Mengumpulkan log Okta
Didukung di:
Google SecOps
SIEM
Dokumen ini menjelaskan cara menyerap log Okta ke Google Security Operations menggunakan Okta API. Parser mengekstrak log sistem, menangani peristiwa tunggal dan peristiwa batch dalam array JSON. Parser ini menormalisasi data ke dalam format UDM, memetakan kolom Okta ke kolom UDM yang setara, memperkaya data dengan agen pengguna yang diuraikan, informasi geografis, dan detail autentikasi, serta menghasilkan peristiwa hasil keamanan berdasarkan hasil dan informasi risiko.
Sebelum memulai
- Instance Google SecOps
- Akses istimewa ke Okta
Cara mengonfigurasi Okta
Untuk mengonfigurasi SSO Okta, selesaikan tugas berikut:
Membuat pengguna Administratif Okta dengan hak istimewa hanya baca
- Login ke konsol administrator Okta.
Buat Pengguna Standar.
- Buka Direktori > Orang.
- Klik Tambahkan orang dan lengkapi kolom yang wajib diisi.
Pilih Security > Administrators.
Klik Tambahkan Administrator.
Di kolom Administrator assignment by admin, temukan Standard User.
Di bagian roles, pilih Read-Only Administrator dari daftar.
Logout dari akun administrator.
Mendapatkan kunci API
- Login ke Okta Administrator Console dengan pengguna read-only administrator.
- Buka Security > API > Tokens.
- Klik Create Token.
- Berikan nama yang bermakna untuk token.
- Berikan zona IP, tempat API akan digunakan (Anda dapat memilih any IP jika tidak yakin).
- Klik Create Token.
- Salin kunci API.
- Klik Oke, mengerti.
Menyiapkan feed
Ada dua titik entri yang berbeda untuk menyiapkan feed di platform Google SecOps:
- Settings > Data Management > Feeds > Add New Feed (Di platform khusus SIEM, Settings > Feeds > Add New Feed)
- Content Hub > Paket Konten > Mulai
Cara menyiapkan feed Okta
Untuk mengonfigurasi jenis log ini, ikuti langkah-langkah berikut:
- Klik paket Okta.
- Temukan jenis log Okta.
Tentukan nilai untuk kolom berikut:
- Jenis Sumber: API pihak ketiga (direkomendasikan)
- Header HTTP autentikasi: Masukkan Kunci API Okta dalam format berikut:
Authorization:<API_KEY>. - Nama Host API: Tentukan nama domain host Okta Anda (misalnya,
<your-domain>.okta.com). - Namespace aset: Namespace aset.
- Label penyerapan: Label yang diterapkan ke peristiwa dari feed ini.
Opsi lanjutan
- Nama Feed: Nilai yang diisi otomatis yang mengidentifikasi feed.
- Namespace Aset: Namespace yang terkait dengan feed.
- Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat Feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam kelompok produk ini, lihat Mengonfigurasi feed menurut produk.
Tabel pemetaan UDM
| Kolom Log | Pemetaan UDM | Logika |
|---|---|---|
user_email |
event.idm.read_-only_udm.network.email.from |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.cidr_ip |
event.idm.read_only_udm.target.ip |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.cidr_ip |
event.idm.read_only_udm.target.asset.ip |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.range |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.CIDR |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
debugContext.debugData.requestId |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
debugContext.debugData.targetEventHookIds |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
id |
event1.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
details.type |
event1.idm.read_only_udm.metadata.product_event_type |
Dipetakan dari log perubahan |
details.actor.name |
event1.idm.read_only_udm.principal.user.userid |
Dipetakan dari log perubahan |
details.actor.details.full_name |
event1.idm.read_only_udm.principal.user.user_display_name |
Dipetakan dari log perubahan |
details.actor.details.first_name |
event1.idm.read_only_udm.principal.user.first_name |
Dipetakan dari log perubahan |
details.actor.details.last_name |
event1.idm.read_only_udm.principal.user.last_name |
Dipetakan dari log perubahan |
details.actor.id |
event1.idm.read_only_udm.principal.user.employee_id |
Dipetakan dari log perubahan |
details.client.hostname |
event1.idm.read_only_udm.principal.hostname |
Dipetakan dari log perubahan |
details.client.hostname |
event1.idm.read_only_udm.principal.asset.hostname |
Dipetakan dari log perubahan |
details.client.id |
event1.idm.read_only_udm.principal.user.product_object_id |
Dipetakan dari log perubahan |
details.client.description |
event1.idm.read_only_udm.principal.application |
Dipetakan dari log perubahan |
details.client.os |
event1.idm.read_only_udm.principal.platform |
Dipetakan dari log perubahan |
details.client.os |
event1.idm.read_only_udm.principal.platform_version |
Dipetakan dari log perubahan |
details.team_id |
event1.idm.read_only_udm.target.resource.id |
Dipetakan dari log perubahan |
details.team_id |
event1.idm.read_only_udm.principal.resource.id |
Dipetakan dari log perubahan |
details.team_name |
event1.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
details.client.state |
event1.idm.read_only_udm.principal.resource.attribute.labels |
Dipetakan dari log perubahan |
details.target_server |
event1.idm.read_only_udm.target.application |
Dipetakan dari log perubahan |
details.via |
event1.idm.read_only_udm.network.session_id |
Dipetakan dari log perubahan |
details_session_type |
event1.idm.read_only_udm.security_result.detection_fields |
Dipetakan dari log perubahan |
details.actor.details.user_type |
event1.idm.read_only_udm.principal.user.attribute.roles |
Dipetakan dari log perubahan |
details.trace_id |
event1.idm.read_only_udm.network.session_id |
Dipetakan dari log perubahan |
details.client.encrypted |
event1.idm.read_only_udm.principal.asset.attribute.labels |
Dipetakan dari log perubahan |
details.client.user_name |
event1.idm.read_only_udm.target.user.userid |
Dipetakan dari log perubahan |
details.client_ip |
event1.idm.read_only_udm.principal.ip |
Dipetakan dari log perubahan |
details.client_ip |
event1.idm.read_only_udm.principal.asset.ip |
Dipetakan dari log perubahan |
details.project.id |
event1.idm.read_only_udm.target.resource.id |
Dipetakan dari log perubahan |
details.project.team |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.create_server_users |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.force_shared_ssh_users |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.forward_traffic |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.rdp_session_recording |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.require_preauth_for_creds |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.ssh_certificate_type |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.ssh_session_recording |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.next_unix_gid |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.next_unix_uid |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server_hostnames |
event1.idm.read_only_udm.target.hostname |
Dipetakan dari log perubahan |
details.server_hostnames |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
server_cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_instance_type |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_network |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_project_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_zone_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
detailsserver_os |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_services |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_sftd_version |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_source |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details._type |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.internal_ip |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.network |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.project_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.os |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.project_name |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source_details.cloud_account |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source_details.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details._type |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.internal_ip |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.network |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.project_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.os |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.project_name |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source_details.cloud_account |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source_details.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_source_details |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
detailsserver.team_name |
event1.idm.read_only_udm.intermediary.user.department |
Dipetakan dari log perubahan |
details.username |
event1.idm.read_only_udm.target.user.user_display_name |
Dipetakan dari log perubahan |
details.ssh_key_fingerprint |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.unix_user_name |
event1.idm.read_only_udm.principal.user.userid |
Dipetakan dari log perubahan |
details.ssh_algorithm |
event1.idm.read_only_udm.network.tls.cipher |
Dipetakan dari log perubahan |
details.servers.alt_names |
event1.idm.read_only_udm.target.hostname |
Dipetakan dari log perubahan |
details.servers.alt_names |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.alt_names |
event1.idm.read_only_udm.target.hostname |
Dipetakan dari log perubahan |
details.server.alt_names |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.access_address |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.server.access_address |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.servers.external_ip |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.server.external_ip |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.server.sftd_version |
event1.idm.read_only_udm.metadata.product_version |
Dipetakan dari log perubahan |
details.servers.sftd_version |
event1.idm.read_only_udm.metadata.product_version |
Dipetakan dari log perubahan |
details.server.instance_details.zone_id |
event1.idm.read_only_udm.intermediary.location.country_or_region |
Dipetakan dari log perubahan |
details.servers.instance_details.zone_id |
event1.idm.read_only_udm.intermediary.location.country_or_region |
Dipetakan dari log perubahan |
debugContext.debugData.authType" and "debugContext.debugData.factorType |
additional.fields |
Dipetakan dari log perubahan |
risk.level |
security_result.severity_details |
Dipetakan dari log perubahan |
risk.reasons |
security_result.description |
Dipetakan dari log perubahan |
actor.displayName" and "target.displayName |
additional.fields |
Dipetakan dari log perubahan |
anonymous", "operator", and "type |
security_result.detection_fields |
Dipetakan dari log perubahan |
tunnels" and "policyRuleFactorMode |
security_result.detection_fields |
Dipetakan dari log perubahan |
profile.displayName |
principal.user.user_display_name |
Dipetakan dari log perubahan |
profile.email |
principal.user.email_addresses |
Dipetakan dari log perubahan |
target.0.alternateId |
target.user.userid |
Dipetakan dari log perubahan |
target.1.alternateId |
target.user.userid |
Dipetakan dari log perubahan |
securityContext.asNumber |
security_result.detection_fields |
Dipetakan dari log perubahan |
legacyEventType |
security_result.detection_fields |
Dipetakan dari log perubahan |
target.displayName |
target.resource_ancestors.name |
Dipetakan dari log perubahan |
targetfield.detailEntry.methodTypeUsed |
target.resource_ancestors.attribute.labels |
Dipetakan dari log perubahan |
targetfield.detailEntry.methodUsedVerifiedProperties |
target.resource_ancestors.attribute.labels |
Dipetakan dari log perubahan |
debugContext.debugData.changedAttributes |
security_result.detection_fields |
Dipetakan dari log perubahan |
client.userAgent.os |
principal.platform |
Dipetakan dari log perubahan |
client.device |
principal.asset.type |
Dipetakan dari log perubahan |
target.0.detailEntry.clientAppId |
target.asset_id |
Dipetakan dari log perubahan |
| Kolom log | pemetaan UDM | Keterangan |
| :--- | :--- | :--- |
actor.displayName |
principal.resource.attribute.labels |
|
assigned_group[] |
security_result.detection_fields |
|
created |
target.resource.attribute.labels |
|
credentials.oauthClient.autoKeyRotation |
security_result.detection_fields |
|
credentials.oauthClient.pkce_required |
security_result.detection_fields |
|
credentials.oauthClient.token_endpoint_auth_method |
security_result.detection_fields |
|
credentials.signing.kid |
security_result.detection_fields |
|
credentials.userNameTemplate.pushStatus |
security_result.detection_fields |
|
credentials.userNameTemplate.template |
metadata.product_event_type |
|
credentials.userNameTemplate.type |
security_result.detection_fields |
|
id |
principal.user.userid |
|
label |
target.resource.attribute.labels |
|
lastUpdated |
target.resource.attribute.labels |
|
orn |
target.resource.attribute.labels |
|
settings.implicitAssignment |
security_result.detection_fields |
|
settings.manualProvisioning |
security_result.detection_fields |
|
settings.notifications.vpn.network.connection |
security_result.detection_fields |
|
settings.notifications.vpn.network.helpUrl |
security_result.detection_fields |
|
settings.notifications.vpn.network.message |
security_result.detection_fields |
|
settings.oauthClient.application_type |
security_result.detection_fields |
|
settings.oauthClient.client_uri |
security_result.detection_fields |
|
settings.oauthClient.consent_method |
security_result.detection_fields |
|
settings.oauthClient.dpop_bound_access_tokens |
security_result.detection_fields |
|
settings.oauthClient.grant_types[] |
security_result.detection_fields |
|
settings.oauthClient.idp_initiated_login.mode |
security_result.detection_fields |
|
settings.oauthClient.initiate_login_uri |
security_result.detection_fields |
|
settings.oauthClient.issuer_mode |
security_result.detection_fields |
|
settings.oauthClient.logo_uri |
security_result.detection_fields |
|
settings.oauthClient.pkce_required |
security_result.detection_fields |
|
settings.oauthClient.redirect_uris[] |
security_result.detection_fields |
|
settings.oauthClient.response_types[] |
security_result.detection_fields |
|
settings.oauthClient.token_endpoint_auth_method |
security_result.detection_fields |
|
settings.oauthClient.wildcard_redirect |
security_result.detection_fields |
|
settings.signOn.acsUrl |
security_result.detection_fields |
|
settings.signOn.assertionSigned |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].filterType |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].filterValue |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].name |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].namespace |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].type |
security_result.detection_fields |
|
settings.signOn.audience |
security_result.detection_fields |
|
settings.signOn.authnContextClassRef |
security_result.detection_fields |
|
settings.signOn.defaultRelayState |
security_result.detection_fields |
|
settings.signOn.destination |
security_result.detection_fields |
|
settings.signOn.digestAlgorithm |
security_result.detection_fields |
|
settings.signOn.idpIssuer |
security_result.detection_fields |
|
settings.signOn.recipient |
security_result.detection_fields |
|
settings.signOn.responseSigned |
security_result.detection_fields |
|
settings.signOn.signatureAlgorithm |
security_result.detection_fields |
|
settings.signOn.subjectNameIdFormat |
security_result.detection_fields |
|
settings.signOn.subjectNameIdTemplate |
security_result.detection_fields |
|
signOnMode |
security_result.detection_fields |
|
status |
security_result.detection_fields |
|
visibility.appLinks.oidc_client_link |
security_result.detection_fields |
|
visibility.autoSubmitToolbar |
security_result.detection_fields |
|
visibility.hide.iOS |
security_result.detection_fields |
|
visibility.hide.web |
security_result.detection_fields |
|
| T/A | metadata.vendor_name |
Tetapkan ke Okta. |
| T/A | metadata.product_name |
Tetapkan ke Okta. |
| T/A | extensions.auth.type |
Tetapkan ke SSO. |
Tabel pemetaan array
Tabel berikut mencantumkan pemetaan elemen array Okta ke kolom UDM berulang.
| Array log | Array peristiwa | Keterangan |
|---|---|---|
actor.alternateId |
TBD |
|
actor.displayName |
principal.user.user_display_name |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
actor.displayName |
principal.user.user_display_name |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
actor.type |
principal.user.attribute.roles.name |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
actor.type |
principal.user.attribute.roles.name |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
anonymous |
security_result.detection_fields |
|
authenticationContext.externalSessionId |
network.parent_session_id |
|
client.device |
principal.asset.type |
Mendukung: LINUX, WINDOWS, MAC, IOS, ANDROID, CHROME_OS |
client.device |
additional.fields |
Event_type |
client.geographicalContext.city |
principal.location.city |
|
client.geographicalContext.country |
principal.location.country_or_region |
|
client.geographicalContext.geolocation.lat |
principal.location.region_latitude |
|
client.geographicalContext.geolocation.lon |
principal.location.region_longitude |
|
client.geographicalContext.postalCode |
additional.fields |
|
client.geographicalContext.postalCode |
target.resource.attribute.labels |
|
client.ipAddress |
principal.ip |
|
client.userAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
client.userAgent.browser |
target.resource.attribute.labels |
|
client.userAgent.os |
principal.platform |
|
client.userAgent.os |
principal.platform |
|
client.userAgent.rawUserAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
client.zone |
additional.fields |
Event_type |
debugContext.debugData.behaviors.New City |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Country |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Device |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Geo-Location |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New IP |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New State |
security_result.detection_fields |
|
debugContext.debugData.behaviors.Velocity |
security_result.detection_fields |
|
debugContext.debugData.clientAddress |
principal.ipprincipal.asset.ip |
|
debugContext.debugData.dtHash |
security_result.detection_fields |
|
debugContext.debugData.factor |
security_result.detection_fields |
|
debugContext.debugData.factorIntent |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors |
security_result.description |
|
debugContext.debugData.logOnlySecurityData.behaviors.New City |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Country |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Device |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Geo-Location |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New IP |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New State |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.Velocity |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.description |
|
debugContext.debugData.logOnlySecurityData.risk.level |
security_result.severity_details |
|
debugContext.debugData.logOnlySecurityData.url |
target.url |
|
debugContext.debugData.privilegeGranted[] |
target.user.attribute.roles.nametarget.user.attribute.roles.description |
|
debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
debugContext.debugData.requestUri |
extensions.auth.auth_details |
|
debugContext.debugData.requestUri |
target.url |
|
debugContext.debugData.risk |
security_result.detection_fields |
Alasan yang dipetakan ke security_result.detection_fields. |
debugContext.debugData.suspiciousActivityEventId |
security_result.detection_fields |
|
debugContext.debugData.suspiciousActivityEventType |
security_result.detection_fields |
|
debugContext.debugData.threatDetections |
security_result.detection_fields |
|
debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
debugContext.debugData.tunnels[].anonymous |
security_result.detection_fields |
|
debugContext.debugData.tunnels[].operator |
security_result.detection_fields |
|
debugContext.debugData.tunnels[].type |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.anonymous |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.operator |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.type |
security_result.detection_fields |
|
detail.actor.id |
principal.user.product_object_id |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
detail.actor.id |
principal.user.product_object_id |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
detail.authenticationContext.externalSessionId |
network.parent_session_id |
|
detail.client.ipChain.0.ipclient.ipAddress |
principal.ipprincipal.asset.ip |
|
detail.debugContext.debugData.dtHash |
security_result.detection_fields |
|
detail.debugContext.debugData.factor |
security_result.detection_fields |
|
detail.debugContext.debugData.factorIntent |
security_result.detection_fields |
|
detail.debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
detail.debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
detail.debugContext.debugData.requestUri |
target.url |
|
detail.eventType |
metadata.product_event_type |
|
detail.outcome.reason |
security_result.category_details |
|
detail.outcome.result |
security_result.action |
|
detail.request.ipChain.0.geographicalContext.city |
principal.location.city |
|
detail.request.ipChain.0.geographicalContext.country |
principal.location.country_or_region |
|
detail.request.ipChain.0.geographicalContext.state |
principal.location.state |
|
detail.severity |
security_result.severity |
|
detail.target.0.alternateId |
Lihat keterangan. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
detail.target.0.displayName |
target.applicationtarget.resource.name |
|
detail.target.0.displayName |
target.user.user_display_name |
|
detail.target.0.detailEntry.policyType} |
target.resource_ancestors.attribute.labels |
|
detail.target.0.id |
target.resource.product_object_id |
|
detail.target.0.id |
target.resource_ancestors.product_object_id |
|
detail.target.0.type |
target.resource.resource_subtype |
|
detail.target.0.type |
target.resource_ancestors.resource_subtype |
|
detail.uuid |
metadata.product_log_id |
|
displayMessage |
security_result.summary |
|
extensions.auth.type |
SSO |
Event_type |
extensions.auth.type |
SSO |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
eventType |
metadata.product_event_type |
|
eventTypedetail.eventType |
metadata.product_event_type |
|
json_array.n.actor.id |
principal.user.product_object_id |
|
mapped data.fields to fields |
||
metadata.product_name |
Okta |
Event_type |
metadata.vendor_name |
Okta |
Event_type |
msg.actor.alternateId |
Lihat keterangan. | Jika penguraian gagal, ini akan dipetakan ke principal.user.userid atau memetakan nama pengguna ke principal.user.useridatau nama pengguna@domain ke principal.user.email_addresses. |
msg.actor.displayName |
principal.user.user_display_name |
|
msg.actor.type |
principal.user.attribute.roles.name |
|
msg.authenticationContext.authenticationProvider |
security_result.detection_fields |
Event_type |
msg.authenticationContext.credentialProvider |
security_result.detection_fields |
Event_type |
msg.authenticationContext.externalSessionId |
network.parent_session_id |
|
msg.client.device |
principal.asset.type |
Mendukung: MOBILE, WORKSTATION, LAPTOP, IOT, NETWORK_ATTACHED_STORAGE, PRINTER, SCANNER, SERVER, TAPE_LIBRARY |
msg.client.geographicalContext.city |
principal.location.city |
|
msg.client.geographicalContext.country |
principal.location.country_or_region |
|
msg.client.geographicalContext.geolocation.lat |
principal.location.region_latitude |
|
msg.client.geographicalContext.geolocation.lon |
principal.location.region_longitude |
|
msg.client.geographicalContext.postalCode |
additional.fields |
|
msg.client.geographicalContext.state |
principal.location.state |
|
msg.client.ipAddress |
principal.ip |
|
msg.client.userAgent.browser |
target.resource.attribute.labels |
|
msg.client.userAgent.os |
principal.platform |
Mendukung: LINUX, WINDOWS, MAC, IOS, ANDROID, CHROME_OS |
msg.client.userAgent.rawUserAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
msg.debugContext.debugData.dtHash |
security_result.detection_fields |
|
msg.debugContext.debugData.factor |
security_result.detection_fields |
|
msg.debugContext.debugData.factorIntent |
security_result.detection_fields |
|
msg.debugContext.debugData.logOnlySecurityData.behaviors |
security_result.description |
|
msg.debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.detection_fields |
|
msg.debugContext.debugData.logOnlySecurityData.url |
target.url |
|
msg.debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
msg.debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
msg.debugContext.debugData.requestUri |
extensions.auth.auth_details |
|
msg.debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
msg.displayMessage |
security_result.summary |
|
msg.eventType |
metadata.product_event_type |
|
msg.legacyEventType |
security_result.detection_fields |
|
msg.outcome.reason |
security_result.category_details |
|
msg.outcome.result |
security_result.action |
|
msg.published |
metadata.event_timestamp |
|
msg.request.ipChain.n.geographicalContext.city |
intermediary[n].location.city |
|
msg.request.ipChain.n.geographicalContext.country |
intermediary[n].location.country_or_region |
|
msg.request.ipChain.n.geographicalContext.geolocation.lat |
intermediary[n].location.region_latitude |
|
msg.request.ipChain.n.geographicalContext.geolocation.lon |
intermediary[n].location.region_longitude |
|
msg.request.ipChain.n.geographicalContext.state |
intermediary[n].location.state |
|
msg.request.ipChain.n.ip |
intermediary[n].ip |
|
msg.securityContext.asNumber |
security_result.detection_fields |
|
msg.securityContext.asOrg |
security_result.detection_fields |
|
msg.securityContext.domain |
security_result.detection_fields |
|
msg.securityContext.isProxy |
security_result.detection_fields |
|
msg.securityContext.isp |
security_result.detection_fields |
|
msg.severity |
security_result.severity |
|
msg.target.alternateId (when msg.target.type == User) |
target.user.email_addresses |
Jika msg.target.type = User. Namun, jika penguraian gagal, hal ini akan dipetakan ke target.user.useridatau jika tidak, target_user_name akan dipetakan ke target.user.userid. |
msg.target.detailEntry.policyType |
target.resource_ancestors.attribute.labels |
Jika msg.target.type = PolicyEntity. |
msg.target.detailEntry.signOnModeType |
security_result.detection_fields |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.displayName |
additional.fields |
|
msg.target.displayName |
about.resource.name |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.displayName |
principal.user.user_display_name |
Jika msg.target.type = User. |
msg.target.displayName |
target.application |
Jika msg.target.type = AppInstance. |
msg.target.displayName |
target.resource.name |
Jika msg.target.type = AppInstance. |
msg.target.displayName |
target.resource.name |
Jika msg.target.type = PolicyRule. |
msg.target.displayName |
target.resource_ancestors.name |
Jika msg.target.type = PolicyEntity. |
msg.target.id |
about.resource.product_object_id |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.id |
target.resource.product_object_id |
Jika msg.target.type = AppInstance. |
msg.target.id |
target.resource.product_object_id |
Jika msg.target.type = PolicyRule. |
msg.target.id |
target.resource_ancestors.product_object_id |
Jika msg.target.type = PolicyEntity. |
msg.target.id |
target.user.product_object_id |
Jika msg.target.type = User. |
msg.target.type |
about.resource.resource_subtype |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.type |
target.resource.resource_subtype |
Jika msg.target.type = AppInstance. |
msg.target.type |
target.resource.resource_subtype |
Jika msg.target.type = PolicyRule. |
msg.target.type |
target.resource_ancestors.resource_subtype |
Jika msg.target.type = PolicyEntity. |
msg.target.type |
target.user.attribute.roles.name |
Jika msg.target.type = User. |
msg.transaction.id |
network.session_id |
|
msg.transaction.type |
additional.fields |
Event_type |
msg.uuid |
metadata.product_log_id |
|
operator |
security_result.detection_fields |
|
outcome.reasondetail.outcome.reason |
security_result.category_details |
|
outcome.resultdetail.outcome.result |
security_result.action |
|
profile.displayName |
principal.user.user_display_name |
|
profile.email |
principal.user.email_addresses |
|
profile.login |
principal.user.userid |
username => principal.user.userid |
published |
metadata.event_timestamp |
|
published |
metadata.event_timestamp |
|
request.ipChain.0.geographicalContext.citydetail.request.ipChain.0.geographicalContext.city |
principal.location.city |
|
request.ipChain.0.geographicalContext.countrydetail.request.ipChain.0.geographicalContext.country |
principal.location.country_or_region |
|
request.ipChain.0.geographicalContext.statedetail.request.ipChain.0.geographicalContext.state |
principal.location.state |
|
request.ipChain.0.ip |
principal.ipprincipal.asset.ip |
|
request.ipChain.1.geographicalContext.city |
intermediary.location.city |
|
request.ipChain.1.geographicalContext.country |
intermediary.location.country_or_region |
|
request.ipChain.1.geographicalContext.state |
intermediary.location.state |
|
securityContext.asNumber |
security_result.detection_fields |
|
securityContext.asOrg |
security_result.detection_fields |
|
securityContext.domain |
security_result.detection_fields |
|
securityContext.isProxy |
security_result.detection_fields |
|
securityContext.isProxy |
security_result.detection_fieldsadditional.fields |
|
securityContext.isp |
security_result.detection_fields |
|
severitydetail.severity |
security_result.severity |
|
target[].alternateId |
target.resource.attribute.labels |
|
target[].detailEntry.methodTypeUsed |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.methodUsedVerifiedProperties |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.policyRuleFactorMode |
security_result.detection_fields |
|
target[].detailEntry.policyType |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.signOnModeType |
security_result.detection_fields |
|
target[].displayName |
additional.fields |
|
target[].displayName |
target.applicationtarget.resource.name |
|
target[].displayName |
target.resource.name |
|
target[].displayName |
target.resource_ancestors.name |
|
target[].id |
target.resource.product_object_id |
|
target[].id |
target.resource_ancestors.product_object_id |
|
target[].type |
target.resource.resource_subtype |
|
target[].type |
target.resource_ancestors.resource_subtype |
|
target.0.alternateId |
Lihat keterangan. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
target.0.detailEntry.clientAppId |
target.asset_id |
|
target.0.displayNamedetail.target.0.displayName |
target.user.user_display_name |
|
target.0.displayName/target.1.displayName |
target.user.group_identifiers |
|
target.0.id |
target.user.product_object_id |
|
target.0.typedetail.target.0.type |
target.user.attribute.roles.name |
|
target.1.alternateId |
Lihat keterangan. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
target.1.detailEntry.clientAppId |
target.asset_id |
|
target.1.displayName |
target.user.user_display_name |
|
target.1.id |
target.user.product_object_id |
|
target.1.type |
target.user.attribute.roles.name |
|
transaction.id |
network.session_id |
|
type |
security_result.detection_fields |
|
user_agent.browser |
target.resource.attribute.labels |
|
user_email |
principal.user.email_addresses |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
user_email |
principal.user.email_addresses |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
user_id |
principal.user.userid |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
user_id |
principal.user.userid |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
uuid |
metadata.product_log_id |
|
uuid |
metadata.product_log_id |
Referensi delta pemetaan UDM
Pada 26 Agustus 2025, Google SecOps merilis versi baru parser Okta, yang mencakup perubahan signifikan pada pemetaan kolom log Okta ke kolom UDM dan perubahan pada pemetaan jenis peristiwa.
Delta pemetaan kolom log
Tabel berikut mencantumkan delta pemetaan untuk kolom log Okta ke UDM yang diekspos sebelum 26 Agustus 2025 dan setelahnya (masing-masing tercantum dalam kolom Pemetaan lama dan Pemetaan saat ini).
| Kolom log | Pemetaan lama | Pemetaan saat ini |
|---|---|---|
client.geographicalContext.geolocation.lat |
target.location.region_latitude |
principal.location.region_coordinates.latitude |
client.geographicalContext.geolocation.lon |
target.location.region_longitude |
principal.location.region_coordinates.longitude |
created |
target.resource.attribute.labels |
metadata.event_timestamp |
debugContext.debugData.authnRequestId |
additional.fields |
security_result.detection_fields |
debugContext.debugData.factorType |
additional.fields |
security_result.detection_fields |
debugContext.debugData.traceId |
additional.fields |
security_result.detection_fields |
debugContext.debugData.tunnels.anonymous |
security_result.detection_fields |
network.proxy_info.anonymous |
lastUpdated |
target.resource.attribute.labels |
target.resource.attribute.last_update_time |
platform jika platformnya adalah iOS |
principal.platform = MAC |
principal.platform = IOS |
securityContext.asOrg |
security_result.detection_fields |
network.organization_name |
securityContext.isProxy |
additional.fields |
network.is_proxy |
target.detailEntry.methodTypeUsed |
target.resource.attribute.labels |
security_result.detection_fields |
target.detailEntry.methodUsedVerifiedProperties |
target.resource.attribute.labels |
security_result.detection_fields |
Delta pemetaan jenis peristiwa
Beberapa peristiwa yang sebelumnya diklasifikasikan sebagai peristiwa umum kini diklasifikasikan dengan benar menggunakan jenis peristiwa yang bermakna.
Tabel berikut mencantumkan delta untuk penanganan jenis peristiwa Okta sebelum 26 Agustus 2025 dan setelahnya (masing-masing tercantum dalam kolom event_type lama dan event-type saat ini).
| eventType dari log | event_type lama | event_type saat ini |
|---|---|---|
app.oauth2.as.authorize |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.code |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.implicit.access_token |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.implicit.id_token |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.authorize.code |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.token.grant |
USER_UNCATEGORIZED |
USER_LOGIN |
application.user_membership.remove |
USER_UNCATEGORIZED |
USER_CHANGE_PERMISSIONS |
application.user_membership.update |
STATUS_UPDATE |
USER_CHANGE_PERMISSIONS |
user.authentication.auth_via_AD_agent |
STATUS_UPDATE |
USER_UNCATEGORIZED |
user.authentication.slo |
USER_UNCATEGORIZED |
USER_LOGOUT |
Log Perubahan
Melihat Log Perubahan untuk parser ini
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.