收集 GitHub 稽核記錄

支援的國家/地區：

本文說明如何使用 Amazon S3，將 GitHub 稽核記錄擷取至 Google Security Operations。剖析器會嘗試使用各種 Grok 模式，從「message」欄位擷取資料，並處理 JSON 和非 JSON 格式。根據擷取的「process_type」，使用 grok、kv 和其他篩選器套用特定剖析邏輯，將原始記錄資料對應至 Unified Data Model (UDM) 結構定義。

事前準備

請確認您已完成下列事前準備事項：

  • Google SecOps 執行個體。
  • 具有企業主權限的 GitHub Enterprise Cloud 租戶特殊存取權。
  • AWS (S3、IAM) 的特殊存取權。

收集 GitHub Enterprise Cloud 先決條件 (企業存取權)

  1. 登入 GitHub Enterprise Cloud 管理控制台。
  2. 依序前往「企業設定」「設定」「稽核記錄」「記錄串流」。
  3. 請確認您具備企業擁有者權限，可設定稽核記錄串流。
  4. 複製下列詳細資料並儲存在安全位置：
    • GitHub Enterprise 名稱
    • 企業底下的機構名稱

為 Google SecOps 設定 AWS S3 值區和身分與存取權管理

  1. 按照這份使用者指南建立 Amazon S3 bucket：建立 bucket
  2. 儲存 bucket 的「名稱」和「地區」，以供日後參考 (例如 github-audit-logs)。
  3. 請按照這份使用者指南建立使用者：建立 IAM 使用者。
  4. 選取建立的「使用者」。
  5. 選取「安全憑證」分頁標籤。
  6. 在「Access Keys」部分中，按一下「Create Access Key」。
  7. 選取「第三方服務」做為「用途」。
  8. 點選「下一步」。
  9. 選用：新增說明標記。
  10. 按一下「建立存取金鑰」。
  11. 按一下「下載 .CSV 檔案」，儲存「存取金鑰」和「私密存取金鑰」，以供日後參考。
  12. 按一下 [完成]。

設定 GitHub S3 串流的 IAM 政策

  1. 在 AWS 控制台中，依序前往「IAM」>「Policies」>「Create policy」>「JSON」分頁標籤。
  2. 複製並貼上下列政策。

  3. 政策 JSON (如果您輸入的 bucket 名稱不同，請替換 github-audit-logs)：

    {
"Version": "2012-10-17",
"Statement": [
    {
    "Sid": "AllowPutObjects",
    "Effect": "Allow",
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::github-audit-logs/*"
    }
]
}

  4. 依序點選「下一步」>「建立政策」。

  5. 為政策命名 GitHubAuditStreamingPolicy，然後點選「建立政策」。

  6. 返回先前建立的 IAM 使用者。

  7. 選取 [權限] 分頁標籤。

  8. 依序點選「新增權限」>「直接附加政策」。

  9. 搜尋並選取 GitHubAuditStreamingPolicy。

  10. 依序點選「下一步」>「新增權限」。

設定 GitHub Enterprise Cloud 稽核記錄串流

  1. 以企業擁有者身分登入 GitHub Enterprise Cloud。
  2. 按一下個人資料相片，然後按一下「企業版設定」。
  3. 在企業帳戶側欄中，依序按一下「設定」>「稽核記錄」>「記錄串流」。
  4. 選取「設定串流」，然後按一下「Amazon S3」。
  5. 在「驗證」之下點選「存取金鑰」。
  6. 請提供下列設定詳細資料：
    • 「Region」(區域)：選取 bucket 的區域 (例如 us-east-1)。
    • Bucket：輸入要串流至的 bucket 名稱 (例如 github-audit-logs)。
    • 存取金鑰 ID：輸入 IAM 使用者的存取金鑰 ID。
    • Secret Key (私密金鑰)：輸入 IAM 使用者的私密金鑰。
  7. 按一下「檢查端點」，確認 GitHub 可以連線至 Amazon S3 端點並寫入資料。
  8. 成功驗證端點後，請按一下「儲存」。

為 Google SecOps 建立唯讀 IAM 使用者和金鑰

  1. 依序前往 AWS 管理中心 > IAM > 使用者 > 新增使用者。
  2. 點選 [Add users] (新增使用者)。
  3. 請提供下列設定詳細資料：
    • 使用者：輸入 secops-reader。
    • 存取類型：選取「存取金鑰 - 程式輔助存取」。
  4. 按一下「建立使用者」。
  5. 附加最低讀取權限政策 (自訂)：依序選取「Users」>「secops-reader」>「Permissions」>「Add permissions」>「Attach policies directly」>「Create policy」。

  6. JSON：

    {
"Version": "2012-10-17",
"Statement": [
    {
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::github-audit-logs/*"
    },
    {
    "Effect": "Allow",
    "Action": ["s3:ListBucket"],
    "Resource": "arn:aws:s3:::github-audit-logs"
    }
]
}

  7. Name = secops-reader-policy。

  8. 依序點選「建立政策」> 搜尋/選取 >「下一步」>「新增權限」。

  9. 為 secops-reader 建立存取金鑰：依序點選「安全憑證」「存取金鑰」「建立存取金鑰」 下載 .CSV (您會將這些值貼到動態饋給中)。

在 Google SecOps 中設定資訊提供，以便擷取 GitHub 記錄

  1. 依序前往「SIEM 設定」>「動態饋給」。
  2. 按一下「+ 新增動態消息」。
  3. 在「動態饋給名稱」欄位中輸入動態饋給名稱 (例如 GitHub audit logs)。
  4. 選取「Amazon S3 V2」做為「來源類型」。
  5. 選取「GitHub」做為「記錄類型」。
  6. 點選「下一步」。
  7. 指定下列輸入參數的值：
    • S3 URI：s3://github-audit-logs/
    • 來源刪除選項：根據偏好設定選取刪除選項。
    • 檔案存在時間上限：包含在過去天數內修改的檔案。預設值為 180 天。
    • 存取金鑰 ID：具有 S3 儲存空間存取權的使用者存取金鑰。
    • 存取密鑰：具有 S3 bucket 存取權的使用者私密金鑰。
    • 資產命名空間：資產命名空間。
    • 擷取標籤：套用至這個動態饋給事件的標籤。
  8. 點選「下一步」。
  9. 在「Finalize」(完成) 畫面中檢查新的動態饋給設定，然後按一下「Submit」(提交)。

事件類型

下表列出事件類型和事件類型的條件：

event_type 條件
NETWORK_CONNECTION [has_target] == "true" && [has_principal] == "true"
PROCESS_LAUNCH [has_principal] == "true" && [has_target_process] == "true"
STATUS_UPDATE [has_principal] == "true"
USER_LOGIN [raw][message] =~ "Authentication success" or [message] =~ "Authentication success" && ([has_target]== "true" || [has_target_user] == "true")
USER_RESOURCE_CREATION [has_target_resource] == "true" && [has_principal_userid] == "true" && [action] in ["personal_access_token.create" ,"repository_vulnerability_alert.create"]
USER_RESOURCE_DELETION [has_target_resource] == "true" && [has_principal_user] == "true" && [action] in ["hook.destroy" ,"protected_branch.destroy" ,"public_key.delete"]
USER_RESOURCE_DELETION [has_target_resource] == "true" && [has_principal_userid] == "true" && [action] in [ "hook.destroy" ,"protected_branch.destroy" ,"public_key.delete"]
USER_RESOURCE_UPDATE_CONTENT [has_target_resource] == "true" && [has_principal_userid] == "true" && [action] in [ "pull_request.merge" , "hook.events_changed"]
USER_RESOURCE_UPDATE_PERMISSIONS [has_target_resource] == "true" && [has_principal_userid] == "true" && [action] in ["repo.update_actions_secret","protected_branch.update_pull_request_reviews_enforcement_level", "org.update_member" ,"protected_branch.update_admin_enforced" ,"protected_branch.update_required_status_checks_enforcement_level","org.integration_manager_removed" ,"repo.update_member", "repo.add_member"]
USER_UNCATEGORIZED [has_principal_userid] == "true"

UDM 對應表

記錄欄位 UDM 對應 附註
above_lock_quota additional.fields
above_warn_quota additional.fields
ac_ms additional.fields
accept additional.fields
action metadata.product_event_type 適用於 JSON 記錄。
action security_result.summary 適用於系統記錄檔記錄。
active target.resource.attribute.labels
active_job_id additional.fields
actor principal.user.userid
actor_id principal.user.attribute.labels.value
actor_ip principal.ip
actor_is_agent additional.fields
actor_is_bot principal.user.attribute.labels
actor_location.country_code principal.location.country_or_region
actor_session additional.fields
additional_list additional.fields
additional_string additional.fields
after additional.fields
alert_id security_result.detection_fields
alert_number security_result.detection_fields
alert_numbers additional.fields
allow_deletions_enforcement_level additional.fields
allow_force_pushes_enforcement_level additional.fields
allow_private_repository_forking additional.fields
application_name target.application
aqueduct_job_id additional.fields
auth_tries additional.fields
babeld additional.fields
banner additional.fields
before additional.fields
best_cipher additional.fields
best_kex additional.fields
best_mac additional.fields
best_sigtype additional.fields
Body security_result.description
branch target.resource.attribute.labels
branches target.resource.attribute.labels
business additional.fields
business_id additional.fields
cactive additional.fields
calling_workflow_refs target.resource.attribute.labels
calling_workflow_shas target.resource.attribute.labels
changes.body.from additional.fields
charset additional.fields
check_run.app additional.fields
check_run.app.events additional.fields
check_run.app.owner additional.fields
check_run.check_suite.app.client_id additional.fields
check_run.check_suite.app.created_at additional.fields
check_run.check_suite.app.description additional.fields
check_run.check_suite.app.events additional.fields
check_run.check_suite.app.external_url additional.fields
check_run.check_suite.app.html_url additional.fields
check_run.check_suite.app.id additional.fields
check_run.check_suite.app.name additional.fields
check_run.check_suite.app.node_id additional.fields
check_run.check_suite.app.slug additional.fields
check_run.check_suite.app.updated_at additional.fields
check_run.check_suite.conclusion additional.fields
check_run.check_suite.id additional.fields
check_run.check_suite.url additional.fields
check_run.completed_at additional.fields
check_run.conclusion additional.fields
check_run.output additional.fields
check_run.started_at additional.fields
check_suite (所有子欄位) additional.fields
check_suite.app (所有子欄位) additional.fields
check_suite.app.events additional.fields
check_suite.app.owner (所有子欄位) additional.fields
check_suite.head_commit (所有子欄位) additional.fields
cid additional.fields
cipher network.tls.cipher
client_id principal.user.attribute.labels
cloning additional.fields
code additional.fields
CodeNamespace additional.fields
comment (所有子欄位) additional.fields
comment.performed_via_github_app (所有子欄位) additional.fields
comment.performed_via_github_app.events additional.fields
comment.reactions (所有子欄位) additional.fields
commit.author principal.resource.attribute.labels
commit.commit.author.date additional.fields
commit.commit.author.email additional.fields
commit.commit.author.name additional.fields
commit.commit.tree.url additional.fields
commit.commit.verification additional.fields
commit.committer additional.fields
commit.parents additional.fields
commit.sha additional.fields
commit.url additional.fields
commit_oid additional.fields
committer_date additional.fields
completed_at vulns.vulnerabilities.scan_end_time
config.content_typt target.resource.attribute.labels
config.insecure_ssl target.resource.attribute.labels
config.secret target.resource.attribute.labels
config.url target.url
considers.site.admin additional.fields
content_type target.file.mime_type
cr additional.fields
create_protected additional.fields
created_at metadata.event_timestamp 系統會將值從 UNIX 毫秒轉換為時間戳記。
credential detection_fields
ctotal additional.fields
data._document_id metadata.product_log_id
data.active_job_id additional.fields
data.aqueduct_job_id additional.fields
data.business target.administrative_domain
data.business_id additional.fields
data.cancelled_at extensions.vulns.vulnerabilities.scan_end_time 系統會將 ISO8601 格式的值轉換為時間戳記。
data.category_type security_result.category_details
data.dn additional.fields
data.email target.user.email_addresses
data.entry_found additional.fields
data.event target.resource.attribute.labels
data.events security_result.about.labels.value
data.head_branch target.resource.attribute.labels
data.head_sha target.file.sha256
data.hook_id target.resource.product_object_id
data.job target.application
data.operation_type additional.fields
data.started_at extensions.vulns.vulnerabilities.scan_start_time 系統會將 ISO8601 格式的值轉換為時間戳記。
data.team target.group.group_display_name
data.trigger_id target.resource.attribute.labels
data.uid additional.fields
data.workflow_id target.resource.attribute.labels
data.workflow_run_id target.resource.attribute.labels
default_new_repo_branch additional.fields
default_repo_visibility additional.fields
default_repository_permission additional.fields
degraded additional.fields
dependency_scope additional.fields
deployment.environment additional.fields
disable_members_can_create_repositories additional.fields
disable_members_can_delete_repositories additional.fields
disable_user_org_creation additional.fields
disk_info additional.fields
disk_py_file additional.fields
dismiss_stale_reviews_on_push additional.fields
dotcom_contributions additional.fields
dotcom_user_license_usage_upload additional.fields
duration_ms additional.fields
ecosystem additional.fields
enforcement_level additional.fields
enterprise principal.resource.attribute.labels
enterprise.name additional.fields.value.string_value
environment_name target.resource.attribute.labels
error additional.fields
external_id additional.fields
external_identity_nameid target.user.email_addresses 如果值是電子郵件地址，系統會將其新增至 target.user.email_addresses 陣列。
external_identity_nameid target.user.userid
external_identity_username additional.fields 如果 target.user.user_display_name 中未填入值，則會對應至 additional.fields。
external_identity_username target.user.user_display_name 如果 target.user.user_display_name 中填入值，系統就會對應該值。
features additional.fields
filtered additional.fields
filtered_request_body.query additional.fields
fluentbit_pod_name additional.fields
fp_sha256 additional.fields
frontend additional.fields
frontend_pid intermediary.process.pid
frontend_ppid intermediary.process.parent_process.pid
fs_host target.hostname
fsc_ms additional.fields
fully_qualified_domain_name additional.fields
gh.sdk.name additional.fields
gh.sdk.version additional.fields
gh.timerd.timer.name additional.fields
ghsa_id additional.fields
git.maxobjectsize additional.fields
git_dir_safe target.resource.attribute.labels
github_event_after target.resource.attribute.labels
github_event_before target.resource.attribute.labels
github_event_compare target.resource.attribute.labels
github_event_created target.resource.attribute.labels
github_event_deleted target.resource.attribute.labels
github_event_forced target.resource.attribute.labels
github_event_head_commit_author_email target.resource.attribute.labels
github_event_head_commit_author_name target.resource.attribute.labels
github_event_head_commit_author_username target.resource.attribute.labels
github_event_head_commit_committer_email target.resource.attribute.labels
github_event_head_commit_committer_name target.resource.attribute.labels
github_event_head_commit_committer_username target.resource.attribute.labels
github_event_head_commit_distinct target.resource.attribute.labels
github_event_head_commit_msg1 target.resource.attribute.labels
github_event_head_commit_timestamp target.resource.attribute.labels
github_event_pusher_email target.resource.attribute.labels
github_event_pusher_name target.resource.attribute.labels
github_event_ref target.resource.attribute.labels
github_event_repository_has_projects target.resource.attributes.labels
github_event_repository_master_branch target.resource.attribute.labels
github_event_repository_organization target.resource.attribute.labels
github_event_repository_owner_name target.resource.attribute.labels
github_event_repository_stargazers target.resource.attribute.labels
github_event_workflow_job_completed_at target.resource.attributes.labels
gpv additional.fields
handler_code additional.fields
hashed_token network.session_id
head_branch target.resource.attribute.labels
head_sha target.file.sha256
healthy additional.fields
hmac additional.fields
hook_id target.resource.attribute.labels
host.name principal.user.attribute.labels
http_version network.application_protocol_version
id metadata.product_log_id
ignore_approvals_from_contributors additional.fields
imode additional.fields
imperfect additional.fields
InstrumentationScope additional.fields
integration_id additional.fields
intel.flat additional.fields
is_hosted_runner target.resource.attribute.labels
issue (所有子欄位) additional.fields
issue.pull_request (所有子欄位) additional.fields
job_name target.resource.attribute.labels.value
job_workflow_ref target.resource.attribute.labels.value
job_workflow_sha target.resource.attribute.labels.value
kafka_cluster additional.fields
kex additional.fields
keytype additional.fields
kubernetes.container_image principal.resource.attribute.labels
kubernetes.container_name principal.resource.attribute.labels
kubernetes.host principal.resource.attribute.labels
kubernetes.labels.app principal.resource.attribute.labels
kubernetes.labels.chart principal.resource.attribute.labels
kubernetes.labels.component principal.resource.attribute.labels
kubernetes.labels.heritage principal.resource.attribute.labels
kubernetes.labels.pod-template-hash principal.resource.attribute.labels
kubernetes.labels.release principal.resource.attribute.labels
kubernetes.labels.system principal.resource.attribute.labels
kubernetes.namespace_name principal.resource.attribute.labels
kubernetes.pod_ip principal.ip、
principal.asset.ip
kubernetes.pod_name principal.resource.attribute.labels
last_state_change_at additional.fields
last_state_change_reason additional.fields
lat principal.location.region_coordinates.latitude
ldap.debug_logging_enabled additional.fields
level security_result.severity
lfs_auth_scope additional.fields
lfs_deploy_key_header additional.fields
lfs_verify_reason additional.fields
linear_history_requirement_enforcement_level additional.fields
lock_allows_fetch_and_merge additional.fields
lock_branch_enforcement_level additional.fields
log_level security_result.severity
log_source additional.fields
log_source_file target.file.full_path
logData.Count additional.fields
logData.Metrics.* additional.fields 星號 (*) 表示這包括所有子欄位。
logType additional.fields
lon principal.location.region_coordinates.longitude
loop additional.fields
matched_policies security_result.detection_fields
member target.user.attribute.labels
merge_queue_enforcement_level additional.fields
method additional.fields
multi_repo security_result.detection_fields
mysql_component additional.fields
mysql_warning_code additional.fields
name target.resource.attribute.labels
non_integer_id additional.fields
ns additional.fields
number additional.fields
oauth_application principal.application
oauth_application_id principal.resource.attribute.labels
oauth_party additional.fields
offset additional.fields
old_permissions additional.fields
old_repo_permissions additional.fields
org target.administrative_domain
org_id additional.fields.value.string_value
organization.url additional.fields
original_user_agent additional.fields
overridden_codes additional.fields
owner principal.user.user_display_name
owner_id principal.user.userid
package additional.fields
package_name target.application
parent additional.fields
parent_installation_id additional.fields
partition additional.fields
path_info additional.fields 這是路徑已對應至 target.file.full_path 時的對應。
path_info target.file.full_path 如果路徑尚未對應至 target.file.full_path，就會使用這個對應。
pgroup additional.fields
pk_ms additional.fields
prin_ip principal.ip、
principal.asset.ip
prin_port principal.port
prin_usr principal.user.userid
pro_pid target.process.pid
probe_fail additional.fields
probe_ok additional.fields
programmatic_access_type additional.fields.value.string_value
pubkey_creator_id additional.fields
pubkey_creator_login additional.fields
pubkey_fingerprint additional.fields
pubkey_id additional.fields
pubkey_verifier_id additional.fields
pubkey_verifier_login additional.fields
public_repo additional.fields.value.string_value
public_repo target.location.name
publicly_leaked security_result.detection_fields
pull_request.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request._links.comments.href additional.fields
pull_request._links.commits.href additional.fields
pull_request._links.html.href additional.fields
pull_request._links.issue.href additional.fields
pull_request._links.review_comment.href additional.fields
pull_request._links.review_comments.href additional.fields
pull_request._links.self.href additional.fields
pull_request._links.statuses.href additional.fields
pull_request.base.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.base.repo.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.base.repo.owner.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.head.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.head.owner.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.head.repo.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.head.user.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.requested_reviewers.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.requested_teams.* additional.fields 星號 (*) 表示這包括所有子欄位。
pull_request.user. (及其所有子欄位，但 login 除外) principal.user.attribute.labels
pull_request.user.login principal.user.user_display_name
pull_request_id target.resource.attribute.labels
pull_request_title target.resource.attribute.labels
query_string additional.fields.value.string_value
queue_duration additional.fields
quotas_enabled additional.fields
rate_limit additional.fields
rate_limit_family additional.fields
rate_limit_key additional.fields
rate_limit_remaining additional.fields.value.string_value
rate_limit_reset additional.fields
rate_limit_used additional.fields
raw.at additional.fields
raw.hashed_token network.session_id
raw.token_type additional.fields
raw.url target.url
raw.user_agent network.http.user_agent、
network.http.parsed_user_agent
raw_login additional.fields
read_only additional.fields
readonly additional.fields
reasons additional.fields
ref target.resource.attribute.labels
replicas additional.fields
repo target.resource.name
repo_id additional.fields.value.string_value
repo_owner_login target.resource.attribute.labels
repo_owner_type target.resource.attribute.labels
repo_public additional.fields
repository target.resource.attribute.labels
repository.archive_url target.resource.attribute.labels
repository.assignees_url target.resource.attribute.labels
repository.blobs_url target.resource.attribute.labels
repository.branches_url target.resource.attribute.labels
repository.clone_url target.resource.attribute.labels
repository.collaborators_url target.resource.attribute.labels
repository.comments_url target.resource.attribute.labels
repository.commits_url target.resource.attribute.labels
repository.compare_url target.resource.attribute.labels
repository.contents_url target.resource.attribute.labels
repository.contributors_url target.resource.attribute.labels
repository.created_at target.resource.attribute.labels
repository.custom_properties. (和所有子欄位) target.resource.attribute.labels
repository.deployments_url target.resource.attribute.labels
repository.downloads_url target.resource.attribute.labels
repository.events_url target.resource.attribute.labels
repository.fork target.resource.attribute.labels
repository.forks_url target.resource.attribute.labels
repository.full_name target.resource.attribute.labels
repository.git_commits_url target.resource.attribute.labels
repository.git_refs_url target.resource.attribute.labels
repository.git_tags_url target.resource.attribute.labels
repository.git_url target.resource.attribute.labels
repository.homepage target.resource.attributes.labels
repository.hooks_url target.resource.attribute.labels
repository.html_url target.resource.attribute.labels
repository.id target.resource.attribute.labels
repository.issue_comment_url target.resource.attribute.labels
repository.issue_events_url target.resource.attribute.labels
repository.issues_url target.resource.attribute.labels
repository.keys_url target.resource.attribute.labels
repository.labels_url target.resource.attribute.labels
repository.languages_url target.resource.attribute.labels
repository.license target.resource.attributes.labels
repository.merges_url target.resource.attribute.labels
repository.milestones_url target.resource.attribute.labels
repository.mirror_url target.resource.attributes.labels
repository.name target.resource.attribute.labels
repository.node_id target.resource.attribute.labels
repository.notifications_url target.resource.attribute.labels
repository.open_issues_count target.resource.attribute.labels
repository.owner.avatar_url target.resource.attribute.labels
repository.owner.events_url target.resource.attribute.labels
repository.owner.followers_url target.resource.attribute.labels
repository.owner.following_url target.resource.attribute.labels
repository.owner.gists_url target.resource.attribute.labels
repository.owner.gravatar_id target.resource.attribute.labels
repository.owner.html_url target.resource.attribute.labels
repository.owner.id target.resource.attribute.labels
repository.owner.node_id target.resource.attribute.labels
repository.owner.organizations_url target.resource.attribute.labels
repository.owner.received_events_url target.resource.attribute.labels
repository.owner.repos_url target.resource.attribute.labels
repository.owner.site_admin target.resource.attribute.labels
repository.owner.starred_url target.resource.attribute.labels
repository.owner.subscriptions_url target.resource.attribute.labels
repository.owner.type target.resource.attribute.labels
repository.owner.url target.resource.attribute.labels
repository.owner.user_view_type target.resource.attribute.labels
repository.private target.resource.attribute.labels
repository.pulls_url target.resource.attribute.labels
repository.pushed_at target.resource.attribute.labels
repository.releases_url target.resource.attribute.labels
repository.size target.resource.attribute.labels
repository.ssh_url target.resource.attribute.labels
repository.stargazers_url target.resource.attribute.labels
repository.statuses_url target.resource.attribute.labels
repository.subscribers_url target.resource.attribute.labels
repository.subscription_url target.resource.attribute.labels
repository.svn_url target.resource.attribute.labels
repository.tags_url target.resource.attribute.labels
repository.teams_url target.resource.attribute.labels
repository.topics target.resource.attributes.labels
repository.trees_url target.resource.attribute.labels
repository.updated_at target.resource.attribute.labels
repository.url target.resource.attribute.labels
repository.visibility target.resource.attribute.labels
repository_public target.resource.attribute.labels
req_content_type target.file.mime_type
request_access_security_header security_result.detection_fields
request_auth additional.fields
request_body additional.fields.value.string_value
request_duration additional.fields
request_host principal.ip、
principal.asset.ip		 如果存在 IP 位址，則會對應至 principal.ip (保留 principal.hostname 的現有對應)。
request_method network.http.method 這個值會轉換為大寫。
requested_reviewers.* additional.fields 星號 (*) 表示這包括所有子欄位。
require_code_owner_review additional.fields
require_last_push_approval additional.fields
required_approving_review_count additional.fields
required_deployments_enforcement_level additional.fields
required_review_thread_resolution_enforcement_level additional.fields
rerun_type additional.fields
res_type target.resource.resource_subtype
response_time additional.fields
review_id target.resource.attributes.labels
route additional.fields.value.string_value
rpc.jsonrpc.error_code network.http.response_code
rpc.jsonrpc.error_message security_result.summary
rule_suite_id security_result.rule_id
run_attempt additional.fields
run_number additional.fields
runner_labels target.resource.attribute.labels
runner_owner_type target.resource.attribute.labels
runner_tenant_id target.resource.attribute.labels
s3_tag additional.fields
secret_type security_result.detection_fields
secret_types security_result.detection_fields
secrets_passed security_result.detection_fields
sender.id src.user.product_object_id
sender.login src.user.user_display_name
sender.node_id src.asset_id
sender.type src.user.title
sender.url src.url
service target.resource.name
service.version additional.fields
serviceName target.resource.name
severity (如果很高) security_result.severity
SeverityText security_result.severity
shallow additional.fields
sign_in_verification_method security_result.detection_fields
signature_requirement_enforcement_level additional.fields
sigtype additional.fields
source src.resource.name
spec additional.fields
sr additional.fields
ss additional.fields
started_at vulns.vulnerabilities.scan_start_time
stateless additional.fields
status_code network.http.response_code
strict_required_status_checks_policy additional.fields
subject.business.id target.resource.attribute.labels
subject.owner.id additional.fields
subject.owning_organization.id principal.group.product_object_id
subject.repository.id target.resource.product_object_id
subject.repository.internal target.resource.attribute.labels
subject.repository.owner.id additional.fields
subject.repository.public target.resource.attribute.labels
subject.repository.writable target.resource.attribute.labels
subject.type target.resource.attribute.labels
synthetic_status additional.fields
tar_application target.application
telemetry.sdk.name additional.fields
tenant_id target.resource.attribute.labels
tid additional.fields
time metadata.event_timestamp
time_duration_ms additional.fields
time_zone additional.fields
timestamp metadata.event_timestamp
tls_version network.tls.version
token_id additional.fields.value.string_value
token_scopes additional.fields.value.string_value
topic additional.fields
total additional.fields
transport_protocol additional.fields
transport_protocol_name network.application_protocol 這個值會轉換為大寫。
ts metadata.event_timestamp process_type為 github_production 時。
TTY additional.fields
twirp_method additional.fields
twirp_package additional.fields
twirp_service additional.fields
twirp_status network.http.response_code
two_factor_type security_result.detection_fields
type additional.fields
unavailable additional.fields
updated_at metadata.collected_timestamp
url_path target.url
usage_metrics additional.fields
user target.user.userid
user.id target.user.attr.labels 如果 actor.id 存在。
user.id target.user.userid 沒有 actor.id 時。
user_agent network.http.parsed_user_agent 系統會剖析該值。
user_agent network.http.user_agent
user_id target.user.userid
user_operator_mode additional.fields
user_programmatic_access_id additional.fields
user_renaming_enabled additional.fields
user_spammy additional.fields
version metadata.product_version 這項對應包含 JSON 記錄。
visibility additional.fields
vk_ms additional.fields
vulnerability_id additional.fields
vulnerable_version_range_id additional.fields
workflow target.resource.attributes.labels
workflow.name target.resource.attribute.labels
workflow_id target.resource.attribute.labels
workflow_job.head_branch security_result.detection_fields
workflow_job.name target.resource.attributes.labels
workflow_job.workflow_name security_result.detection_fields
workflow_run.actor. (以及所有子欄位，但每個子欄位中包含的 login 欄位除外) principal.user.attribute.labels
workflow_run.actor.login principal.user.userid
workflow_run.artifacts_url target.resource.attributes.labels
workflow_run.cancel_url target.resource.attributes.labels
workflow_run.check_suite_id additional.fields
workflow_run.check_suite_node_id additional.fields
workflow_run.check_suite_url target.resource.attributes.labels
workflow_run.conclusion target.resource.attribute.labels
workflow_run.created_at metadata.event_timestamp
workflow_run.display_title target.resource.attribute.labels
workflow_run.event additional.fields.value.string_value
workflow_run.event target.resource.attribute.labels
workflow_run.head_branch target.resource.attribute.labels
workflow_run.head_commit target.resource.attributes.labels
workflow_run.head_repository additional.fields
workflow_run.head_sha target.file.sha256
workflow_run.html_url target.resource.attribute.labels
workflow_run.id target.resource.attribute.labels.value
workflow_run.jobs_url target.resource.attributes.labels
workflow_run.logs_url target.resource.attributes.labels
workflow_run.name target.resource.name
workflow_run.node_id target.resource.product_object_id
workflow_run.path target.resource.attribute.labels
workflow_run.previous_attempt_url target.resource.attributes.labels
workflow_run.pull_requests about.resource.attribute.labels
workflow_run.repository additional.fields
workflow_run.rerun_url target.resource.attributes.labels
workflow_run.run_attempt target.resource.attribute.labels
workflow_run.run_number target.resource.attribute.labels
workflow_run.run_started_at target.resource.attribute.labels
workflow_run.status security_result.description
workflow_run.triggering_actor additional.fields
workflow_run.updated_at metadata.collected_timestamp
workflow_run.url target.url
workflow_run.workflow_id security_result.about.labels.value
workflow_run.workflow_id target.resource.attribute.labels
workflow_run.workflow_url target.resource.attributes.labels

版本差異參考資料

Google SecOps 於 2026 年 1 月 8 日發布新版 GitHub 剖析器，其中包含重大變更。

記錄欄位對應差異

下表列出 2026 年 1 月 8 日前後，GitHub 記錄公開至 UDM 欄位的對應差異 (分別列於「舊版對應」和「目前對應」欄位)：

記錄欄位 舊對應 目前對應
action (適用於 JSON 記錄) metadata.product_event_type, security_result.summary,security_result.detection_fields metadata.product_event_type
action (適用於 Syslog 記錄) additional.fields, security_result.summary security_result.summary
business additional.fields, target.user.company_name additional.fields
business_id target.resource.attribute.labels additional.fields
data.email target.email target.user.email_addresses
data.event security_result.about.labels target.resource.attribute.labels
data.head_branch security_result.about.labels target.resource.attribute.labels
data.hook_id target.resource.attribute.labels target.resource.product_object_id
data.team target.user.group_identifiers target.group.group_display_name
data.trigger_id security_result.about.labels target.resource.attribute.labels
data.workflow_id security_result.about.labels target.resource.attribute.labels
data.workflow_run_id security_result.about.labels target.resource.attribute.labels
hashed_token additional.fields network.session_id
hook_id (適用於 JSON 記錄) additional.fields target.resource.attribute.labels
name additional.fields target.resource.attribute.labels
oauth_application_id additional.fields principal.resource.attribute.labels
pull_request_id additional.fields target.resource.attribute.labels
pull_request_title additional.fields target.resource.attribute.labels
repository.archive_url additional.fields target.resource.attribute.labels
repository.assignees_url additional.fields target.resource.attribute.labels
repository.blobs_url additional.fields target.resource.attribute.labels
repository.branches_url additional.fields target.resource.attribute.labels
repository.clone_url additional.fields target.resource.attribute.labels
repository.collaborators_url additional.fields target.resource.attribute.labels
repository.comments_url additional.fields target.resource.attribute.labels
repository.commits_url additional.fields target.resource.attribute.labels
repository.compare_url additional.fields target.resource.attribute.labels
repository.contents_url additional.fields target.resource.attribute.labels
repository.contributors_url additional.fields target.resource.attribute.labels
repository.created_at additional.fields target.resource.attribute.labels
repository.deployments_url additional.fields target.resource.attribute.labels
repository.downloads_url additional.fields target.resource.attribute.labels
repository.events_url additional.fields target.resource.attribute.labels
repository.fork additional.fields target.resource.attribute.labels
repository.forks_url additional.fields target.resource.attribute.labels
repository.full_name additional.fields target.resource.attribute.labels
repository.git_commits_url additional.fields target.resource.attribute.labels
repository.git_refs_url additional.fields target.resource.attribute.labels
repository.git_tags_url additional.fields target.resource.attribute.labels
repository.git_url additional.fields target.resource.attribute.labels
repository.hooks_url additional.fields target.resource.attribute.labels
repository.html_url additional.fields target.resource.attribute.labels
repository.id additional target.resource.attribute.labels
repository.issue_comment_url additional.fields target.resource.attribute.labels
repository.issue_events_url additional.fields target.resource.attribute.labels
repository.issues_url additional.fields target.resource.attribute.labels
repository.keys_url additional.fields target.resource.attribute.labels
repository.labels_url additional.fields target.resource.attribute.labels
repository.languages_url additional.fields target.resource.attribute.labels
repository.merges_url additional.fields target.resource.attribute.labels
repository.milestones_url additional.fields target.resource.attribute.labels
repository.name additional.fields target.resource.attribute.labels
repository.node_id additional.fields target.resource.attribute.labels
repository.notifications_url additional.fields target.resource.attribute.labels
repository.owner.avatar_url additional.fields target.resource.attribute.labels
repository.owner.events_url additional.fields target.resource.attribute.labels
repository.owner.followers_url additional.fields target.resource.attribute.labels
repository.owner.following_url additional.fields target.resource.attribute.labels
repository.owner.gists_url additional.fields target.resource.attribute.labels
repository.owner.gravatar_id additional.fields target.resource.attribute.labels
repository.owner.html_url additional.fields target.resource.attribute.labels
repository.owner.id additional.fields target.resource.attribute.labels
repository.owner.node_id additional.fields target.resource.attribute.labels
repository.owner.organizations_url additional.fields target.resource.attribute.labels
repository.owner.received_events_url additional.fields target.resource.attribute.labels
repository.owner.repos_url additional.fields target.resource.attribute.labels
repository.owner.site_admin additional.fields target.resource.attribute.labels
repository.owner.starred_url additional.fields target.resource.attribute.labels
repository.owner.subscriptions_url additional.fields target.resource.attribute.labels
repository.owner.type additional.fields target.resource.attribute.labels
repository.owner.url additional.fields target.resource.attribute.labels
repository.owner.user_view_type additional.fields target.resource.attribute.labels
repository.private additional.fields target.resource.attribute.labels
repository.pulls_url additional.fields target.resource.attribute.labels
repository.pushed_at additional.fields target.resource.attribute.labels
repository.releases_url additional.fields target.resource.attribute.labels
repository.size additional.fields target.resource.attribute.labels
repository.ssh_url additional.fields target.resource.attribute.labels
repository.stargazers_url additional.fields target.resource.attribute.labels
repository.statuses_url additional.fields target.resource.attribute.labels
repository.subscribers_url additional.fields target.resource.attribute.labels
repository.subscription_url additional.fields target.resource.attribute.labels
repository.svn_url additional.fields target.resource.attribute.labels
repository.tags_url additional.fields target.resource.attribute.labels
repository.teams_url additional.fields target.resource.attribute.labels
repository.trees_url additional.fields target.resource.attribute.labels
repository.updated_at additional.fields target.resource.attribute.labels
repository.url additional.fields target.resource.attribute.labels
repository.visibility additional.fields target.resource.attribute.labels
repository_public additional.fields target.resource.attribute.labels
res_type target.resource.type target.resource.resource_subtype
sender.id src.user.product_object_id, additional.fields src.user.product_object_id
sender.login additional.fields, src.user.user_display_name src.user.user_display_name
sender.node_id src.asset_id, additional.fields src.asset_id
sender.type src.user.title, additional.fields src.user.title
sender.url src.url, additional.fields src.url
workflow.name security_result.about.labels target.resource.attribute.labels
workflow_job.head_branch security_result.about.labels security_result.detection_fields
workflow_job.workflow_name security_result.about.labels security_result.detection_fields
workflow_run.event additional.fields target.resource.attribute.labels
workflow_run.head_branch security_result.about.labels target.resource.attribute.labels
workflow_run.workflow_id security_result.about.labels target.resource.attribute.labels

事件類型條件差異

2026 年 1 月 8 日發布的版本變更了決定 Google SecOps 事件類型的條件。

下表列出事件類型和目前條件 (也就是 2026 年 1 月 8 日發布前的情況)：

event_type 條件
NETWORK_CONNECTION [has_target] == "true" && [has_principal] == "true"
STATUS_UPDATE [has_principal] == "true"
USER_RESOURCE_DELETION [has_target_resource] == "true" && [has_principal_user] == "true" && [action] in ["hook.destroy" ,"protected_branch.destroy" ,"public_key.delete"]
USER_RESOURCE_UPDATE_CONTENT [has_target_resource] == "true" && [has_principal_userid] == "true" && [action] in [ "pull_request.merge" , "hook.events_changed"]
USER_RESOURCE_UPDATE_PERMISSIONS [has_target_resource] == "true" && [has_principal_userid] == "true" && [action] in ["repo.update_actions_secret","protected_branch.update_pull_request_reviews_enforcement_level", "org.update_member" ,"protected_branch.update_admin_enforced" ,"protected_branch.update_required_status_checks_enforcement_level","org.integration_manager_removed" ,"repo.update_member", "repo.add_member"]

按鍵對應差異

下表列出原始記錄欄位中的鍵，與 2026 年 1 月 8 日前和之後公開的 UDM 欄位中的鍵之間的對應差異 (分別列於「舊鍵」和「目前鍵」欄中)：

原始記錄中的金鑰 舊金鑰 目前的金鑰
alert.secret_type_display_name secret_type_display_name alert_secret_type_display_name
enterprise.name Enterprise Name enterprise_name
hook_id Hook Id Hook_Id
invitation.failed_at failed_at invitation_failed_at
invitation.failed_reason failed_reason invitation_failed_reason
invitation.invitation_source invitation_source invitation_invitation_source
raw.failure_reason failure_reason raw_failure_reason
raw.failure_type failure_type raw_failure_type
raw.from from raw_from
workflow_run.event event workflow_run_event
workflow_run.head_branch Head Branch Head_Branch
workflow_run.id workflow_run_id workflow_Run_id
workflow_run.workflow_id Workflow Id Workflow_Id

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。