Collecter les journaux de télémétrie Jamf Protect

Compatible avec :

Google secops SIEM

Ce document explique comment collecter les journaux de télémétrie Jamf Protect en configurant un flux Google Security Operations et comment les champs de journal sont mappés aux champs du modèle de données unifié (UDM) de Google Security Operations. Ce document répertorie également la version de télémétrie Jamf Protect compatible.

Pour en savoir plus, consultez Ingestion de données dans Google Security Operations.

Un déploiement typique comprend la télémétrie Jamf Protect et le flux Google Security Operations configuré pour envoyer des journaux à Google Security Operations. Chaque déploiement client peut être différent et plus complexe.

Le déploiement contient les composants suivants :

• Télémétrie Jamf Protect : plate-forme de télémétrie Jamf Protect à partir de laquelle vous collectez des journaux.

• Flux Google Security Operations : flux Google Security Operations qui récupère les journaux de la télémétrie Jamf Protect et les écrit dans Google Security Operations.

• Google Security Operations : Google Security Operations conserve et analyse les journaux de la télémétrie Jamf Protect.

Un libellé d'ingestion identifie l'analyseur qui normalise les données de journal brutes au format UDM structuré. Les informations de ce document s'appliquent à l'analyseur avec le libellé d'ingestion JAMF_TELEMETRY.

Avant de commencer

Assurez-vous de remplir les conditions suivantes :

• Configuration de la télémétrie Jamf Protect
• Jamf Protect version 4.0.0 ou ultérieure
• Tous les systèmes de l'architecture de déploiement sont configurés avec le fuseau horaire UTC.

Configurer des flux à partir de Paramètres SIEM > Flux

Vous pouvez utiliser Amazon S3 V2 ou un webhook pour configurer un flux d'ingestion dans Google Security Operations.

Configurer un flux d'ingestion dans Google SecOps à l'aide d'Amazon S3 V2

1. Accédez à Paramètres SIEM > Flux.
2. Cliquez sur Ajouter un flux.
3. Cliquez sur le pack de flux JAMF.
4. Localisez le type de journal Télémétrie Jamf Protect.
5. Sélectionnez Amazon S3 V2 comme Type de source.

6. Spécifiez des valeurs pour les champs suivants :

   • URI S3 : URI du bucket.
     • s3://your-log-bucket-name/
       • Remplacez your-log-bucket-name par le nom réel de votre bucket S3.
   • Options de suppression de la source : sélectionnez l'option de suppression en fonction de vos préférences d'ingestion.
   • ID de clé d'accès : clé d'accès de l'utilisateur avec les autorisations de lecture à partir du bucket S3.
   • Âge maximal du fichier : inclut les fichiers modifiés au cours des derniers jours. La valeur par défaut est de 180 jours.
   • Clé d'accès secrète : clé secrète de l'utilisateur avec les autorisations de lecture à partir du bucket S3.

   Options avancées

   • Nom du flux : valeur préremplie qui identifie le flux.
   • Espace de noms de l'élément : espace de noms associé au flux.
   • Libellés d'ingestion : libellés appliqués à tous les événements de ce flux.

7. Cliquez sur Créer un flux.

Configurer un flux d'ingestion dans Google SecOps à l'aide d'un webhook

1. Accédez à Paramètres SIEM > Flux.
2. Cliquez sur Ajouter un flux.
3. Cliquez sur le pack de flux JAMF.
4. Localisez le type de journal Télémétrie Jamf Protect.
5. Dans la liste Type de source, sélectionnez Webhook.
6. Spécifiez des valeurs pour les champs suivants :
   • Délimiteur de division : délimiteur utilisé pour séparer les lignes de journal, par exemple \n.
   • Espace de noms de l'élément : espace de noms de l'élément.
   • Libellés d'ingestion : libellé à appliquer aux événements de ce flux.
7. Cliquez sur Créer un flux.

Pour configurer plusieurs flux pour différents types de journaux au sein de cette famille de produits, consultez Configurer des flux par produit.

Créer une clé API pour un flux de webhook

1. Accédez à Google Cloud console > Identifiants.

   Accéder à "Identifiants"

2. Cliquez sur Créer des identifiants, puis sélectionnez Clé API.

3. Restreignez l'accès de la clé API à l'API Google Security Operations.

Configurer la télémétrie Jamf Protect pour un flux de webhook

1. Dans l'application de télémétrie Jamf Protect, accédez à la configuration de l'action associée.
2. Pour ajouter un point de terminaison de données, cliquez sur Créer des actions.
3. Sélectionnez HTTP comme protocole.
4. Saisissez l'URL HTTPS du point de terminaison de l'API Google Security Operations dans le champ URL. (Il s'agit du champ Informations sur le point de terminaison que vous avez copié à partir de la configuration du flux de webhook. Il est déjà au format requis.)

5. Activez l'authentification en spécifiant la clé API et la clé secrète dans l'en-tête personnalisé au format suivant :

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   Recommandation : spécifiez la clé API en tant qu'en-tête au lieu de la spécifier dans l'URL. Si votre client webhook n'est pas compatible avec les en-têtes personnalisés, vous pouvez spécifier la clé API et la clé secrète à l'aide de paramètres de requête au format suivant :

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

   Remplacez les éléments suivants :

   • ENDPOINT_URL : URL du point de terminaison du flux.
   • API_KEY : clé API pour s'authentifier auprès de Google Security Operations.
   • SECRET : clé secrète que vous avez générée pour authentifier le flux.

6. Dans la section Collecter les journaux, sélectionnez Télémétrie.

7. Cliquez sur Envoyer.

Pour en savoir plus sur les flux Google Security Operations, consultez la documentation sur les flux Google Security Operations. Pour en savoir plus sur les exigences de chaque type de flux, consultez Configuration des flux par type.

Si vous rencontrez des problèmes lors de la création de flux, contactez l'assistance Google Security Operations.

Types de journaux de télémétrie Jamf Protect compatibles

L'analyseur de télémétrie Jamf Protect est compatible avec les types de journaux suivants :

Event Type

• AUE_add_to_group
• AUE_AUDITCTL
• AUE_AUDITON_SPOLICY
• AUE_AUTH_USER
• AUE_BIND
• AUE_BIOS_FIRMWARE_VERSIONS
• AUE_CHDIR
• AUE_CHROOT
• AUE_CONNECT
• AUE_create_group
• AUE_delete_group
• AUE_create_user
• AUE_delete_user
• AUE_EXECVE
• AUE_EXIT
• AUE_FORK
• AUE_GETAUID
• AUE_KILL
• AUE_LISTEN
• AUE_LOGOUT
• AUE_LW_LOGIN
• AUE_MAC_SET_PROC
• AUE_modify_group
• AUE_modify_password
• AUE_modify_user
• AUE_MOUNT
• AUE_openssh
• AUE_PIDFORTASK
• AUE_POSIX_SPAWN
• AUE_REMOVE_FROM_GROUP
• AUE_SESSION_CLOSE
• AUE_SESSION_END
• AUE_SESSION_START
• AUE_SESSION_UPDATE
• AUE_SETPRIORITY
• AUE_SETSOCKOPT
• AUE_SETTIMEOFDAY
• AUE_SHUTDOWN
• AUE_SOCKETPAIR
• AUE_SSAUTHINT
• AUE_SSAUTHMECH
• AUE_SSAUTHORIZE
• AUE_TASKFORPID
• AUE_TASKNAMEFORPID
• AUE_UNMOUNT
• AUE_WAIT4
• PLAINTEXT_LOG_COLLECTION_EVENT
• SYSTEM_PERFORMANCE_METRICS

Formats de journaux de télémétrie Jamf Protect compatibles

L'analyseur de télémétrie Jamf Protect est compatible avec les journaux au format JSON.

Exemples de journaux de télémétrie Jamf Protect compatibles

• JSON

  {
    "exec_chain": {
      "uuid": "F6095AEA-C5CB-4AAB-8FC7-70B9D454319E"
    },
    "exec_chain_child": {
      "parent_path": "/sbin/launchd",
      "parent_pid": 1,
      "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02"
    },
    "header": {
      "time_seconds_epoch": 1657906179,
      "time_milliseconds_offset": 848,
      "version": 11,
      "event_modifier": 0,
      "event_id": 45018,
      "event_name": "AUE_add_to_group"
    },
    "host_info": {
      "serial_number": "C03WG0H4HDTS",
      "host_name": "Test_MacBook_Pro",
      "osversion": "Version 12.4 (Build 21F79)",
      "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
    },
    "identity": {
      "signer_id": "dummy.domain.opendirectoryd",
      "team_id_truncated": false,
      "signer_id_truncated": false,
      "cd_hash": "68d22bdec020f20010bfa9d27cd5f69d78427636",
      "team_id": "",
      "signer_type": 1
    },
    "key": "21E48D3B-4965-4072-81BF-83BE04A329C2",
    "return": {
      "error": 0,
      "description": "success",
      "return_value": 0
    },
    "subject": {
      "session_id": 100003,
      "group_id": 20,
      "process_name": "/System/Library/PreferencePanes/Accounts.prefPane/Contents/XPCServices/com.apple.preferences.users.remoteservice.xpc/Contents/MacOS/com.apple.preferences.users.remoteservice",
      "parent_pid": 1,
      "effective_user_name": "jamf",
      "user_id": 501,
      "group_name": "staff",
      "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02",
      "uuid": "F6095AEA-C5CB-4AAB-8FC7-70B9D454319E",
      "effective_group_id": 20,
      "process_hash": "507494616e05a5eb909794354fe69f29e432f2a7",
      "audit_id": 501,
      "responsible_process_id": 1391,
      "parent_path": "/sbin/launchd",
      "process_id": 1701,
      "effective_group_name": "staff",
      "audit_user_name": "jamf",
      "effective_user_id": 501,
      "terminal_id": {
        "type": 4,
        "ip_address": "198.51.100.0",
        "port": 4278
      },
      "responsible_process_name": "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences",
      "user_name": "jamf"
    },
    "texts": [
      "Added Groups membership username to '_lpadmin' node '/Local/Default', value = 'baddie'"
    ]
  }
  

Documentation de référence sur le mappage de champ

Cette section explique comment l'analyseur Google Security Operations mappe les champs de télémétrie Jamf Protect aux champs du modèle de données unifié (UDM) de Google Security Operations.

Documentation de référence sur le mappage de champ : identifiant d'événement vers type d'événement

Le tableau suivant répertorie les types de journaux JAMF_TELEMETRY et leurs types d'événements UDM correspondants.

Event Identifier	Event Type
AUE_add_to_group	GROUP_MODIFICATION
AUE_AUDITCTL	RESOURCE_READ
AUE_AUDITON_SPOLICY	RESOURCE_READ
AUE_AUTH_USER	USER_LOGIN
AUE_BIND	NETWORK_CONNECTION
AUE_BIOS_FIRMWARE_VERSIONS	USER_RESOURCE_ACCESS
AUE_CHDIR	USER_RESOURCE_ACCESS
AUE_CHROOT	USER_RESOURCE_ACCESS
AUE_CONNECT	NETWORK_CONNECTION
AUE_create_group	GROUP_CREATION
AUE_delete_group	GROUP_DELETION
AUE_create_user	USER_CREATION
AUE_delete_user	USER_DELETION
AUE_EXECVE	PROCESS_LAUNCH
AUE_EXIT	PROCESS_TERMINATION
AUE_FORK	PROCESS_LAUNCH
AUE_GETAUID	SCHEDULED_TASK_CREATION
AUE_KILL	PROCESS_TERMINATION
AUE_LISTEN	NETWORK_CONNECTION
AUE_LOGOUT	USER_LOGOUT
AUE_LW_LOGIN	USER_LOGIN
AUE_MAC_SET_PROC	PROCESS_UNCATEGORIZED
AUE_modify_group	GROUP_MODIFICATION
AUE_modify_password	USER_CHANGE_PASSWORD
AUE_modify_user	USER_UNCATEGORIZED
AUE_MOUNT	RESOURCE_READ
AUE_openssh	USER_LOGIN
AUE_PIDFORTASK	PROCESS_LAUNCH
AUE_POSIX_SPAWN	PROCESS_LAUNCH
AUE_REMOVE_FROM_GROUP	GROUP_MODIFICATION
AUE_SESSION_CLOSE	USER_LOGOUT
AUE_SESSION_END	USER_LOGOUT
AUE_SESSION_START	USER_LOGIN
AUE_SESSION_UPDATE	USER_UNCATEGORIZED
AUE_SETPRIORITY	SETTING_MODIFICATION
AUE_SETSOCKOPT	NETWORK_CONNECTION
AUE_SETTIMEOFDAY	SETTING_MODIFICATION
AUE_SHUTDOWN	STATUS_SHUTDOWN
AUE_SOCKETPAIR	NETWORK_CONNECTION
AUE_SSAUTHINT	USER_LOGIN
AUE_SSAUTHMECH	USER_LOGIN
AUE_SSAUTHORIZE	USER_LOGIN
AUE_TASKFORPID	PROCESS_INJECTION
AUE_TASKNAMEFORPID	PROCESS_INJECTION
AUE_UNMOUNT	RESOURCE_READ
AUE_WAIT4	PROCESS_UNCATEGORIZED
PLAINTEXT_LOG_COLLECTION_EVENT	GENERIC_EVENT
SYSTEM_PERFORMANCE_METRICS	GENERIC_EVENT

Documentation de référence sur le mappage de champ : JAMF_TELEMETRY

Le tableau suivant répertorie les champs de journal du type de journal JAMF_TELEMETRY et leurs champs UDM correspondants.

Obsolète :

Les champs labels suivants pour les noms UDM sont obsolètes : about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels et target.labels. Pour les analyseurs existants, en plus de ces champs UDM, les champs de journaux sont également mappés aux champs UDM clé/valeur additional.fields. Pour les nouveaux analyseurs, les paramètres clé/valeur des champs UDM additional.fields sont utilisés à la place des champs UDM labels obsolètes. Nous vous recommandons de mettre à jour les règles existantes pour utiliser les paramètres clé/valeur des champs UDM additional.fields au lieu des champs UDM labels obsolètes.

Log field	UDM mapping	Logic
	metadata.event_type
	metadata.product_name	The metadata.product_name UDM field is set to JAMF_TELEMETRY.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to JAMF.
header.time_seconds_epoch	metadata.event_timestamp
header.time_milliseconds_offset	about.labels[time_milliseconds_offset] (deprecated)
header.time_milliseconds_offset	additional.fields[time_milliseconds_offset]
header.version	about.labels[header_version] (deprecated)
header.version	additional.fields[header_version]
header.event_modifier	about.labels[event_modifier] (deprecated)
header.event_modifier	additional.fields[event_modifier]
header.event_uuid	metadata.product_log_id
header.event_name,header.event_id	metadata.product_event_type	If the header.event_name and header.event_id log field values are not empty, then the header.event_name-header.event_id log fields are mapped to the metadata.product_event_type UDM field. Else, if the header.event_name log field value is not empty, then the header.event_name log field is mapped to the metadata.product_event_type UDM field. Else, if the header.event_id log field value is not empty, then the header.event_id log field is mapped to the metadata.product_event_type UDM field.
exec_chain.thread_uuid	principal.labels[exec_chain_thread_uuid] (deprecated)
exec_chain.thread_uuid	additional.fields[exec_chain_thread_uuid]
exec_chain.uuid	principal.labels[exec_chain_uuid] (deprecated)
exec_chain.uuid	additional.fields[exec_chain_uuid]
exec_chain_child.parent_path	principal.process.parent_process.file.full_path
exec_chain_child.parent_pid	principal.process.parent_process.pid
exec_chain_child.parent_uuidsubject.parent (deprecated)	principal.labels[exec_chain_child_parent_uuid]
exec_chain_child.parent_uuid	additional.fields[exec_chain_child_parent_uuid]
host_info.serial_number	principal.asset.hardware.serial_number
host_info.host_name	principal.hostname
host_info.osversion	principal.asset.software.version
host_info.host_uuid	principal.asset.product_object_id
host_info.primary_mac_address	principal.asset.mac
identity.signer_id	principal.labels[identity_signer_id] (deprecated)
identity.signer_id	additional.fields[identity_signer_id]
identity.team_id_truncated	principal.labels[identity_team_id_truncated] (deprecated)
identity.team_id_truncated	additional.fields[identity_team_id_truncated]
identity.signer_id_truncated	principal.labels[identity_signer_id_truncated] (deprecated)
identity.signer_id_truncated	additional.fields[identity_signer_id_truncated]
identity.cd_hash	principal.labels[identity_cd_hash] (deprecated)
identity.cd_hash	additional.fields[identity_cd_hash]
identity.team_id	principal.labels[team_id] (deprecated)
identity.team_id	additional.fields[team_id]
identity.signer_type	principal.labels[signer_type] (deprecated)
identity.signer_type	additional.fields[signer_type]
key	about.labels[key] (deprecated)
key	additional.fields[key]
return.error,return.description	security_result.description	If the return.error and return.description log field values are not empty, then the return.error-return.description log fields are mapped to the security_result.description UDM field. Else, if the return.error log field value is not empty, then the return.error log field is mapped to the security_result.description UDM field. Else, if the return.description log field value is not empty, then the return.description log field is mapped to the security_result.description UDM field.
return.return_value	security_result.detection_fields
subject.session_id	network.session_id
subject.group_id	principal.user.group_identifiers	If the header.event_name log field value contains one of the following values, then the subject.group_id log field is mapped to the target.user.group_identifiers UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize Else, the subject.group_id log field is mapped to the principal.user.group_identifiers UDM field.
subject.effective_group_id	target.user.group_identifiers	If the header.event_name log field value does not contain one of the following values, then the subject.effective_group_id log field is mapped to the target.user.group_identifiers UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize
subject.group_name	principal.group.group_display_name	If the header.event_name log field value contains one of the following values, then the subject.group_name log field is mapped to the target.group.group_display_name UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize Else, the subject.group_name log field is mapped to the principal.group.group_display_name UDM field.
subject.effective_group_name	target.group.group_display_name	If the header.event_name log field value does not contain one of the following values, then the subject.effective_group_name log field is mapped to the target.group.group_display_name UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize
subject.user_name	principal.user.user_display_name	If the header.event_name log field value contains one of the following values, then the subject.user_name log field is mapped to the target.user.user_display_name UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize Else, the subject.user_name log field is mapped to the principal.user.user_display_name UDM field.
subject.effective_user_name	target.user.user_display_name	If the header.event_name log field value does not contain one of the following values, then the subject.effective_user_name log field is mapped to the target.user.user_display_name UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize
subject.user_id	principal.user.userid	If the header.event_name log field value contains one of the following values, then the subject.user_id log field is mapped to the target.user.userid UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize Else, the subject.user_id log field is mapped to the principal.user.userid UDM field.
subject.effective_user_id	target.user.userid	If the header.event_name log field value does not contain one of the following values, then the subject.effective_user_id log field is mapped to the target.user.userid UDM field: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize
subject.audit_id	principal.labels[audit_id] (deprecated)
subject.audit_id	additional.fields[audit_id]
subject.responsible_process_id,metrics.tasks.pid	principal.process.pid	If the header.event_name log field value is equal to SYSTEM_PERFORMANCE_METRICS, then the metrics.tasks.pid log field is mapped to the principal.process.pid UDM field. Else, the subject.responsible_process_id log field is mapped to the principal.process.pid UDM field.
subject.process_id	principal.process_ancestors.pid	If the subject.responsible_process_id log field value is not empty, then the subject.process_id log field is mapped to the principal.process_ancestors.pid UDM field. Else, the subject.process_id log field is mapped to the principal.process.pid UDM field.
subject.audit_user_name	principal.labels[audit_user_name] (deprecated)
subject.audit_user_name	additional.fields[audit_user_name]
subject.process_name	principal.process_ancestors.file.full_path	If the subject.responsible_process_name log field value is not empty, then the subject.process_name log field is mapped to the principal.process_ancestors.file.full_path UDM field. Else, the subject.process_name log field is mapped to the principal.process.file.full_path UDM field.
subject.responsible_process_name	principal.process.file.full_path
subject.process_hash	principal.process.file.sha1
subject.terminal_id.type	principal.labels[type] (deprecated)	If the subject.terminal_id.type log field value is equal to 4, then the principal.labels.key UDM field is set to subject_terminal_id_type and the principal.labels.value UDM field is set to 4-IPv4. Else, if the subject.terminal_id.type log field value is equal to 6, then the principal.labels.key UDM field is set to subject_terminal_id_type and the principal.labels.value UDM field is set to 6-IPv6. Else, the principal.labels.key UDM field is set to subject_terminal_id_type and the subject.terminal_id.type log field is mapped to the principal.labels.value UDM field.
subject.terminal_id.type	additional.fields[type]	If the subject.terminal_id.type log field value is equal to 4, then the additional.fields.key UDM field is set to subject_terminal_id_type and the additional.fields.value.string_value UDM field is set to 4-IPv4. Else, if the subject.terminal_id.type log field value is equal to 6, then the additional.fields.key UDM field is set to subject_terminal_id_type and the additional.fields.value.string_value UDM field is set to 6-IPv6. Else, the additional.fields.key UDM field is set to subject_terminal_id_type and the subject.terminal_id.type log field is mapped to the additional.fields.value.string_value UDM field.
subject.terminal_id.ip_address	principal.ip
subject.terminal_id.port	principal.port
texts	metadata.description	If the index value is equal to 0, then the texts log field is mapped to the metadata.description UDM field. Else, the texts log field is mapped to the about.labels.value UDM field.
attributes.device	principal.asset.attribute.labels[device]
attributes.owner_group_name	about.group.group_display_name
attributes.owner_group_id	about.user.group_identifiers
attributes.owner_user_id	about.user.userid
attributes.owner_user_name	about.user.user_display_name
attributes.file_system_id	principal.labels[attributes_file_system_id] (deprecated)
attributes.file_system_id	additional.fields[attributes_file_system_id]
attributes.file_access_mode	principal.labels[attributes_file_access_mode] (deprecated)
attributes.file_access_mode	additional.fields[attributes_file_access_mode]
attributes.node_id	principal.asset.asset_id
path	about.labels[path]
arguments.cmd	principal.labels[arguments_cmd] (deprecated)
arguments.cmd	additional.fields[arguments_cmd]
arguments.policy	principal.labels[arguments_policy] (deprecated)
arguments.policy	additional.fields[arguments_policy]
arguments.length	principal.labels[arguments_length] (deprecated)
arguments.length	additional.fields[arguments_length]
_event_score	security_result.severity_details
architecture	principal.asset.hardware.cpu_model
arguments.addr	principal.labels[arguments_addr] (deprecated)
arguments.addr	additional.fields[arguments_addr]
arguments.am_failure	principal.labels[arguments_am_failure] (deprecated)
arguments.am_failure	additional.fields[arguments_am_failure]
arguments.am_success	principal.labels[arguments_am_success] (deprecated)
arguments.am_success	additional.fields[arguments_am_success]
arguments.authenticated_as_test	principal.labels[arguments_authenticated_as_test] (deprecated)
arguments.authenticated_as_test	additional.fields[arguments_authenticated_as_test]
arguments.child_PID	principal.labels[arguments_child_PID] (deprecated)
arguments.child_PID	additional.fields[arguments_child_PID]
arguments.data	principal.labels[arguments_data] (deprecated)
arguments.data	additional.fields[arguments_data]
arguments.domain	principal.labels[arguments_domain] (deprecated)
arguments.domain	additional.fields[arguments_domain]
arguments.fd	principal.labels[arguments_fd] (deprecated)
arguments.fd	additional.fields[arguments_fd]
arguments.flags	principal.labels[arguments_flags] (deprecated)
arguments.flags	additional.fields[arguments_flags]
arguments.authenticated_as_allen.golbig	principal.labels[authenticated_as_allen_golbig] (deprecated)
arguments.authenticated_as_allen.golbig	additional.fields[authenticated_as_allen_golbig]
arguments.known_UID_	principal.labels[argument_known_uid] (deprecated)
arguments.known_UID_	additional.fields[argument_known_uid]
arguments.pid	principal.labels[arguments_pid] (deprecated)
arguments.pid	additional.fields[arguments_pid]
arguments.port	principal.labels[arguments_port] (deprecated)
arguments.port	additional.fields[arguments_port]
arguments.priority	security_result.priority_details
arguments.process	principal.labels[argument_process] (deprecated)
arguments.process	additional.fields[argument_process]
arguments.protocol	principal.labels[argument_protocol] (deprecated)
arguments.protocol	additional.fields[argument_protocol]
arguments.request	principal.labels[argument_request] (deprecated)
arguments.request	additional.fields[argument_request]
arguments.sflags	principal.labels[arguments_sflags] (deprecated)
arguments.sflags	additional.fields[arguments_sflags]
arguments.signal	principal.labels[argument_signal] (deprecated)
arguments.signal	additional.fields[argument_signal]
arguments.target_port,process.terminal_id.port,socket_inet.port	target.port	If the header.event_name log field value is equal to AUE_KILL or AUE_TASKFORPID, then the process.port log field is mapped to the target.port UDM field. Else, if the header.event_name log field value is equal to AUE_BIND or AUE_CONNECT, then the socket_inet.port log field is mapped to the target.port UDM field. Else, the agument.target_port log field is mapped to the target.port UDM field.
arguments.task_port	principal.labels[task_port] (deprecated)
arguments.task_port	additional.fields[task_port]
arguments.type	principal.labels[argument_type] (deprecated)
arguments.type	additional.fields[argument_type]
arguments.which	principal.labels[which] (deprecated)
arguments.which	additional.fields[which]
arguments.who	principal.labels[who] (deprecated)
arguments.who	additional.fields[who]
bios_firmware_versions.booter-version	principal.asset.attribute.labels[booter_version]
bios_firmware_versions.firmware-features	principal.asset.attribute.labels[firmware_features]
bios_firmware_versions.firmware-version	principal.asset.attribute.labels[firmware_version]
bios_firmware_versions.release-date	principal.asset.attribute.labels[release_date]
bios_firmware_versions.rom-size	principal.asset.attribute.labels[rom_size]
bios_firmware_versions.system-firmware-version	principal.asset.attribute.labels[system_firmware_version]
bios_firmware_versions.vendor	principal.asset.attribute.labels[vendor]
bios_firmware_versions.version	principal.asset.attribute.labels[version]
exec_args.args_compiled	principal.process.command_line
exec_chain_parent.uuid	principal.labels[parent_uuid] (deprecated)
exec_chain_parent.uuid	additional.fields[parent_uuid]
exec_env.env_compiled	about.labels[env_compiled] (deprecated)
exec_env.env_compiled	additional.fields[env_compiled]
exec_env.env.PATH	about.labels[env_path] (deprecated)
exec_env.env.PATH	additional.fields[env_path]
exit.return_value	principal.labels[return_value] (deprecated)
exit.return_value	additional.fields[return_value]
exit.status	principal.labels[exit_status] (deprecated)
exit.status	additional.fields[exit_status]
process.audit_id	about.labels[process_audit_id] (deprecated)
process.audit_id	additional.fields[process_audit_id]
process.audit_user_name	about.labels[audit_user_name] (deprecated)
process.audit_user_name	additional.fields[audit_user_name]
process.group_idprocess.effective_group_id	about.user.group_identifiers
process.group_name	about.group.group_display_name
process.process_hash	target.process.file.sha1
process.process_id	target.process.pid
process.process_name	target.process.file.full_path
process.session_id	target.labels[process_session_id] (deprecated)
process.session_id	additional.fields[process_session_id]
process.terminal_id.addr	target.labels[addr]
process.terminal_id.ip_address	target.ip
process.terminal_id.type	target.labels[process_terminal_id_type] (deprecated)	If the process.terminal_id.type log field value is equal to 4, then the target.labels.key UDM field is set to process_terminal_id_type and the target.labels.value UDM field is set to 4-IPv4. Else, if the subject.terminal_id.type log field value is equal to 6, then the target.labels.key UDM field is set to process_terminal_id_type and the target.labels.value UDM field is set to 6-IPv6. Else, the target.labels.key UDM field is set to process_terminal_id_type and the process.terminal_id.type log field is mapped to the target.labels.value UDM field.
process.terminal_id.type	additional.fields[process_terminal_id_type]	If the process.terminal_id.type log field value is equal to 4, then the additional.fields.key UDM field is set to process_terminal_id_type and the additional.fields.value.string_value UDM field is set to 4-IPv4. Else, if the subject.terminal_id.type log field value is equal to 6, then the additional.fields.key UDM field is set to process_terminal_id_type and the additional.fields.value.string_value UDM field is set to 6-IPv6. Else, the additional.fields.key UDM field is set to process_terminal_id_type and the process.terminal_id.type log field is mapped to the additional.fields.value.string_value UDM field.
process.user_id	about.user.userid
process.user_name	about.user.user_display_name
rateLimitingSeconds	about.labels[rate_limiting_seconds] (deprecated)
rateLimitingSeconds	additional.fields[rate_limiting_seconds]
socket_inet.family	target.labels[socket_inet_family] (deprecated)
socket_inet.family	additional.fields[socket_inet_family]
socket_inet.id	target.labels[socket_inet_id] (deprecated)	If the socket_inet.id log field value is equal to 128, then the target.labels.key UDM field is set to socket_inet_id and the target.labels.value UDM field is set to 128-IPv4. Else, if the socket_inet.id log field value is equal to 129, then the target.labels.key UDM field is set to socket_inet_id and the target.labels.value UDM field is set to 129-IPv6. Else, the target.labels.key UDM field is set to socket_inet_id and the socket_inet.ip log field is mapped to the target.labels.value UDM field.
socket_inet.id	additional.fields[socket_inet_id]	If the socket_inet.id log field value is equal to 128, then the additional.fields.key UDM field is set to socket_inet_id and the additional.fields.value.string_value UDM field is set to 128-IPv4. Else, if the socket_inet.id log field value is equal to 129, then the additional.fields.key UDM field is set to socket_inet_id and the additional.fields.value.string_value UDM field is set to 129-IPv6. Else, the additional.fields.key UDM field is set to socket_inet_id and the socket_inet.ip log field is mapped to the additional.fields.value.string_value UDM field.
socket_inet.ip_address	target.ip
socket_unix.family	target.labels[socket_unix_family] (deprecated)
socket_unix.family	additional.fields[socket_unix_family]
socket_unix.path	target.file.full_path
subject.terminal_id.addr	target.labels[addr]
metrics.hw_model	principal.asset.hardware.model
metrics.tasks.bytes_received	network.received_bytes	If the index value is equal to 0, then the metrics.tasks.bytes_received log field is mapped to the network.received_bytes UDM field. Else, the metrics.tasks.bytes_received log field is mapped to the principal.asset.attribute.labels.value UDM field.
metrics.tasks.bytes_received_per_s	principal.asset.attribute.labels[bytes_received_per_s]
metrics.tasks.bytes_sent	network.sent_bytes	If the index value is equal to 0, then the metrics.tasks.bytes_sent log field is mapped to the network.sent_bytes UDM field. Else, the metrics.tasks.bytes_sent log field is mapped to the principal.asset.attribute.labels.value UDM field.
metrics.tasks.bytes_sent_per_s	principal.asset.attribute.labels[bytes_sent_per_s]
metrics.tasks.cputime_ms_per_s	principal.asset.attribute.labels[cputime_ms_per_s]
metrics.tasks.cputime_ns	principal.asset.attribute.labels[cputime_ns]
metrics.tasks.cputime_sample_ms_per_s	principal.asset.attribute.labels[cputime_sample_ms_per_s]
metrics.tasks.cputime_userland_ratio	principal.asset.attribute.labels[cputime_userland_ratio]
metrics.tasks.diskio_bytesread	principal.asset.attribute.labels[diskio_bytesread]
metrics.tasks.diskio_bytesread_per_s	principal.asset.attribute.labels[diskio_bytesread_per_s]
metrics.tasks.diskio_byteswritten	principal.asset.attribute.labels[diskio_byteswritten]
metrics.tasks.diskio_byteswritten_per_s	principal.asset.attribute.labels[diskio_byteswritten_per_s]
metrics.tasks.energy_impact	principal.asset.attribute.labels[energy_impact]
metrics.tasks.energy_impact_per_s	principal.asset.attribute.labels[energy_impact_per_s]
metrics.tasks.idle_wakeups	principal.asset.attribute.labels[idle_wakeups]
metrics.tasks.interval_ns	principal.asset.attribute.labels[interval_ns]
metrics.tasks.intr_wakeups_per_s	principal.asset.attribute.labels[intr_wakeups_per_s]
metrics.tasks.name	principal.asset.attribute.labels[name]
metrics.tasks.packets_received	network.received_packets	If the index value is equal to 0, then the metrics.tasks.packets_received log field is mapped to the network.received_packets UDM field. Else, the metrics.tasks.packets_received log field is mapped to the principal.asset.attribute.labels.value UDM field.
metrics.tasks.packets_received_per_s	principal.asset.attribute.labels[packets_received_per_s]
metrics.tasks.packets_sent	network.sent_packets	If the index value is equal to 0, then the metrics.tasks.packets_sent log field is mapped to the network.sent_packets UDM field. Else, the metrics.tasks.packets_sent log field is mapped to the principal.asset.attribute.labels.value UDM field.
metrics.tasks.packets_sent_per_s	principal.asset.attribute.labels[packets_sent_per_s]
metrics.tasks.pageins	principal.asset.attribute.labels[pageins]
metrics.tasks.pageins_per_s	principal.asset.attribute.labels[pageins_per_s]
metrics.tasks.qos_background_ms_per_s	principal.asset.attribute.labels[qos_background_ms_per_s]
metrics.tasks.qos_background_ns	principal.asset.attribute.labels[qos_background_ns]
metrics.tasks.qos_default_ms_per_s	principal.asset.attribute.labels[qos_default_ms_per_s]
metrics.tasks.qos_default_ns	principal.asset.attribute.labels[qos_default_ns]
metrics.tasks.qos_disabled_ms_per_s	principal.asset.attribute.labels[qos_disabled_ms_per_s]
metrics.tasks.qos_disabled_ns	principal.asset.attribute.labels[qos_disabled_ns]
metrics.tasks.qos_maintenance_ms_per_s	principal.asset.attribute.labels[qos_maintenance_ms_per_s]
metrics.tasks.qos_maintenance_ns	principal.asset.attribute.labels[qos_maintenance_ns]
metrics.tasks.qos_user_initiated_ms_per_s	principal.asset.attribute.labels[qos_user_initiated_ms_per_s]
metrics.tasks.qos_user_initiated_ns	principal.asset.attribute.labels[qos_user_initiated_ns]
metrics.tasks.qos_user_interactive_ms_per_s	principal.asset.attribute.labels[qos_user_interactive_ms_per_s]
metrics.tasks.qos_user_interactive_ns	principal.asset.attribute.labels[qos_user_interactive_ns]
metrics.tasks.qos_utility_ms_per_s	principal.asset.attribute.labels[qos_utility_ms_per_s]
metrics.tasks.qos_utility_ns	principal.asset.attribute.labels[qos_utility_ns]
metrics.tasks.started_abstime_ns	principal.asset.attribute.labels[started_abstime_ns]
metrics.tasks.timer_wakeups.wakeups	principal.asset.attribute.labels[timer_wakeups]
page_info.page	about.labels[page_info_page] (deprecated)
page_info.page	additional.fields[page_info_page]
page_info.total	about.labels[page_info_total] (deprecated)
page_info.total	additional.fields[page_info_total]
exec_env.env._	about.labels[env] (deprecated)
exec_env.env._	additional.fields[env]
exec_env.env.__CF_USER_TEXT_ENCODING	about.labels[env__CF_USER_TEXT_ENCODING] (deprecated)
exec_env.env.__CF_USER_TEXT_ENCODING	additional.fields[env__CF_USER_TEXT_ENCODING]
exec_env.env.__CFBundleIdentifier	about.labels[env__CFBundleIdentifier] (deprecated)
exec_env.env.__CFBundleIdentifier	additional.fields[env__CFBundleIdentifier]
exec_env.env.ASDF_DIR	about.labels[env_ASDF_DIR] (deprecated)
exec_env.env.ASDF_DIR	additional.fields[env_ASDF_DIR]
exec_env.env.HOME	about.labels[env_HOME] (deprecated)
exec_env.env.HOME	additional.fields[env_HOME]
exec_env.env.LANG	about.labels[env_LANG] (deprecated)
exec_env.env.LANG	additional.fields[env_LANG]
exec_env.env.LC_TERMINAL	about.labels[env_LC_TERMINAL] (deprecated)
exec_env.env.LC_TERMINAL	additional.fields[env_LC_TERMINAL]
exec_env.env.LC_TERMINAL_VERSION	about.labels[env_LC_TERMINAL_VERSION] (deprecated)
exec_env.env.LC_TERMINAL_VERSION	additional.fields[env_LC_TERMINAL_VERSION]
exec_env.env.MAIL	about.labels[env_MAIL] (deprecated)
exec_env.env.MAIL	additional.fields[env_MAIL]
exec_env.env.MallocSpaceEfficient	about.labels[env_MallocSpaceEfficient] (deprecated)
exec_env.env.MallocSpaceEfficient	additional.fields[env_MallocSpaceEfficient]
exec_env.env.OLDPWD	about.labels[env_OLDPWD] (deprecated)
exec_env.env.OLDPWD	additional.fields[env_OLDPWD]
exec_env.env.PWD	about.file.full_path
exec_env.env.SHELL	about.labels[env_SHELL] (deprecated)
exec_env.env.SHELL	additional.fields[env_SHELL]
exec_env.env.SHLVL	about.labels[env_SHLVL] (deprecated)
exec_env.env.SHLVL	additional.fields[env_SHLVL]
exec_env.env.SSH_AUTH_SOCK	about.labels[env_SSH_AUTH_SOCK] (deprecated)
exec_env.env.SSH_AUTH_SOCK	additional.fields[env_SSH_AUTH_SOCK]
exec_env.env.SSH_CLIENT	about.labels[env_SSH_CLIENT] (deprecated)
exec_env.env.SSH_CLIENT	additional.fields[env_SSH_CLIENT]
exec_env.env.SSH_CONNECTION	about.labels[env_SSH_CONNECTION] (deprecated)
exec_env.env.SSH_CONNECTION	additional.fields[env_SSH_CONNECTION]
exec_env.env.SSH_TTY	about.labels[env_SSH_TTY] (deprecated)
exec_env.env.SSH_TTY	additional.fields[env_SSH_TTY]
exec_env.env.SUDO_COMMAND	about.labels[env_SUDO_COMMAND] (deprecated)
exec_env.env.SUDO_COMMAND	additional.fields[env_SUDO_COMMAND]
exec_env.env.SUDO_GID	about.user.group_identifiers
exec_env.env.SUDO_UID	about.user.userid
exec_env.env.SUDO_USER	about.user.user_display_name
exec_env.env.TERM	about.labels[env_TERM] (deprecated)
exec_env.env.TERM	additional.fields[env_TERM]
exec_env.env.LOGNAME	about.labels[env_LOGNAME] (deprecated)
exec_env.env.LOGNAME	additional.fields[env_LOGNAME]
exec_env.env.USER	about.labels[env_USER] (deprecated)
exec_env.env.USER	additional.fields[env_USER]
exec_env.env.TERM_PROGRAM	about.labels[env_TERM_PROGRAM] (deprecated)
exec_env.env.TERM_PROGRAM	additional.fields[env_TERM_PROGRAM]
exec_env.env.TERM_PROGRAM_VERSION	about.labels[env_TERM_PROGRAM_VERSION] (deprecated)
exec_env.env.TERM_PROGRAM_VERSION	additional.fields[env_TERM_PROGRAM_VERSION]
exec_env.env.TERM_SESSION_ID	about.labels[env_TERM_SESSION_ID] (deprecated)
exec_env.env.TERM_SESSION_ID	additional.fields[env_TERM_SESSION_ID]
exec_env.env.TMPDIR	about.labels[env_TMPDIR] (deprecated)
exec_env.env.TMPDIR	additional.fields[env_TMPDIR]
exec_env.env.XPC_FLAGS	about.labels[env_XPC_FLAGS] (deprecated)
exec_env.env.XPC_FLAGS	additional.fields[env_XPC_FLAGS]
exec_env.env.XPC_SERVICE_NAME	about.labels[env_XPC_SERVICE_NAME] (deprecated)
exec_env.env.XPC_SERVICE_NAME	additional.fields[env_XPC_SERVICE_NAME]
	target.resource.resource_type	If the header.event_name log field value is equal to AUE_GETAUID, then the target.resource.resource_type UDM field is set to TASK. Else, if the header.event_name log field value is equal to AUE_SETPRIORITY or AUE_SETTIMEOFDAY, then the target.resource.resource_type UDM field is set to SETTING.
	extensions.auth.mechanism	If the header.event_name log field value contains one of the following values, then the mechanism UDM field is set to USERNAME_PASSWORD: AUE_auth_user AUE_logout AUE_lw_login AUE_openssh AUE_SESSION_CLOSE AUE_SESSION_END AUE_SESSION_START AUE_ssauthint AUE_ssauthmech AUE_ssauthorize

Étape suivante

• Ingestion de données dans Google Security Operations

Journal des modifications

Afficher le journal des modifications de cet analyseur

Vous avez encore besoin d'aide ? Obtenez des réponses auprès des membres de la communauté et des professionnels Google SecOps.