Mengumpulkan log Okta
Didukung di:
Google SecOps
SIEM
Dokumen ini menjelaskan cara menyerap log Okta ke Google Security Operations menggunakan Okta API. Parser mengekstrak log sistem, menangani peristiwa tunggal dan peristiwa batch dalam array JSON. Data dinormalisasi ke dalam format UDM, memetakan kolom Okta ke kolom UDM yang setara, memperkaya data dengan agen pengguna yang di-parsing, informasi geografis, dan detail autentikasi, serta menghasilkan peristiwa hasil keamanan berdasarkan hasil dan informasi risiko.
Sebelum memulai
- Instance Google SecOps
- Akses istimewa ke Okta
Cara mengonfigurasi Okta
Untuk mengonfigurasi SSO Okta, selesaikan tugas berikut:
Membuat pengguna Administratif Okta dengan hak istimewa hanya baca
- Login ke konsol administrator Okta.
Buat Pengguna Standar.
- Buka Direktori > Orang.
- Klik Tambahkan orang dan lengkapi kolom yang wajib diisi.
Pilih Security > Administrators.
Klik Tambahkan Administrator.
Di kolom Penetapan administrator oleh admin, temukan Pengguna Standar.
Di bagian roles, pilih Read-Only Administrator dari daftar.
Logout dari akun administrator.
Mendapatkan kunci API
- Login ke Konsol Administrator Okta dengan pengguna administrator hanya baca.
- Buka Security > API > Tokens.
- Klik Create Token.
- Berikan nama yang bermakna untuk token.
- Berikan zona IP tempat API akan digunakan (Anda dapat memilih IP apa pun jika tidak yakin).
- Klik Create Token.
- Salin kunci API.
- Klik Oke, paham.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
- Setelan SIEM > Feed > Tambahkan Feed Baru
- Hub Konten > Paket Konten > Mulai
Cara menyiapkan feed Okta
Untuk mengonfigurasi jenis log ini, ikuti langkah-langkah berikut:
- Klik paket Okta.
- Temukan jenis log Okta.
Tentukan nilai untuk kolom berikut:
- Jenis Sumber: API pihak ketiga (direkomendasikan)
- Header HTTP autentikasi: Masukkan Kunci API Okta dalam format berikut:
Authorization:<API_KEY>. - Nama Host API: Tentukan nama domain host Okta Anda (misalnya,
<your-domain>.okta.com). - Namespace aset: Namespace aset.
- Label penyerapan: Label yang diterapkan ke peristiwa dari feed ini.
Opsi lanjutan
- Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
- Namespace Aset: Namespace yang terkait dengan feed.
- Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat Feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Tabel pemetaan UDM
| Kolom Log | Pemetaan UDM | Logika |
|---|---|---|
user_email |
event.idm.read_-only_udm.network.email.from |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.cidr_ip |
event.idm.read_only_udm.target.ip |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.cidr_ip |
event.idm.read_only_udm.target.asset.ip |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.range |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
debugContext.debugData.zoneData.CIDR |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
debugContext.debugData.requestId |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
debugContext.debugData.targetEventHookIds |
event.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
id |
event1.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
details.type |
event1.idm.read_only_udm.metadata.product_event_type |
Dipetakan dari log perubahan |
details.actor.name |
event1.idm.read_only_udm.principal.user.userid |
Dipetakan dari log perubahan |
details.actor.details.full_name |
event1.idm.read_only_udm.principal.user.user_display_name |
Dipetakan dari log perubahan |
details.actor.details.first_name |
event1.idm.read_only_udm.principal.user.first_name |
Dipetakan dari log perubahan |
details.actor.details.last_name |
event1.idm.read_only_udm.principal.user.last_name |
Dipetakan dari log perubahan |
details.actor.id |
event1.idm.read_only_udm.principal.user.employee_id |
Dipetakan dari log perubahan |
details.client.hostname |
event1.idm.read_only_udm.principal.hostname |
Dipetakan dari log perubahan |
details.client.hostname |
event1.idm.read_only_udm.principal.asset.hostname |
Dipetakan dari log perubahan |
details.client.id |
event1.idm.read_only_udm.principal.user.product_object_id |
Dipetakan dari log perubahan |
details.client.description |
event1.idm.read_only_udm.principal.application |
Dipetakan dari log perubahan |
details.client.os |
event1.idm.read_only_udm.principal.platform |
Dipetakan dari log perubahan |
details.client.os |
event1.idm.read_only_udm.principal.platform_version |
Dipetakan dari log perubahan |
details.team_id |
event1.idm.read_only_udm.target.resource.id |
Dipetakan dari log perubahan |
details.team_id |
event1.idm.read_only_udm.principal.resource.id |
Dipetakan dari log perubahan |
details.team_name |
event1.idm.read_only_udm.additional.fields |
Dipetakan dari log perubahan |
details.client.state |
event1.idm.read_only_udm.principal.resource.attribute.labels |
Dipetakan dari log perubahan |
details.target_server |
event1.idm.read_only_udm.target.application |
Dipetakan dari log perubahan |
details.via |
event1.idm.read_only_udm.network.session_id |
Dipetakan dari log perubahan |
details_session_type |
event1.idm.read_only_udm.security_result.detection_fields |
Dipetakan dari log perubahan |
details.actor.details.user_type |
event1.idm.read_only_udm.principal.user.attribute.roles |
Dipetakan dari log perubahan |
details.trace_id |
event1.idm.read_only_udm.network.session_id |
Dipetakan dari log perubahan |
details.client.encrypted |
event1.idm.read_only_udm.principal.asset.attribute.labels |
Dipetakan dari log perubahan |
details.client.user_name |
event1.idm.read_only_udm.target.user.userid |
Dipetakan dari log perubahan |
details.client_ip |
event1.idm.read_only_udm.principal.ip |
Dipetakan dari log perubahan |
details.client_ip |
event1.idm.read_only_udm.principal.asset.ip |
Dipetakan dari log perubahan |
details.project.id |
event1.idm.read_only_udm.target.resource.id |
Dipetakan dari log perubahan |
details.project.team |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.create_server_users |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.force_shared_ssh_users |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.forward_traffic |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.rdp_session_recording |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.require_preauth_for_creds |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.ssh_certificate_type |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.ssh_session_recording |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.next_unix_gid |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.project.next_unix_uid |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server_hostnames |
event1.idm.read_only_udm.target.hostname |
Dipetakan dari log perubahan |
details.server_hostnames |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
server_cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_instance_type |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_network |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_project_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_zone_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
detailsserver_os |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_services |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_sftd_version |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_source |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details._type |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.internal_ip |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.network |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_details.project_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.os |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.project_name |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source_details.cloud_account |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source_details.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.source_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details._type |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.internal_ip |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.network |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_details.project_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.os |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.project_name |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source_details.cloud_account |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source_details.cloud_provider |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.source_details.instance_id |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
server_source_details |
event1.idm.read_only_udm.intermediary.resource.attribute.labels |
Dipetakan dari log perubahan |
detailsserver.team_name |
event1.idm.read_only_udm.intermediary.user.department |
Dipetakan dari log perubahan |
details.username |
event1.idm.read_only_udm.target.user.user_display_name |
Dipetakan dari log perubahan |
details.ssh_key_fingerprint |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.unix_user_name |
event1.idm.read_only_udm.principal.user.userid |
Dipetakan dari log perubahan |
details.ssh_algorithm |
event1.idm.read_only_udm.network.tls.cipher |
Dipetakan dari log perubahan |
details.servers.alt_names |
event1.idm.read_only_udm.target.hostname |
Dipetakan dari log perubahan |
details.servers.alt_names |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.server.alt_names |
event1.idm.read_only_udm.target.hostname |
Dipetakan dari log perubahan |
details.server.alt_names |
event1.idm.read_only_udm.target.resource.attribute.labels |
Dipetakan dari log perubahan |
details.servers.access_address |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.server.access_address |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.servers.external_ip |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.server.external_ip |
event1.idm.read_only_udm.intermediary.ip |
Dipetakan dari log perubahan |
details.server.sftd_version |
event1.idm.read_only_udm.metadata.product_version |
Dipetakan dari log perubahan |
details.servers.sftd_version |
event1.idm.read_only_udm.metadata.product_version |
Dipetakan dari log perubahan |
details.server.instance_details.zone_id |
event1.idm.read_only_udm.intermediary.location.country_or_region |
Dipetakan dari log perubahan |
details.servers.instance_details.zone_id |
event1.idm.read_only_udm.intermediary.location.country_or_region |
Dipetakan dari log perubahan |
debugContext.debugData.authType" and "debugContext.debugData.factorType |
additional.fields |
Dipetakan dari log perubahan |
risk.level |
security_result.severity_details |
Dipetakan dari log perubahan |
risk.reasons |
security_result.description |
Dipetakan dari log perubahan |
actor.displayName" and "target.displayName |
additional.fields |
Dipetakan dari log perubahan |
anonymous", "operator", and "type |
security_result.detection_fields |
Dipetakan dari log perubahan |
tunnels" and "policyRuleFactorMode |
security_result.detection_fields |
Dipetakan dari log perubahan |
profile.displayName |
principal.user.user_display_name |
Dipetakan dari log perubahan |
profile.email |
principal.user.email_addresses |
Dipetakan dari log perubahan |
target.0.alternateId |
target.user.userid |
Dipetakan dari log perubahan |
target.1.alternateId |
target.user.userid |
Dipetakan dari log perubahan |
securityContext.asNumber |
security_result.detection_fields |
Dipetakan dari log perubahan |
legacyEventType |
security_result.detection_fields |
Dipetakan dari log perubahan |
target.displayName |
target.resource_ancestors.name |
Dipetakan dari log perubahan |
targetfield.detailEntry.methodTypeUsed |
target.resource_ancestors.attribute.labels |
Dipetakan dari log perubahan |
targetfield.detailEntry.methodUsedVerifiedProperties |
target.resource_ancestors.attribute.labels |
Dipetakan dari log perubahan |
debugContext.debugData.changedAttributes |
security_result.detection_fields |
Dipetakan dari log perubahan |
client.userAgent.os |
principal.platform |
Dipetakan dari log perubahan |
client.device |
principal.asset.type |
Dipetakan dari log perubahan |
target.0.detailEntry.clientAppId |
target.asset_id |
Dipetakan dari log perubahan |
| Kolom log | Pemetaan UDM | Keterangan |
| :--- | :--- | :--- |
actor.displayName |
principal.resource.attribute.labels |
|
assigned_group[] |
security_result.detection_fields |
|
created |
target.resource.attribute.labels |
|
credentials.oauthClient.autoKeyRotation |
security_result.detection_fields |
|
credentials.oauthClient.pkce_required |
security_result.detection_fields |
|
credentials.oauthClient.token_endpoint_auth_method |
security_result.detection_fields |
|
credentials.signing.kid |
security_result.detection_fields |
|
credentials.userNameTemplate.pushStatus |
security_result.detection_fields |
|
credentials.userNameTemplate.template |
metadata.product_event_type |
|
credentials.userNameTemplate.type |
security_result.detection_fields |
|
id |
principal.user.userid |
|
label |
target.resource.attribute.labels |
|
lastUpdated |
target.resource.attribute.labels |
|
orn |
target.resource.attribute.labels |
|
settings.implicitAssignment |
security_result.detection_fields |
|
settings.manualProvisioning |
security_result.detection_fields |
|
settings.notifications.vpn.network.connection |
security_result.detection_fields |
|
settings.notifications.vpn.network.helpUrl |
security_result.detection_fields |
|
settings.notifications.vpn.network.message |
security_result.detection_fields |
|
settings.oauthClient.application_type |
security_result.detection_fields |
|
settings.oauthClient.client_uri |
security_result.detection_fields |
|
settings.oauthClient.consent_method |
security_result.detection_fields |
|
settings.oauthClient.dpop_bound_access_tokens |
security_result.detection_fields |
|
settings.oauthClient.grant_types[] |
security_result.detection_fields |
|
settings.oauthClient.idp_initiated_login.mode |
security_result.detection_fields |
|
settings.oauthClient.initiate_login_uri |
security_result.detection_fields |
|
settings.oauthClient.issuer_mode |
security_result.detection_fields |
|
settings.oauthClient.logo_uri |
security_result.detection_fields |
|
settings.oauthClient.pkce_required |
security_result.detection_fields |
|
settings.oauthClient.redirect_uris[] |
security_result.detection_fields |
|
settings.oauthClient.response_types[] |
security_result.detection_fields |
|
settings.oauthClient.token_endpoint_auth_method |
security_result.detection_fields |
|
settings.oauthClient.wildcard_redirect |
security_result.detection_fields |
|
settings.signOn.acsUrl |
security_result.detection_fields |
|
settings.signOn.assertionSigned |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].filterType |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].filterValue |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].name |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].namespace |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].type |
security_result.detection_fields |
|
settings.signOn.audience |
security_result.detection_fields |
|
settings.signOn.authnContextClassRef |
security_result.detection_fields |
|
settings.signOn.defaultRelayState |
security_result.detection_fields |
|
settings.signOn.destination |
security_result.detection_fields |
|
settings.signOn.digestAlgorithm |
security_result.detection_fields |
|
settings.signOn.idpIssuer |
security_result.detection_fields |
|
settings.signOn.recipient |
security_result.detection_fields |
|
settings.signOn.responseSigned |
security_result.detection_fields |
|
settings.signOn.signatureAlgorithm |
security_result.detection_fields |
|
settings.signOn.subjectNameIdFormat |
security_result.detection_fields |
|
settings.signOn.subjectNameIdTemplate |
security_result.detection_fields |
|
signOnMode |
security_result.detection_fields |
|
status |
security_result.detection_fields |
|
visibility.appLinks.oidc_client_link |
security_result.detection_fields |
|
visibility.autoSubmitToolbar |
security_result.detection_fields |
|
visibility.hide.iOS |
security_result.detection_fields |
|
visibility.hide.web |
security_result.detection_fields |
|
| T/A | metadata.vendor_name |
Tetapkan ke Okta. |
| T/A | metadata.product_name |
Tetapkan ke Okta. |
| T/A | extensions.auth.type |
Tetapkan ke SSO. |
Tabel pemetaan array
Tabel berikut mencantumkan pemetaan elemen array Okta ke kolom UDM berulang.
| Array log | Array peristiwa | Keterangan |
|---|---|---|
actor.alternateId |
TBD |
|
actor.displayName |
principal.user.user_display_name |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
actor.displayName |
principal.user.user_display_name |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
actor.type |
principal.user.attribute.roles.name |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
actor.type |
principal.user.attribute.roles.name |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
anonymous |
security_result.detection_fields |
|
authenticationContext.externalSessionId |
network.parent_session_id |
|
client.device |
principal.asset.type |
Mendukung: LINUX, WINDOWS, MAC, IOS, ANDROID, CHROME_OS |
client.device |
additional.fields |
Event_type |
client.geographicalContext.city |
principal.location.city |
|
client.geographicalContext.country |
principal.location.country_or_region |
|
client.geographicalContext.geolocation.lat |
principal.location.region_latitude |
|
client.geographicalContext.geolocation.lon |
principal.location.region_longitude |
|
client.geographicalContext.postalCode |
additional.fields |
|
client.geographicalContext.postalCode |
target.resource.attribute.labels |
|
client.ipAddress |
principal.ip |
|
client.userAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
client.userAgent.browser |
target.resource.attribute.labels |
|
client.userAgent.os |
principal.platform |
|
client.userAgent.os |
principal.platform |
|
client.userAgent.rawUserAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
client.zone |
additional.fields |
Event_type |
debugContext.debugData.behaviors.New City |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Country |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Device |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Geo-Location |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New IP |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New State |
security_result.detection_fields |
|
debugContext.debugData.behaviors.Velocity |
security_result.detection_fields |
|
debugContext.debugData.clientAddress |
principal.ipprincipal.asset.ip |
|
debugContext.debugData.dtHash |
security_result.detection_fields |
|
debugContext.debugData.factor |
security_result.detection_fields |
|
debugContext.debugData.factorIntent |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors |
security_result.description |
|
debugContext.debugData.logOnlySecurityData.behaviors.New City |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Country |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Device |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Geo-Location |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New IP |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New State |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.Velocity |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.description |
|
debugContext.debugData.logOnlySecurityData.risk.level |
security_result.severity_details |
|
debugContext.debugData.logOnlySecurityData.url |
target.url |
|
debugContext.debugData.privilegeGranted[] |
target.user.attribute.roles.nametarget.user.attribute.roles.description |
|
debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
debugContext.debugData.requestUri |
extensions.auth.auth_details |
|
debugContext.debugData.requestUri |
target.url |
|
debugContext.debugData.risk |
security_result.detection_fields |
Memetakan alasan ke security_result.detection_fields. |
debugContext.debugData.suspiciousActivityEventId |
security_result.detection_fields |
|
debugContext.debugData.suspiciousActivityEventType |
security_result.detection_fields |
|
debugContext.debugData.threatDetections |
security_result.detection_fields |
|
debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
debugContext.debugData.tunnels[].anonymous |
security_result.detection_fields |
|
debugContext.debugData.tunnels[].operator |
security_result.detection_fields |
|
debugContext.debugData.tunnels[].type |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.anonymous |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.operator |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.type |
security_result.detection_fields |
|
detail.actor.id |
principal.user.product_object_id |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
detail.actor.id |
principal.user.product_object_id |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
detail.authenticationContext.externalSessionId |
network.parent_session_id |
|
detail.client.ipChain.0.ipclient.ipAddress |
principal.ipprincipal.asset.ip |
|
detail.debugContext.debugData.dtHash |
security_result.detection_fields |
|
detail.debugContext.debugData.factor |
security_result.detection_fields |
|
detail.debugContext.debugData.factorIntent |
security_result.detection_fields |
|
detail.debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
detail.debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
detail.debugContext.debugData.requestUri |
target.url |
|
detail.eventType |
metadata.product_event_type |
|
detail.outcome.reason |
security_result.category_details |
|
detail.outcome.result |
security_result.action |
|
detail.request.ipChain.0.geographicalContext.city |
principal.location.city |
|
detail.request.ipChain.0.geographicalContext.country |
principal.location.country_or_region |
|
detail.request.ipChain.0.geographicalContext.state |
principal.location.state |
|
detail.severity |
security_result.severity |
|
detail.target.0.alternateId |
Lihat catatan. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
detail.target.0.displayName |
target.applicationtarget.resource.name |
|
detail.target.0.displayName |
target.user.user_display_name |
|
detail.target.0.detailEntry.policyType} |
target.resource_ancestors.attribute.labels |
|
detail.target.0.id |
target.resource.product_object_id |
|
detail.target.0.id |
target.resource_ancestors.product_object_id |
|
detail.target.0.type |
target.resource.resource_subtype |
|
detail.target.0.type |
target.resource_ancestors.resource_subtype |
|
detail.uuid |
metadata.product_log_id |
|
displayMessage |
security_result.summary |
|
extensions.auth.type |
SSO |
Event_type |
extensions.auth.type |
SSO |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
eventType |
metadata.product_event_type |
|
eventTypedetail.eventType |
metadata.product_event_type |
|
json_array.n.actor.id |
principal.user.product_object_id |
|
mapped data.fields to fields |
||
metadata.product_name |
Okta |
Event_type |
metadata.vendor_name |
Okta |
Event_type |
msg.actor.alternateId |
Lihat catatan. | Jika penguraian gagal, ini dipetakan ke principal.user.userid atau memetakan nama pengguna ke principal.user.useridatau username@domain ke principal.user.email_addresses. |
msg.actor.displayName |
principal.user.user_display_name |
|
msg.actor.type |
principal.user.attribute.roles.name |
|
msg.authenticationContext.authenticationProvider |
security_result.detection_fields |
Event_type |
msg.authenticationContext.credentialProvider |
security_result.detection_fields |
Event_type |
msg.authenticationContext.externalSessionId |
network.parent_session_id |
|
msg.client.device |
principal.asset.type |
Mendukung: MOBILE, WORKSTATION, LAPTOP, IOT, NETWORK_ATTACHED_STORAGE, PRINTER, SCANNER, SERVER, TAPE_LIBRARY |
msg.client.geographicalContext.city |
principal.location.city |
|
msg.client.geographicalContext.country |
principal.location.country_or_region |
|
msg.client.geographicalContext.geolocation.lat |
principal.location.region_latitude |
|
msg.client.geographicalContext.geolocation.lon |
principal.location.region_longitude |
|
msg.client.geographicalContext.postalCode |
additional.fields |
|
msg.client.geographicalContext.state |
principal.location.state |
|
msg.client.ipAddress |
principal.ip |
|
msg.client.userAgent.browser |
target.resource.attribute.labels |
|
msg.client.userAgent.os |
principal.platform |
Mendukung: LINUX, WINDOWS, MAC, IOS, ANDROID, CHROME_OS |
msg.client.userAgent.rawUserAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
msg.debugContext.debugData.dtHash |
security_result.detection_fields |
|
msg.debugContext.debugData.factor |
security_result.detection_fields |
|
msg.debugContext.debugData.factorIntent |
security_result.detection_fields |
|
msg.debugContext.debugData.logOnlySecurityData.behaviors |
security_result.description |
|
msg.debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.detection_fields |
|
msg.debugContext.debugData.logOnlySecurityData.url |
target.url |
|
msg.debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
msg.debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
msg.debugContext.debugData.requestUri |
extensions.auth.auth_details |
|
msg.debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
msg.displayMessage |
security_result.summary |
|
msg.eventType |
metadata.product_event_type |
|
msg.legacyEventType |
security_result.detection_fields |
|
msg.outcome.reason |
security_result.category_details |
|
msg.outcome.result |
security_result.action |
|
msg.published |
metadata.event_timestamp |
|
msg.request.ipChain.n.geographicalContext.city |
intermediary[n].location.city |
|
msg.request.ipChain.n.geographicalContext.country |
intermediary[n].location.country_or_region |
|
msg.request.ipChain.n.geographicalContext.geolocation.lat |
intermediary[n].location.region_latitude |
|
msg.request.ipChain.n.geographicalContext.geolocation.lon |
intermediary[n].location.region_longitude |
|
msg.request.ipChain.n.geographicalContext.state |
intermediary[n].location.state |
|
msg.request.ipChain.n.ip |
intermediary[n].ip |
|
msg.securityContext.asNumber |
security_result.detection_fields |
|
msg.securityContext.asOrg |
security_result.detection_fields |
|
msg.securityContext.domain |
security_result.detection_fields |
|
msg.securityContext.isProxy |
security_result.detection_fields |
|
msg.securityContext.isp |
security_result.detection_fields |
|
msg.severity |
security_result.severity |
|
msg.target.alternateId (when msg.target.type == User) |
target.user.email_addresses |
Saat msg.target.type = User. Namun, jika penguraian gagal, hal ini dipetakan ke target.user.useridatau target_user_name dipetakan ke target.user.userid. |
msg.target.detailEntry.policyType |
target.resource_ancestors.attribute.labels |
Saat msg.target.type = PolicyEntity. |
msg.target.detailEntry.signOnModeType |
security_result.detection_fields |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.displayName |
additional.fields |
|
msg.target.displayName |
about.resource.name |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.displayName |
principal.user.user_display_name |
Saat msg.target.type = User. |
msg.target.displayName |
target.application |
Saat msg.target.type = AppInstance. |
msg.target.displayName |
target.resource.name |
Saat msg.target.type = AppInstance. |
msg.target.displayName |
target.resource.name |
Saat msg.target.type = PolicyRule. |
msg.target.displayName |
target.resource_ancestors.name |
Saat msg.target.type = PolicyEntity. |
msg.target.id |
about.resource.product_object_id |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.id |
target.resource.product_object_id |
Saat msg.target.type = AppInstance. |
msg.target.id |
target.resource.product_object_id |
Saat msg.target.type = PolicyRule. |
msg.target.id |
target.resource_ancestors.product_object_id |
Saat msg.target.type = PolicyEntity. |
msg.target.id |
target.user.product_object_id |
Saat msg.target.type = User. |
msg.target.type |
about.resource.resource_subtype |
Jika msg.target.type adalah kasus selain AppInstance, PolicyEntity, PolicyRule, atau User. |
msg.target.type |
target.resource.resource_subtype |
Saat msg.target.type = AppInstance. |
msg.target.type |
target.resource.resource_subtype |
Saat msg.target.type = PolicyRule. |
msg.target.type |
target.resource_ancestors.resource_subtype |
Saat msg.target.type = PolicyEntity. |
msg.target.type |
target.user.attribute.roles.name |
Saat msg.target.type = User. |
msg.transaction.id |
network.session_id |
|
msg.transaction.type |
additional.fields |
Event_type |
msg.uuid |
metadata.product_log_id |
|
operator |
security_result.detection_fields |
|
outcome.reasondetail.outcome.reason |
security_result.category_details |
|
outcome.resultdetail.outcome.result |
security_result.action |
|
profile.displayName |
principal.user.user_display_name |
|
profile.email |
principal.user.email_addresses |
|
profile.login |
principal.user.userid |
username => principal.user.userid |
published |
metadata.event_timestamp |
|
published |
metadata.event_timestamp |
|
request.ipChain.0.geographicalContext.citydetail.request.ipChain.0.geographicalContext.city |
principal.location.city |
|
request.ipChain.0.geographicalContext.countrydetail.request.ipChain.0.geographicalContext.country |
principal.location.country_or_region |
|
request.ipChain.0.geographicalContext.statedetail.request.ipChain.0.geographicalContext.state |
principal.location.state |
|
request.ipChain.0.ip |
principal.ipprincipal.asset.ip |
|
request.ipChain.1.geographicalContext.city |
intermediary.location.city |
|
request.ipChain.1.geographicalContext.country |
intermediary.location.country_or_region |
|
request.ipChain.1.geographicalContext.state |
intermediary.location.state |
|
securityContext.asNumber |
security_result.detection_fields |
|
securityContext.asOrg |
security_result.detection_fields |
|
securityContext.domain |
security_result.detection_fields |
|
securityContext.isProxy |
security_result.detection_fields |
|
securityContext.isProxy |
security_result.detection_fieldsadditional.fields |
|
securityContext.isp |
security_result.detection_fields |
|
severitydetail.severity |
security_result.severity |
|
target[].alternateId |
target.resource.attribute.labels |
|
target[].detailEntry.methodTypeUsed |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.methodUsedVerifiedProperties |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.policyRuleFactorMode |
security_result.detection_fields |
|
target[].detailEntry.policyType |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.signOnModeType |
security_result.detection_fields |
|
target[].displayName |
additional.fields |
|
target[].displayName |
target.applicationtarget.resource.name |
|
target[].displayName |
target.resource.name |
|
target[].displayName |
target.resource_ancestors.name |
|
target[].id |
target.resource.product_object_id |
|
target[].id |
target.resource_ancestors.product_object_id |
|
target[].type |
target.resource.resource_subtype |
|
target[].type |
target.resource_ancestors.resource_subtype |
|
target.0.alternateId |
Lihat catatan. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
target.0.detailEntry.clientAppId |
target.asset_id |
|
target.0.displayNamedetail.target.0.displayName |
target.user.user_display_name |
|
target.0.displayName/target.1.displayName |
target.user.group_identifiers |
|
target.0.id |
target.user.product_object_id |
|
target.0.typedetail.target.0.type |
target.user.attribute.roles.name |
|
target.1.alternateId |
Lihat catatan. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
target.1.detailEntry.clientAppId |
target.asset_id |
|
target.1.displayName |
target.user.user_display_name |
|
target.1.id |
target.user.product_object_id |
|
target.1.type |
target.user.attribute.roles.name |
|
transaction.id |
network.session_id |
|
type |
security_result.detection_fields |
|
user_agent.browser |
target.resource.attribute.labels |
|
user_email |
principal.user.email_addresses |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
user_email |
principal.user.email_addresses |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
user_id |
principal.user.userid |
Jika eventType adalah application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
user_id |
principal.user.userid |
Jika eventType bukan application.user_membership.update, policy.rule.update, atau user.authentication.auth_via_radius. |
uuid |
metadata.product_log_id |
|
uuid |
metadata.product_log_id |
Referensi delta pemetaan UDM
Pada 26 Agustus 2025, Google SecOps merilis parser Okta versi baru, yang mencakup perubahan signifikan pada pemetaan kolom log Okta ke kolom UDM dan perubahan pada pemetaan jenis peristiwa.
Delta pemetaan kolom log
Tabel berikut mencantumkan perbedaan pemetaan untuk kolom log Okta ke UDM yang diekspos sebelum 26 Agustus 2025 dan setelahnya (masing-masing tercantum di kolom Pemetaan lama dan Pemetaan saat ini).
| Kolom log | Pemetaan lama | Pemetaan saat ini |
|---|---|---|
client.geographicalContext.geolocation.lat |
target.location.region_latitude |
principal.location.region_coordinates.latitude |
client.geographicalContext.geolocation.lon |
target.location.region_longitude |
principal.location.region_coordinates.longitude |
created |
target.resource.attribute.labels |
metadata.event_timestamp |
debugContext.debugData.authnRequestId |
additional.fields |
security_result.detection_fields |
debugContext.debugData.factorType |
additional.fields |
security_result.detection_fields |
debugContext.debugData.traceId |
additional.fields |
security_result.detection_fields |
debugContext.debugData.tunnels.anonymous |
security_result.detection_fields |
network.proxy_info.anonymous |
lastUpdated |
target.resource.attribute.labels |
target.resource.attribute.last_update_time |
platform saat platformnya adalah iOS |
principal.platform = MAC |
principal.platform = IOS |
securityContext.asOrg |
security_result.detection_fields |
network.organization_name |
securityContext.isProxy |
additional.fields |
network.is_proxy |
target.detailEntry.methodTypeUsed |
target.resource.attribute.labels |
security_result.detection_fields |
target.detailEntry.methodUsedVerifiedProperties |
target.resource.attribute.labels |
security_result.detection_fields |
Delta pemetaan jenis peristiwa
Beberapa peristiwa yang sebelumnya diklasifikasikan sebagai peristiwa umum kini diklasifikasikan dengan benar menggunakan jenis peristiwa yang bermakna.
Tabel berikut mencantumkan perbedaan penanganan jenis peristiwa Okta sebelum 26 Agustus 2025 dan setelahnya (masing-masing tercantum dalam kolom Old event_type dan Current event-type).
| eventType dari log | event_type lama | event_type saat ini |
|---|---|---|
app.oauth2.as.authorize |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.code |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.implicit.access_token |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.implicit.id_token |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.authorize.code |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.token.grant |
USER_UNCATEGORIZED |
USER_LOGIN |
application.user_membership.remove |
USER_UNCATEGORIZED |
USER_CHANGE_PERMISSIONS |
application.user_membership.update |
STATUS_UPDATE |
USER_CHANGE_PERMISSIONS |
user.authentication.auth_via_AD_agent |
STATUS_UPDATE |
USER_UNCATEGORIZED |
user.authentication.slo |
USER_UNCATEGORIZED |
USER_LOGOUT |
Log Perubahan
Melihat Log Perubahan untuk parser ini
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.