	security_result.detection_fields
resp_code	security_result.severity	중복 매핑 삭제
response_code	additional.fields and network.http.response_code	network.http.response_code
sig_names	security_result.rule_name	security_result.detection_fields
sub_violations	security_result.about.resource.attribute.labels	security_result.detection_fields
support_id	additional.fields and metadata.product_log_id	metadata.product_log_id
SYSLOG headers	principal.ip	intermediary.ip
uri	principal.url and target.url	traget.url
violation_rating	security_result.about.resource.attribute.labels	security_result.detection_fields
X-Forwarded-For	security_result.about.resource.attribute.labels	principal.ip
XFF	intermediary.ip	principal.ip
x_forwarded_for_header_value	additional.fields	principal.ip

기타 변경사항

• '해당 사항 없음' 값 매핑 삭제:

  • '해당 사항 없음' 값이 더 이상 principal.location.country_or_region에 매핑되지 않습니다.
  • '해당 사항 없음' 값이 더 이상 principal.user.userid에 매핑되지 않습니다.

• 직접 프로토콜/방향 매핑 삭제:

  • 'UDP'가 포함된 메시지를 network.ip_protocol에 직접 매핑하는 기능이 삭제되었습니다.
  • 'HTTPS'가 포함된 메시지를 network.application_protocol에 직접 매핑하는 기능이 삭제되었습니다.
  • network.direction을 INBOUND로 설정하는 정적 설정이 삭제되었습니다.
  • 'HTTPS/1.1'이 포함된 메시지를 network.network.tls.version에 직접 매핑하는 기능이 삭제되었습니다.

• 업데이트된 URL 매핑:

  • 이전에는 req_host와 req_uri가 병합되어 target.url에 매핑되었습니다. req_uri만 target.url에 매핑되도록 업데이트되었습니다.

• 수정된 작업 설정:

  • "num_of_attempts"이 null이 아닌 경우 security_result.action을 ALLOW으로 설정하는 작업이 삭제되었습니다.

• 삭제된 고정 IP 매핑:

  • dvc_ip에서 0.0.0.0로의 정적 매핑이 삭제되었습니다.
  • target_ip에서 0.0.0.0로의 정적 매핑이 삭제되었습니다.

• 수정된 externalid 매핑:

  • 이제 externalid의 매핑이 additional.fields을 채우고 키 이름이 Support_id에서 externalid로 변경됩니다.

• 업데이트된 심각도 매핑:

  • 이제 숫자 [severity_level] 값 (예: '1', '2', '3')이 'LOW'로 다시 매핑됩니다. 이렇게 하면 숫자 심각도 코드가 일관된 규모로 표준화됩니다.
  • 이제 '경고' 로그가 통합되어 '보통'에 매핑되므로 심각도 분류가 간소화됩니다.
  • 심각도 검사 순서가 가장 심각한 순서대로 조정되었습니다. ERROR, CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL 순입니다.

• 잘못된 값 삭제:

  • 리터럴 큰따옴표 (\")가 포함된 값이 principal.url에서 삭제되었습니다.
  • * 또는 $로 시작하는 잘못된 값이 network.http.parsed_user_agent에서 삭제되었습니다.

변경 로그

이 파서의 변경 로그 보기

도움이 더 필요하신가요? 커뮤니티 회원 및 Google SecOps 전문가에게 문의하여 답변을 받으세요.