Mengumpulkan log firewall Palo Alto Networks

Didukung di:

Google SecOps SIEM

Dokumen ini menjelaskan cara mengonfigurasi Google Security Operations untuk menyerap log dari Palo Alto Networks menggunakan dua metode deployment utama.

Pilih bagian berikut yang sesuai dengan arsitektur Anda:

• Palo Alto Networks Firewall
  • Deskripsi: Mengumpulkan log langsung dari firewall PAN-OS.
  • Metode penyerapan: Log dikirim menggunakan syslog ke forwarder Google SecOps atau agen Bindplane. Karena forwarder Google SecOps tidak digunakan lagi, gunakan agen Bindplane untuk penerusan log.
  • Format yang didukung: CSV, CEF, dan LEEF.
• Palo Alto Networks Firewall Strata Logging Service
  • Deskripsi: Mengumpulkan log dari Strata Logging Service berbasis cloud.
  • Metode penyerapan: Log diteruskan langsung ke Google SecOps menggunakan webhook HTTPS. Tidak diperlukan penerus lokal untuk metode ini.
  • Format yang didukung: Array JSON.

Palo Alto Networks Firewall

Ringkasan

Dokumen ini menjelaskan cara mengonfigurasi syslog dan forwarder Google SecOps untuk mengumpulkan log firewall Palo Alto Networks. Dokumen ini juga menjelaskan cara kolom log firewall Palo Alto Networks dipetakan ke kolom Model Data Terpadu (UDM) Google SecOps. Untuk ringkasan tentang penyerapan data Google SecOps, lihat Penyerapan data ke Google SecOps. Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser dengan label penyerapan PAN_FIREWALL.

Sebelum memulai

• Pastikan produk firewall Palo Alto Networks di-deploy dan dikonfigurasi dengan benar. Untuk petunjuk penyiapan mendetail, lihat Dokumentasi PAN-OS.

• Untuk memahami komponen yang di-deploy untuk mengumpulkan log firewall Palo Alto Networks, tinjau arsitektur deployment. Setiap deployment pelanggan mungkin berbeda dari representasi ini dan mungkin lebih kompleks. Diagram berikut menunjukkan cara mengonfigurasi syslog di firewall Palo Alto Networks dan menginstal forwarder Google SecOps di server Linux untuk meneruskan data log ke Google SecOps. Parser mendukung log yang ditulis dalam format data berikut: Comma Separated Values (CSV), Common Event Format (CEF), dan Log Event Extended Format (LEEF).

  

• Verifikasi format log dan versi PAN-OS yang didukung parser Google SecOps. Tabel berikut mencantumkan format log dan versi PAN-OS yang sesuai yang didukung parser Google SecOps:

  Format log	Versi PAN-OS
  CSV	10.1.3
  CEF	10.0.0
  LEEF	9.1.0

• Verifikasi jenis log firewall Palo Alto Networks yang didukung parser Google SecOps. Parser Google SecOps mendukung jenis log firewall Palo Alto Networks berikut:

  • Traffic
  • Ancaman
  • Pengiriman WildFire
  • Inspeksi terowongan
  • Konfigurasi
  • Sistem
  • Kecocokan HIP
  • IP-Tag
  • User-ID
  • Dekripsi
  • Autentikasi
  • Pemfilteran URL
  • Pemfilteran data
  • GlobalProtect
  • Korelasi
  • GTP
  • SCTP
  • Audit

  Untuk mengetahui informasi selengkapnya tentang jenis log firewall Palo Alto Networks, lihat Jenis log PAN-OS.

• Pastikan semua sistem dalam arsitektur deployment dikonfigurasi dalam zona waktu UTC.

• Sebelum menggunakan parser firewall Palo Alto Networks, tinjau perubahan pemetaan kolom antara parser sebelumnya dan parser firewall Palo Alto Networks saat ini. Sebagai bagian dari migrasi, pastikan aturan, penelusuran, dasbor, atau proses lain yang bergantung pada kolom asli menggunakan kolom yang diperbarui.

  Misalnya, dalam versi parser sebelumnya, kolom log category dipetakan ke kolom UDM security_result.description. Dalam parser firewall Palo Alto Networks saat ini, kolom log category dipetakan ke kolom UDM security_result.category_details. Jika Anda bermigrasi ke parser firewall Palo Alto Networks saat ini dan menggunakan kolom category dalam aturan, Anda harus mengubah aturan untuk menggunakan kolom UDM security_result.category_details dari parser saat ini.

Mengonfigurasi syslog dan forwarder Google Security Operations

Untuk mengonfigurasi syslog dan forwarder Google SecOps, selesaikan langkah-langkah berikut:

1. Untuk memantau log CSV, konfigurasikan profil server syslog. Untuk mengetahui informasi selengkapnya, lihat Mengonfigurasi profil server syslog. Saat Anda mengonfigurasi profil server syslog, tentukan "Default" sebagai format log kustom.
2. Untuk memantau log CEF, konfigurasikan firewall Palo Alto Networks untuk meneruskan log CEF. Untuk mengetahui informasi selengkapnya, download PDF panduan Integrasi CEF PAN-OS dan lihat bagian "Configuration of Palo Alto Networks NGFW to output CEF events".
3. Untuk memantau log LEEF, konfigurasikan profil server syslog. Untuk mengetahui informasi selengkapnya, lihat Penerusan log kustom dalam format LEEF.

4. Konfigurasi forwarder Google SecOps untuk mengirim log ke Google Security Operations. Untuk mengetahui informasi selengkapnya, lihat Menginstal dan mengonfigurasi forwarder di Linux. Berikut adalah contoh konfigurasi penerus Google SecOps:

     - syslog:
         common:
           enabled: true
           data_type: PAN_FIREWALL
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

Mengonfigurasi penerusan syslog di PAN Firewall

Membuat profil server syslog

1. Login ke Palo Alto Networks Firewall Management Console.
2. Buka Device > Server Profiles > Syslog.
3. Klik Add untuk membuat profil server baru.
4. Berikan detail konfigurasi berikut:
   • Name: Masukkan nama deskriptif (misalnya, Google SecOps BindPlane).
   • Location: Pilih sistem virtual (vsys) atau Shared tempat profil ini akan tersedia.
5. Klik Servers > Add untuk mengonfigurasi server syslog.
6. Berikan detail konfigurasi server berikut:
   • Name: Masukkan nama deskriptif untuk server (misalnya, BindPlane Agent).
   • Syslog Server: Masukkan alamat IP Agen BindPlane.
   • Transport: Pilih UDP atau TCP, bergantung pada konfigurasi Agen BindPlane Anda (UDP adalah default).
   • Port: Masukkan nomor port Agen BindPlane (misalnya, 514).
   • Format: Pilih BSD (default) atau IETF, bergantung pada persyaratan Anda.
   • Facility: Pilih LOG_USER (default) atau fasilitas lain sesuai kebutuhan.
7. Klik OK untuk menyimpan profil server syslog.

Opsional: Mengonfigurasi format log kustom untuk CEF atau LEEF

Jika Anda memerlukan log CEF (Common Event Format) atau LEEF (Log Event Extended Format), bukan CSV:

1. Di Syslog Server Profile, pilih tab Custom Log Format.
2. Konfigurasikan format log kustom untuk setiap jenis log (Config, System, Threat, Traffic, URL, Data, WildFire, Tunnel, Authentication, User-ID, HIP Match).
3. Untuk konfigurasi format CEF, lihat Panduan Konfigurasi CEF Palo Alto Networks.
4. Klik OK untuk menyimpan konfigurasi.

Catatan: Palo Alto Networks merekomendasikan PAN-OS 8.0.3 atau yang lebih baru untuk format log kustom CEF.

Membuat profil penerusan log

1. Buka Objects > Log Forwarding.
2. Klik Add untuk membuat profil penerusan log baru.
3. Berikan detail konfigurasi berikut:
   • Name: Masukkan nama profil (misalnya, Google SecOps Forwarding). Jika Anda ingin firewall menetapkan profil ini secara otomatis ke aturan dan zona keamanan baru, beri nama default.
4. Untuk setiap jenis log yang ingin Anda teruskan (Traffic, Threat, WildFire Submission, URL Filtering, Data Filtering, Tunnel, Authentication), konfigurasikan hal berikut:
   • Klik Add di bagian jenis log yang sesuai.
   • Syslog: Pilih profil server syslog yang Anda buat (misalnya, Google SecOps BindPlane).
   • Log Severity: Pilih tingkat keparahan yang akan diteruskan (misalnya, All).
5. Klik OK untuk menyimpan profil penerusan log.

Menerapkan profil penerusan log ke kebijakan keamanan

1. Buka Kebijakan > Keamanan.
2. Pilih aturan keamanan yang ingin Anda aktifkan penerusan lognya.
3. Klik aturan untuk mengeditnya.
4. Buka tab Tindakan.
5. Di menu Log Forwarding, pilih profil penerusan log yang Anda buat (misalnya, Google SecOps Forwarding).
6. Klik OK untuk menyimpan konfigurasi kebijakan keamanan.

Mengonfigurasi setelan log untuk log sistem

1. Buka Device > Log Settings.
2. Untuk setiap jenis log (System, Configuration, User-ID, HIP Match, Global Protect, IP-Tag, SCTP) dan tingkat keparahan, pilih profil server syslog yang Anda buat.
3. Klik OK untuk menyimpan setelan log.

Melakukan commit perubahan

1. Klik Commit di bagian atas antarmuka web firewall.
2. Tunggu hingga commit berhasil diselesaikan.
3. Pastikan log dikirim ke agen Bindplane dengan memeriksa konsol Google SecOps untuk log firewall Palo Alto Networks yang masuk.

Meneruskan Log ke Google SecOps menggunakan agen Bindplane

1. Menginstal dan menyiapkan Virtual Machine Linux.
2. Menginstal dan mengonfigurasi agen Bindplane di Linux untuk meneruskan log ke Google SecOps. Untuk mengetahui informasi selengkapnya tentang cara menginstal dan mengonfigurasi agen Bindplane, lihat petunjuk penginstalan dan konfigurasi agen Bindplane.

Jika Anda mengalami masalah saat membuat feed, hubungi dukungan Google SecOps.

Format log yang didukung

Parser firewall Palo Alto Networks mendukung log dalam format LEEF, CEF, dan CSV.

Contoh log yang didukung

• LEEF

  <14>Jan 22 02:20:19 device_host LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|10.2.12-h4|Microsoft MSOFFICE(52033)|ReceiveTime=2025/01/22 02:20:18|SerialNumber=01250100xxxx|cat=THREAT|Subtype=wildfire|devTime=Jan 22 2025 08:20:18 GMT|src=198.50.100.1|dst=198.50.100.2|srcPostNAT=198.50.100.3|dstPostNAT=198.50.100.4|RuleName=AZURE-US-NEW-CNF_Inbound_To_Azure-ALLOW|usrName=|SourceUser=|DestinationUser=|Application=smtp-base|VirtualSystem=vsys1|SourceZone=McD-Global-Zone|DestinationZone=Azure-Zone|IngressInterface=ae1.111|EgressInterface=ae2.409|LogForwardingProfile=Default-Traffic-Logging|SessionID=35331795|RepeatCount=1|srcPort=21578|dstPort=25|srcPostNATPort=0|dstPostNATPort=0|Flags=0x2000|proto=tcp|action=allow|Miscellaneous=\"......3...................xls\"|ThreatID=Microsoft MSOFFICE(52033)|URLCategory=malicious|sev=4|Severity=high|Direction=client-to-server|sequence=7462614601465681755|ActionFlags=0x8000000000000000|SourceLocation=198.50.100.1-198.50.100.255|DestinationLocation=United States|ContentType=|PCAP_ID=0|FileDigest=0ea04c99bf188c2e4207f60f92ca7c6f5088c7943ee63f45c50032bbd2bf7ea9|Cloud=demo.com|URLIndex=1|RequestMethod=|FileType=ms-office|Sender=[e-mail]|Subject=\"............:.................................................................................-.........(Name)-2025-01-22...............:Y107202501220005, ............:........................, ...............:.........\"|Recipient=[e-mail]|ReportID=117022282776|DeviceGroupHierarchyL1=143|DeviceGroupHierarchyL2=144|DeviceGroupHierarchyL3=39|DeviceGroupHierarchyL4=0|vSrcName=|DeviceName=device_host|SrcUUID=|DstUUID=|TunnelID=0|MonitorTag=|ParentSessionID=0|ParentStartTime=|TunnelType=N/A|ThreatCategory=N/A|ContentVer=WildFire-0
  

• CEF

  14>1 2024-04-04T16:21:56+02:00 FW-PERIMETRAL-AVG-01 - - - - CEF:0|Palo Alto Networks|PAN-OS|10.1.10-h2|end|TRAFFIC|1|src=198.51.100.1 dst=198.51.100.2 srcTranslatedAddress=198.51.100.3 dstTranslatedAddress=198.51.100.4 rule=FW_USER_NATS2_APP suser= duser= app=bittorrent vs=vsys1 sz=INSIDE dz=EXTERNAL InboundInterface=ae2.2266 OutboundInterface=ae1 lp=log_forwarding sid=2935823 cnt=1 spt=6881 dpt=51413 srcTranslatedPort=0 dstTranslatedPort=0 flags=0x7a proto=udp act=allow tbytes=475 in=150 out=325 pkt=2 pktReceived=1 pktSent=1 start=Apr 04 2024 14:21:56 GMT stime=1206 urlcat=any externalId=externalId reason=aged-out DGl1=11 DGl2=161 DGl3=0 DGl4=0 VsysName=STONESOFT dvchost=FW-PERIMETRAL-AVG-01 cat=from-policy ActionFlags=0x8000000000000000 srcUUID= dstUUID= TunnelID=0 MonitorTag= ParentSessionID=0 ParentStartTime= TunnelType=N/A SCTPAssocID=0 SCTPChunks=0 SCTPChunkSent=0 SCTPChunksRcv=0 RuleUUID=746c3eb6-3d51-4679-8438-bd0e00e170a8 HTTP2Con=0 LinkChange=0 PolicyID= LinkDetail= SDWANCluster= SDWANDevice= SDWANClustype= SDWANSite= DynamicUsrgrp= XFFIP= srcDevCat= srcDevProf= srcDevModel= srcDevVendor= srcDevOS= srcDevOSv= srcHostname= srcMac= dstDevCat= dstDevProf= dstDevModel= dstDevVendor= dstDevOS= dstDevOSv= dstHostname= dstMac= ContainerName= PODNamespace= PODName= srcEDL= dstEDL= GPHostID= EPSerial= srcDAG= dstDAG= HASessionOwner= TimeHighRes=2024-04-04T16:21:56.250+02:00 ASServiceType= ASServiceDiff="
  

• CSV

  1,2021/10/24 15:30:07,,CONFIG,0,2561,2021/10/24 15:30:07,198.51.100.0,,set,admin,Web,Succeeded, network virtual-router  VR1,,VR1  { ecmp { algorithm { ip-modulo ; } } protocol { bgp { routing-options { graceful-restart { enable yes; } } enable no; } rip { enable no; } ospf { enable no; } ospfv3 { enable no; } } routing-table { ip { static-route { vr1-log  { path-monitor { enable no; failure-condition any; hold-time 2; } nexthop { ip-address 198.51.100.0; } bfd { profile None; } interface ethernet1/1; metric 10; destination 0.0.0.0/0; route-table { unicast ; } } } } } interface [ ethernet1/1 ethernet1/2 ]; } ,7022390503849066572,0x0,0,0,0,0,,PA-VM,0,
  

Referensi pemetaan kolom: Kolom log ke kolom UDM

Bagian ini menjelaskan cara parser memetakan kolom log firewall Palo Alto Networks ke kolom peristiwa UDM Google SecOps untuk setiap jenis log. Kunci label Google SecOps mengacu pada nama kunci yang dipetakan ke kolom UDM Labels.key.

Misalnya, untuk kolom "Virtual System", nama kolomnya adalah "cs3" dalam format CEF dan "VirtualSystem" dalam format LEEF. Kolom UDM "about.labels.key" berisi nilai "vsys" dan kolom UDM "about.labels.value" berisi nilai kolom tersebut. Beberapa nama kolom CEF atau LEEF tidak memiliki nama yang sesuai dengan nama kolom CSV. Dalam kasus tersebut, jika Anda menambahkan nama variabel Anda sendiri dalam format log kustom di profil syslog, parser tidak akan memetakannya ke kolom UDM.

Lihat bagian berikut untuk referensi pemetaan setiap jenis log:

• Sistem
• Konfigurasi
• Ancaman/kebakaran hutan
• Traffic
• ID Pengguna
• Pencocokan HIP
• Tag IP
• Dekripsi
• Tunnel
• Authentication
• URL
• Data
• GlobalProtect
• Korelasi
• GTP
• SCTP
• Audit

Tidak digunakan lagi:

Kolom labels berikut untuk kata benda UDM tidak digunakan lagi: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels, dan target.labels. Untuk parser yang ada, selain kolom UDM ini, kolom log juga dipetakan ke kolom UDM additional.fields kunci/nilai. Untuk parser baru, setelan kunci/nilai di kolom UDM additional.fields digunakan, bukan kolom UDM labels yang tidak digunakan lagi. Sebaiknya perbarui aturan yang ada untuk menggunakan setelan kunci/nilai di kolom UDM additional.fields, bukan kolom UDM labels yang tidak digunakan lagi.

Sistem

Tabel berikut mencantumkan kolom log dari jenis log sistem dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		target.asset.hardware.serial_number intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type ditetapkan ke "%{type} - %{subtype}".
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type ditetapkan ke "%{type} - %{subtype}".
Waktu Dibuat (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
ID Peristiwa (eventid)	cat		eventid	additional.fields.key dan additional.fields.value.string_value
Objek (object)	fname	Nama file	objek	target.resource.name
Modul (module)	flexString2	Modul	modul	additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)	$number-of-severity(header)	Keparahan		security_result.severity dan security_result.severity_details
Deskripsi (buram)	msg	msg		metadata.description
	principal_user_userid (Kolom ini diekstrak dari kolom msg)			principal.user.userid
	principal_ip3 (Kolom ini diekstrak dari kolom msg)			principal.ip
	Alasan (Kolom ini diekstrak dari kolom msg)			security_result.description
	server_address (Kolom ini diekstrak dari kolom msg.)			target.ip
	server_profile (Kolom ini diekstrak dari kolom msg.)			additional.fields.key dan additional.fields.value.string_value
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1 hingga dg_hier_level_4)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		target.hostname intermediary.hostname
Stempel Waktu Resolusi Tinggi (high_res_timestamp)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value

Konfigurasi

Tabel berikut mencantumkan kolom log dari jenis log konfigurasi dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		target.asset.hardware.serial_number intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)			metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Host (host)	shost	src		principal.ip/hostname
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
Command (cmd)	act	msg	cmd	principal.process.command_line
Admin (admin)	duser	usrName		principal.user.userid
Klien (client)	destinationServiceName	klien		principal.application
Result (result)	ID Signature (Header)(alasan)	Hasil		security_result.summary
Jalur Konfigurasi (path)	msg	ConfigurationPath		principal.process.command_line
Detail Sebelum Perubahan (before_change_detail)	cs1	BeforeChangeDetail	before_change_detail	target.resource.attribute.labels.key/value
Detail Setelah Perubahan (after_change_detail)	cs2	AfterChangeDetail	after_change_detail	target.resource.attribute.labels.key/value
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1 hingga dg_hier_level_4)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		target.hostname intermediary.hostname
Grup Perangkat (dg_id)	PanOSFWDeviceGroup		dg_id	target.asset.attribute.labels.key/value
Komentar Audit (comment)	PanOSPolicyAuditComment		komentar	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (high_res_timestamp)				additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details

Threat/WildFire

Tabel berikut mencantumkan kolom log dari jenis log Threat/WildFire dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (nomor seri)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	cat/subtype (Header)	Subjenis		metadata.product_event_type
Generate Time (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Alamat sumber (src)	src	src		principal.ip
Alamat tujuan (dst)	dst	dst		target.ip
IP Sumber NAT (natsrc)	sourceTranslatedAddress	srcPostNAT		principal.nat_ip
IP Tujuan NAT (natdst)	destinationTranslatedAddress	dstPostNAT		target.nat_ip
Nama Aturan (rule)	cs1	RuleName		security_result.rule_name
Pengguna Sumber (srcuser)	suser	SourceUser / usrName		principal.user.userid
Pengguna Tujuan (dstuser)	duser	DestinationUser		target.user.userid
Aplikasi (app)	aplikasi	Aplikasi		target.application
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)	cs4	SourceZone	dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)	cs5	DestinationZone	sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)	deviceInboundInterface	IngressInterface	inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)	deviceOutboundInterface	EgressInterface	outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6	LogForwardingProfile	logset	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)	cn1	SessionID		network.session_id
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)	spt	srcPort		principal.port
Port Tujuan (dport)	dpt	dstPort		target.port
Port Sumber NAT (natsport)	sourceTranslatedPort	srcPostNATPort		principal.nat_port
Port Tujuan NAT (natdport)	destinationTranslatedPort	dstPostNATPort		target.nat_port
Flag (flags)	flexString1	Flag	flag	additional.fields.key dan additional.fields.value.string_value
Protokol IP (proto)	proto	proto		network.ip_protocol
Tindakan (action)	act	tindakan		security_result.action_details security_result.action
URL/Nama file (lain-lain)	permintaan	Lain-lain		target.file.names (jika subjenisnya adalah 'file', 'virus', 'wildfire-virus', atau 'wildfire', kolom `misc` akan dipetakan ke target.file.names) target.url (jika subjenisnya adalah 'url', kolom `misc` akan dipetakan ke target.url dan target.hostname)
Nama Ancaman/Konten (threatid)	cat	ThreatID		security_result.threat_name
Kategori (category)	cs2	URLCategory		security_result.category_details
Tingkat keparahan (severity)	number-of-severity(header)	Keparahan		security_result.severity dan security_result.severity_details
Direction (arah)	flexString2	Arah		network.direction
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Negara Sumber (srcloc)		SourceLocation		principal.location.country_or_region
Negara Tujuan (dstloc)		DestinationLocation		target.location.country_or_region
Jenis Konten (contenttype)		ContentType	contenttype	additional.fields.key dan additional.fields.value.string_value
ID PCAP (pcap_id)	fileId	PCAP_ID	pcap_id	additional.fields.key dan additional.fields.value.string_value
File Digest (filedigest)	fileHash	FileDigest		target.file.sha1/md5/sha256
Cloud (cloud)	filePath	Cloud	cloud	additional.fields.key dan additional.fields.value.string_value
Indeks URL (url_idx)		URLIndex	url_idx	additional.fields.key dan additional.fields.value.string_value
Agen Pengguna (user_agent)				network.http.user_agent
Jenis File (filetype)	fileType	FileType		target.file.mime_type
X-Forwarded-For (xff)				principal.ip
Perujuk (referer)				network.http.referral_url
Pengirim (sender)	suid	Pengirim		network.email.from
Subject (subject)	msg	Subjek		network.email.subject
Penerima (recipient)	duid	Penerima		network.email.to
ID Laporan (reportid)	oldFileId	ReportID	reportid	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1 hingga dg_hier_level_4)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname intermediary.asset.hostname target.hostname target.asset.hostname
UUID VM Sumber (src_uuid)	PanOSSrcUUID	SrcUUID		principal.asset.product_object_id
UUID VM tujuan (dst_uuid)	PanOSDstUUID	DstUUID		target.asset.product_object_id
Metode HTTP (http_method)		RequestMethod		network.http.method
ID Tunnel/IMSI (tunnel_id/imsi)	PanOSTunnelID	TunnelID	tunnel_id/imsi	additional.fields.key dan additional.fields.value.string_value
Tag/IMEI Monitor (monitortag/imei)	PanOSMonitorTag	MonitorTag	monitortag/imei	additional.fields.key dan additional.fields.value.string_value
ID Sesi Induk (parent_session_id)	PanOSParentSessionID	ParentSessionID	parent_session_id	network.parent_session_id
Waktu Mulai Sesi Induk (parent_start_time)	PanOSParentStartTime	ParentStartTime	parent_start_time	additional.fields.key dan additional.fields.value.string_value
Jenis Tunnel (tunnel)	PanOSTunnelType	TunnelType	tunnel	additional.fields.key dan additional.fields.value.string_value
Kategori Ancaman (thr_category)	PanOSThreatCategory	ThreatCategory	thr_category	security_result.detection_fields.key/value
Versi Konten (contentver)	PanOSContentVer	ContentVer	contentver	additional.fields.key dan additional.fields.value.string_value
ID Pengaitan SCTP (assoc_id)	PanOSAssocID		assoc_id	additional.fields.key dan additional.fields.value.string_value
ID Protokol Payload (ppid)	PanOSPPID		ppid	additional.fields.key dan additional.fields.value.string_value
Header HTTP (http_headers)	PanOSHTTPHeader		http_headers	target.url.last_http_response_headers
Daftar Kategori URL (url_category_list)	PanOSURLCatList		url_category_list	additional.fields.key dan additional.fields.value.string_value
UUID Aturan (rule_uuid)	PanOSRuleUUID			security_result.rule_id
Koneksi HTTP/2 (http2_connection)	PanOSHTTP2Con		http2_connection	network.application_protocol_version
Nama Grup Pengguna Dinamis (dynusergroup_name)	PanDynamicUsrgrp		dynusergroup_name	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Alamat XFF (xff_ip)	PanXFFIP			principal.ip
Kategori Perangkat Sumber (src_category)	PanSrcDeviceCat		src_category	principal.asset.category
Profil Perangkat Sumber (src_profile)	PanSrcDeviceProf		src_profile	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Sumber (src_model)	PanSrcDeviceModel		src_model	principal.asset.hardware.model
Vendor Perangkat Sumber (src_vendor)	PanSrcDeviceVendor		src_vendor	principal.asset.hardware.manufacturer
Kategori OS Perangkat Sumber (src_osfamily)	PanSrcDeviceOS		src_osfamily	principal.platform
Versi OS Perangkat Sumber (src_osversion)	PanSrcDeviceOSv			principal.platform_version
Nama Host Sumber (src_host)	PanSrcHostname			principal.hostname
Alamat MAC Sumber (src_mac)	PanSrcMac			principal.mac
Kategori Perangkat Tujuan (dst_category)	PanDstDeviceCat		dst_category	target.asset.category
Profil Perangkat Tujuan (dst_profile)	PanDstDeviceProf		dst_profile	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Tujuan (dst_model)	PanDstDeviceModel		dst_model	target.asset.hardware.model
Vendor Perangkat Tujuan (dst_vendor)	PanDstDeviceVendor		dst_vendor	target.asset.hardware.manufacturer
Kategori OS Perangkat Tujuan (dst_osfamily)	PanDstDeviceOS		dst_osfamily	target.platform
Versi OS Perangkat Tujuan (dst_osversion)	PanDstDeviceOSv			target.platform_version
Nama Host Tujuan (dst_host)	PanDstHostname			target.hostname
Alamat MAC Tujuan (dst_mac)	PanDstMac			target.mac
ID Penampung (container_id)	PanContainerName		container_id	intermediary.resource.product_object_id
Namespace POD (pod_namespace)	PanPODNamespace		pod_namespace	target.resource.attribute.labels.key/value
Nama POD (pod_name)	PanPODName		pod_name	target.resource.name
Daftar Dinamis Eksternal Sumber (src_edl)	PanSrcEDL		src_edl	additional.fields.key dan additional.fields.value.string_value
Daftar Dinamis Eksternal Tujuan (dst_edl)	PanDstEDL		dst_edl	additional.fields.key dan additional.fields.value.string_value
ID Host (hostid)	PanGPHostID		hostid	principal.asset.asset_id
Nomor Seri Perangkat Pengguna (serialnumber)	PanEPSerial			principal.asset.hardware.serial_number
EDL Domain (domain_edl)	PanDomainEDL		domain_edl	additional.fields.key dan additional.fields.value.string_value
Grup Alamat Dinamis Sumber (src_dag)	PanSrcDAG			principal.group.group_display_name
Destination Dynamic Address Group (dst_dag)	PanDstDAG			target.group.group_display_name
Hash Parsial (partial_hash)	PanPartialHash		partial_hash	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (stempel waktu high_res)	PanTimeHighRes		stempel waktu high_res	additional.fields.key dan additional.fields.value.string_value
Alasan (reason)	PanReasonFilteringAction		mampu bernalar	security_result.summary
Justification (justification)	PanJustification		justification	additional.fields.key dan additional.fields.value.string_value
Jenis Layanan Slice (nssai_sst)	PanASServiceType		nssai_sst	additional.fields.key dan additional.fields.value.string_value
Subkategori Aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori Aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi Aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko Aplikasi (risk_of_app)			risk_of_app	additional.fields.key dan additional.fields.value.string_value
Karakteristik Aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Penampung Aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
SaaS Aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Aplikasi yang Di-tunnel (tunneled_app)				additional.fields.key dan additional.fields.value.string_value
Jenis Alur (flow_type)				additional.fields.key dan additional.fields.value.string_value
Nama Cluster (cluster_name)				intermediary.resource.name
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value

Traffic

Tabel berikut mencantumkan kolom log dari jenis log traffic dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat/Type		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)	mulai			metadata.event_timestamp
Alamat Sumber (src)	src	src		principal.ip
Alamat Tujuan (dst)	dst	dst		target.ip
IP Sumber NAT (natsrc)	sourceTranslatedAddress	srcPostNAT		principal.nat_ip
IP Tujuan NAT (natdst)	destinationTranslatedAddress	dstPostNAT		target.nat_ip
Nama Aturan (rule)	cs1	RuleName		security_result.rule_name
Pengguna Sumber (srcuser)	suser	SourceUser		principal.user.userid
Pengguna Tujuan (dstuser)	duser	DestinationUser		target.user.userid
Aplikasi (app)	aplikasi	Aplikasi		target.application
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)	cs4	SourceZone	dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)	cs5	DestinationZone	sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)	deviceInboundInterface	IngressInterface	inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)	deviceOutboundInterface	EgressInterface	outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6	LogForwardingProfile	logset	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)	cn1	SessionID		network.session_id
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)	spt	srcPort		principal.port
Port Tujuan (dport)	dpt	dstPort		target.port
Port Sumber NAT (natsport)	sourceTranslatedPort	srcPostNATPort		principal.nat_port
Port Tujuan NAT (natdport)	destinationTranslatedPort	dstPostNATPort		target.nat_port
Flag (flags)	flexString1	Flag	flag	additional.fields.key dan additional.fields.value.string_value
Protokol IP (proto)	proto	proto		network.ip_protocol
Tindakan (action)	act	tindakan		security_result.action_details security_result.action
Byte (byte)	flexNumber1	totalBytes	byte	additional.fields.key dan additional.fields.value.string_value
Byte Terkirim (bytes_sent)	di	srcBytes		network.sent_bytes
Byte Diterima (bytes_received)	keluar	dstBytes		network.received_bytes
Paket (paket)	cn2	totalPackets	paket	additional.fields.key dan additional.fields.value.string_value
Waktu Mulai (start)		StartTime	mulai	additional.fields.key dan additional.fields.value.string_value
Waktu Berlalu (elapsed)	cn3	ElapsedTime	berlalu	network.session_duration.seconds
Kategori (category)	cs2	URLCategory		security_result.category / security_result.category_details
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Negara Sumber (srcloc)		SourceLocation		principal.location.country_or_region
Negara Tujuan (dstloc)		DestinationLocation		target.location.country_or_region
Paket Terkirim (pkts_sent)	PanOSPacketsSent	srcPackets	pkts_sent	network.sent_packets
Paket yang Diterima (pkts_received)	PanOSPacketsReceived	dstPackets	pkts_received	network.received_packets
Alasan Akhir Sesi (session_end_reason)	mampu bernalar	SessionEndReason		security_result.summary
Hierarki Grup Perangkat1 (dg_hier_level_1 hingga dg_hier_level_4)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat 2 (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat 3 (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname intermediary.asset.hostname
Sumber Tindakan (action_source)	cat	ActionSource	action_source	additional.fields.key dan additional.fields.value.string_value
UUID VM Sumber (src_uuid)	PanOSSrcUUID	SrcUUID		principal.asset.product_object_id
UUID VM tujuan (dst_uuid)	PanOSDstUUID	DstUUID		target.asset.product_object_id
ID Tunnel/IMSI (tunnelid/imsi)	PanOSTunnelID	TunnelID	tunnelid/imsi	additional.fields.key dan additional.fields.value.string_value
Tag/IMEI Monitor (monitortag/imei)	PanOSMonitorTag	MonitorTag	monitortag/imei	additional.fields.key dan additional.fields.value.string_value
ID Sesi Induk (parent_session_id)	PanOSParentSessionID	ParentSessionID	parent_session_id	network.parent_session_id
Waktu Mulai Induk (parent_start_time)	PanOSParentStartTime	ParentStartTime	parent_start_time	additional.fields.key dan additional.fields.value.string_value
Jenis Tunnel (tunnel)	PanOSTunnelType	TunnelType	tunnel	additional.fields.key dan additional.fields.value.string_value
ID Pengaitan SCTP (assoc_id)	PanOSSCTPAssocID		assoc_id	additional.fields.key dan additional.fields.value.string_value
SCTP Chunks (chunks)	PanOSSCTPChunks		bongkahan	additional.fields.key dan additional.fields.value.string_value
SCTP Chunks Sent (chunks_sent)	PanOSSCTPChunkSent		chunks_sent	additional.fields.key dan additional.fields.value.string_value
SCTP Chunks Received (chunks_received)	PanOSSCTPChunksRcv		chunks_received	additional.fields.key dan additional.fields.value.string_value
UUID Aturan (rule_uuid)	PanOSRuleUUID			security_result.rule_id
Koneksi HTTP/2 (http2_connection)	PanOSHTTP2Con		http2_connection	network.application_protocol_version
Jumlah Flap Aplikasi (link_change_count)	PanLinkChange		link_change_count	additional.fields.key dan additional.fields.value.string_value
ID Kebijakan (policy_id)	PanPolicyID		policy_id	additional.fields.key dan additional.fields.value.string_value
Link Switches (link_switches)	PanLinkDetail		link_switches	additional.fields.key dan additional.fields.value.string_value
Cluster SD-WAN (sdwan_cluster)	PanSDWANCluster		sdwan_cluster	additional.fields.key dan additional.fields.value.string_value
Jenis Perangkat SD-WAN (sdwan_device_type)	PanSDWANDevice		sdwan_device_type	additional.fields.key dan additional.fields.value.string_value
Jenis Cluster SD-WAN (sdwan_cluster_type)	PanSDWANClustype		sdwan_cluster_type	additional.fields.key dan additional.fields.value.string_value
Situs SD-WAN (sdwan_site)	PanSDWANSite		sdwan_site	additional.fields.key dan additional.fields.value.string_value
Nama Grup Pengguna Dinamis (dynusergroup_name)	PanDynamicUsrgrp		dynusergroup_name	additional.fields.key dan additional.fields.value.string_value
Alamat XFF (xff_ip)	PanXFFIP			principal.ip
Kategori Perangkat Sumber (src_category)	PanSrcDeviceCat		src_category	principal.asset.category
Profil Perangkat Sumber (src_profile)	PanSrcDeviceProf		src_profile	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Sumber (src_model)	PanSrcDeviceModel		src_model	principal.asset.hardware.model
Vendor Perangkat Sumber (src_vendor)	PanSrcDeviceVendor		src_vendor	principal.asset.hardware.manufacturer
Kategori OS Perangkat Sumber (src_osfamily)	PanSrcDeviceOS			principal.platform
Versi OS Perangkat Sumber (src_osversion)	PanSrcDeviceOSv			principal.asset.software.version
Nama Host Sumber (src_host)	PanSrcHostname			principal.hostname
Alamat MAC Sumber (src_mac)	PanSrcMac			principal.mac
Kategori Perangkat Tujuan (dst_category)	PanDstDeviceCat		dst_category	target.asset.category
Profil Perangkat Tujuan (dst_profile)	PanDstDeviceProf		dst_profile	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Tujuan (dst_model)	PanDstDeviceModel		dst_model	target.asset.hardware.model
Vendor Perangkat Tujuan (dst_vendor)	PanDstDeviceVendor		dst_vendor	target.asset.hardware.manufacturer
Kategori OS Perangkat Tujuan (dst_osfamily)	PanDstDeviceOS		dst_osfamily	target.platform
Versi OS Perangkat Tujuan (dst_osversion)	PanDstDeviceOSv			target.platform_version
Nama Host Tujuan (dst_host)	PanDstHostname			target.hostname
Alamat MAC Tujuan (dst_mac)	PanDstMac			target.mac
ID Penampung (container_id)	PanContainerName		container_id	intermediary.resource.product_object_id
Namespace POD (pod_namespace)	PanPODNamespace		pod_namespace	target.resource.attribute.labels.key/value
Nama POD (pod_name)	PanPODName		pod_name	target.resource.name
Daftar Dinamis Eksternal Sumber (src_edl)	PanSrcEDL		src_edl	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Daftar Dinamis Eksternal Tujuan (dst_edl)	PanDstEDL		dst_edl	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
ID Host (hostid)	PanGPHostID		hostid	principal.asset.asset_id
Nomor Seri Perangkat Pengguna (serialnumber)	PanEPSerial			principal.asset.hardware.serial_number
Grup Alamat Dinamis Sumber (src_dag)	PanSrcDAG			principal.group.group_display_name
Destination Dynamic Address Group (dst_dag)	PanDstDAG			target.group.group_display_name
Pemilik Sesi (session_owner)	PanHASessionOwner		session_owner	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (high_res_timestamp)	PanTimeHighRes			additional.fields.key dan additional.fields.value.string_value
Jenis Layanan Slice (nsdsai_sst)	PanASServiceType		nsdsai_sst	additional.fields.key dan additional.fields.value.string_value
Slice Differentiator (nsdsai_sd)	PanASServiceDiff		nsdsai_sd	additional.fields.key dan additional.fields.value.string_value
Subkategori Aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori Aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi Aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko Aplikasi (risk_of_app)				security_result.severity
Karakteristik Aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Penampung Aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
SaaS Aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value
Subkategori Aplikasi (subcategory_of_app)			subcategory_of_app1	additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details

User-ID

Tabel berikut mencantumkan kolom log dari jenis log user-id dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
IP Sumber (ip)	src	src		principal.ip
Pengguna (user)	duser	usrName		target.user.userid target.administrative_domain target.user.email_addresses
Nama Sumber Data (datasourcename)	cs4	DataSourceName	datasourcename	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
ID Peristiwa (eventid)		EventID	eventid	additional.fields.key dan additional.fields.value.string_value
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Batas Waktu Tunggu (timeout)	cn3	TimeoutThreshold	timeout	additional.fields.key dan additional.fields.value.string_value
Port Sumber (beginport)	spt	srcPort		principal.port
Port Tujuan (endport)	dpt	dstPort		target.port
Sumber Data (datasource)	cs5	DataSource	sumber data	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Jenis Sumber Data (datasourcetype)	cs6	DataSourceType	datasourcetype	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname
ID Sistem Virtual (vsys_id)	cn2	VirtualSystemID		intermediary.resource.product_object_id
Jenis Faktor (factortype)	cs1	FactorType	factortype	additional.fields.key dan additional.fields.value.string_value
Waktu Penyelesaian Faktor (factorcompletiontime)	end	FactorCompletionTime	factorcompletiontime	additional.fields.key dan additional.fields.value.string_value
Nomor Faktor (factorno)	cn1	FactorNumber	factorno	additional.fields.key dan additional.fields.value.string_value
Flag Grup Pengguna (ugflags)	PanOSUGFlags		ugflags	additional.fields.key dan additional.fields.value.string_value
Pengguna menurut Sumber (userbysource)	PanOSUserBySource			additional.fields, target.user.userid (jika "duser" tidak ada)
Stempel Waktu Resolusi Tinggi (stempel waktu high_res)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Sumber Data Asal (origindatasource)				additional.fields.key dan additional.fields.value.string_value
Nama Cluster (cluster_name)				principal.resource.name
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details

Kecocokan HIP

Tabel berikut mencantumkan kolom log dari jenis log kecocokan HIP dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		target.asset.hardware.serial_number intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis
Waktu Dibuat (time_generated atau cef-formatted-time_generated)	mulai	startTime		metadata.event_timestamp
Pengguna Sumber (srcuser)	suser	usrName		principal.user.userid
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
Nama Perangkat (machinename)	shost	identHostName		principal.hostname
Sistem Operasi (os)	cs2	OS		principal.asset.platform_software.platform
Alamat Sumber (src)	src	identsrc		principal.ip
HIP (matchname)	cat	HIP	matchname	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Jenis HIP (matchtype)	ID Class Peristiwa Perangkat (Header)	HIPType	matchtype	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		target.hostname intermediary.hostname
ID Sistem Virtual (vsys_id)	cn2	VirtualSystemID		target.resource.product_object_id intermediary.resource.product_object_id
Alamat Sistem IPv6 (srcipv6)	c6a2	srcipv6		principal.asset.ip
ID Host (hostid)	PanOSHostID			principal.asset.asset_id
Nomor Seri Perangkat Pengguna (serialnumber)	PanOSEndpointSerialNumber			principal.asset.hardware.serial_number
Alamat MAC Perangkat (mac)	PanOSEndpointMac			principal.asset.mac
Stempel Waktu Resolusi Tinggi (high_res_timestamp)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Nama Cluster (cluster_name)				principal.resource.name
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details

Tag IP

Tabel berikut mencantumkan kolom log dari jenis log tag IP dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		target.asset.hardware.serial_number intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)		GenerateTime		metadata.event_timestamp
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
IP Sumber (ip)	src	src		principal.ip
Nama Tag (tag_name)	PanOSTagName	TagName	tag_name	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
ID Peristiwa (event_id)	PanOSEventID	EventID	event_id	additional.fields.key dan additional.fields.value.string_value
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Waktu tunggu (timeout)	PanOSTimeout	TimeoutThreshold	timeout	additional.fields.key dan additional.fields.value.string_value
Nama Sumber Data (datasourcename)	PanOSDataSourceName	DataSourceName	datasourcename	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Jenis Sumber Data (datasource_type)	PanOSDataSourceType	DataSource	datasource_type	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Subjenis Sumber Data (datasource_subtype)	PanOSDataSourceSubType	DataSourceType	datasource_subtype	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOsVsysName	vSrcName		target.asset.attribute.labels.key/value intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		target.hostname intermediary.hostname
ID Sistem Virtual (vsys_id)	cn2	VirtualSystemID		target.resource.product_object_id intermediary.resource.product_object_id
Stempel Waktu Resolusi Tinggi (stempel waktu high_res)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details
Nama Cluster (cluster_name)				principal.resource.name

Dekripsi

Tabel berikut mencantumkan kolom log dari jenis log dekripsi dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt			metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	PanOSDeviceSN			intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)			metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)			metadata.product_event_type
Versi Konfigurasi (config_ver)	PanOSConfigVersion		config_ver	additional.fields.key dan additional.fields.value.string_value
Waktu Pembuatan (time_generated)	PanOSLogTimeStamp			metadata.event_timestamp
Alamat Sumber (src)	src			principal.ip
Alamat Tujuan (dst)	dst			target.ip
IP Sumber NAT (natsrc)	sourceTranslatedAddress			principa.nat_ip
IP Tujuan NAT (natdst)	destinationTranslatedAddress			target.nat_ip
Aturan (rule)	cs1			security_result.rule_name
Pengguna Sumber (srcuser)	suser			principal.user.userid
Pengguna Tujuan (dstuser)	duser			target.user.userid
Aplikasi (app)	aplikasi			network.application_protocol
Sistem Virtual (vsys)	cs3		vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)	cs4		dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)	cs5		sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)	deviceInboundInterface		inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)	deviceOutboundInterface		outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6		logset	additional.fields.key dan additional.fields.value.string_value
Waktu Dicatat (time_received)	PanOSTimeReceivedManagementPlane			-
ID Sesi (sessionid)	cn1			network.session_id
Jumlah Pengulangan (repeatcnt)	PanOSCountOfRepeats/RepeatCount		repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)	spt			principal.port
Port Tujuan (dport)	dpt			target.port
Port Sumber NAT (natsport)	sourceTranslatedPort			principal.nat_port
Port Tujuan NAT (natdport)	destinationTranslatedPort			target.nat_port
Flag (flags)	flexString1		flag	additional.fields.key dan additional.fields.value.string_value
Protokol IP (proto)	proto			network.ip_protocol
Tindakan (action)	act			security_result.action_details security_result.action
Tunnel (tunnel)	PanOSTunnel		tunnel	additional.fields.key dan additional.fields.value.string_value
UUID VM Sumber (src_uuid)	PanOSSourceUUID			principal.asset.product_object_id
UUID VM tujuan (dst_uuid)	PanOSDestinationUUID			target.asset.product_object_id
UUID untuk aturan (rule_uuid)	PanOSRuleUUID			security_result.rule_id
Tahap untuk Klien ke Firewall (hs_stage_c2f)	PanOSClientToFirewall		hs_stage_c2f	additional.fields.key dan additional.fields.value.string_value
Stage for Firewall to Server (hs_stage_f2s)	PanOSFirewallToServer		hs_stage_f2s	additional.fields.key dan additional.fields.value.string_value
Versi TLS (tls_version)	PanOSTLSVersion			network.tls.version
Algoritma Pertukaran Kunci (tls_keyxchg)	PanOSTLSKeyExchange		tls_keyxchg	additional.fields.key dan additional.fields.value.string_value
Algoritma Enkripsi (tls_enc)	PanOSTLSEncryptionAlgorithm		tls_enc	additional.fields.key dan additional.fields.value.string_value
Hash Algorithm (tls_auth)	PanOSTLSAuth		tls_auth	additional.fields.key dan additional.fields.value.string_value
Nama Kebijakan (policy_name)	PanOSPolicyName		policy_name	additional.fields.key dan additional.fields.value.string_value
Elliptic Curve (ec_curve)	PanOSEllipticCurve			network.tls.curve
Indeks Error (err_index)	PanOSErrorIndex		err_index	additional.fields.key dan additional.fields.value.string_value
Status Root (root_status)	PanOSRootStatus		root_status	additional.fields.key dan additional.fields.value.string_value
Status Jaringan (chain_status)	PanOSChainStatus		chain_status	additional.fields.key dan additional.fields.value.string_value
Jenis Proxy (proxy_type)	PanOSProxyType		proxy_type	additional.fields.key dan additional.fields.value.string_value
Nomor Seri Sertifikat (cert_serial)	PanOSCertificateSerial			network.tls.server.certificate.serial
Sidik Jari Sertifikat (fingerprint)	PanOSFingerprint			network.tls.server.certificate.md5/sha1/sha256
Tanggal Mulai Sertifikat (notbefore)	PanOSTimeNotBefore			network.tls.server.certificate.not_before
Tanggal Akhir Masa Berlaku Sertifikat (notafter)	PanOSTimeNotAfter			network.tls.server.certificate.not_after
Versi Sertifikat (cert_ver)	PanOSCertificateVersion			network.tls.server.certificate.version
Ukuran Sertifikat (cert_size)	PanOSCertificateSize		cert_size	additional.fields.key dan additional.fields.value.string_value
Panjang Nama Umum (cn_len)	PanOSCommonNameLength		cn_len	additional.fields.key dan additional.fields.value.string_value
Panjang Nama Umum Penerbit (issuer_len)	PanOSIssuerNameLength		issuer_len	additional.fields.key dan additional.fields.value.string_value
Panjang Nama Umum Root (rootcn_len)	PanOSRootCNLength		rootcn_len	additional.fields.key dan additional.fields.value.string_value
Panjang SNI (sni_len)	PanOSSNILength		sni_len	additional.fields.key dan additional.fields.value.string_value
Flag Sertifikat (cert_flags)	PanOSCertificateFlags		cert_flags	additional.fields.key dan additional.fields.value.string_value
Nama Umum Subjek (cn)	PanOSCommonName		cn	additional.fields.key dan additional.fields.value.string_value
Nama Umum Penerbit (issuer_cn)	PanOSIssuerCommonName			network.tls.server.certificate.issuer
Nama Umum Root (root_cn)	PanOSRootCommonName		root_cn	additional.fields.key dan additional.fields.value.string_value
Indikasi Nama Server (sni)				network.tls.client.server_name
Error (error)	PanOSErrorMessage		error	additional.fields.key dan additional.fields.value.string_value
ID Penampung (container_id)	PanOSContainerID		container_id	intermediary.resource.product_object_id
Namespace POD (pod_namespace)	PanOSContainerNameSpace		pod_namespace	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Nama POD (pod_name)	PanOSContainerName		pod_name	target.resource.name
Daftar Dinamis Eksternal Sumber (src_edl)	PanOSSourceEDL		src_edl	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Daftar Dinamis Eksternal Tujuan (dst_edl)	PanOSDestinationEDL		dst_edl	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Grup Alamat Dinamis Sumber (src_dag)	PanOSSourceDynamicAddressGroup			principal.group.group_display_name
Destination Dynamic Address Group (dst_dag)	PanOSDestinationDynamicAddressGroup			target.group.group_display_name
Stempel Waktu Resolusi Tinggi (high_res_timestamp)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Kategori Perangkat Sumber (src_category)	PanOSSourceDeviceCategory		src_category	principal.asset.category
Profil Perangkat Sumber (src_profile)	PanOSSourceDeviceProfile		src_profile	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Sumber (src_model)	PanOSSourceDeviceModel		src_model	principal.asset.hardware.model
Vendor Perangkat Sumber (src_vendor)	PanOSSourceDeviceVendor		src_vendor	principal.asset.hardware.manufacturer
Kategori OS Perangkat Sumber (src_osfamily)	PanOSSourceDeviceOSFamily			principal.platform
Versi OS Perangkat Sumber (src_osversion)	PanOSSourceDeviceOSVersion			principal.platform_version
Nama Host Sumber (src_host)	PanOSSourceDeviceHost			principal.hostname
Alamat MAC Sumber (src_mac)	PanOSSourceDeviceMac			principal.mac
Kategori Perangkat Tujuan (dst_category)	PanOSDestinationDeviceCategory		dst_category	target.asset.category
Profil Perangkat Tujuan (dst_profile)	PanOSDestinationDeviceProfile		dst_profile	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Tujuan (dst_model)	PanOSDestinationDeviceModel		dst_model	target.asset.hardware.model
Vendor Perangkat Tujuan (dst_vendor)	PanOSDestinationDeviceVendor		dst_vendor	target.asset.hardware.manufacturer
Kategori OS Perangkat Tujuan (dst_osfamily)	PanOSDestinationDeviceOSFamily		dst_osfamily	target.platform
Versi OS Perangkat Tujuan (dst_osversion)	PanOSDestinationDeviceOSVersion			target.platform_version
Nama Host Tujuan (dst_host)	PanOSDestinationDeviceHost			target.hostname
Alamat MAC Tujuan (dst_mac)	PanOSDestinationDeviceMac			target.mac
Nomor Urut (seqno)	PanOSLogTypeSeqNo			metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags		actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1)		DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)		DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)		DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)		DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)				intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)				intermediary.hostname
ID Sistem Virtual (vsys_id)				intermediary.resource.product_object_id
Subkategori Aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori Aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi Aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko Aplikasi (risk_of_app)				security_result.severity
Karakteristik Aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Penampung Aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
SaaS Aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details

Terowongan

Tabel berikut mencantumkan kolom log dari jenis log tunnel dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Alamat Sumber (src)	src	src		principal.ip
Alamat Tujuan (dst)	dst	dst		target.ip
IP Sumber NAT (natsrc)	sourceTranslatedAddress	srcPostNAT		principal.nat_ip
IP Tujuan NAT (natdst)	destinationTranslatedAddress	dstPostNAT		target.nat_ip
Nama Aturan (rule)	cs1	RuleName		security_result.rule_name
Pengguna Sumber (srcuser)	suser	SourceUser / usrName		principal.user.userid
Pengguna Tujuan (dstuser)	duser	DestinationUser		target.user.userid
Aplikasi (app)	aplikasi	Aplikasi		network.application_protocol
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)	cs4	SourceZone	dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)	cs5	DestinationZone	sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)	deviceInboundInterface	IngressInterface	inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)	deviceOutboundInterface	EgressInterface	outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6	LogForwardingProfile	logset	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)	cn1	SessionID		network.session_id
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)	spt	srcPort		principal.port
Port Tujuan (dport)	dpt	dstPort		target.port
Port Sumber NAT (natsport)	sourceTranslatedPort	srcPostNATPort		principal.nat_port
Port Tujuan NAT (natdport)	destinationTranslatedPort	dstPostNATPort		target.nat_port
Flag (flags)	flexString1	Flag	flag	additional.fields.key dan additional.fields.value.string_value
Protokol IP (proto)	proto	proto		network.ip_protocol
Tindakan (action)	act	tindakan		security_result.action_details security_result.action
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Lokasi Sumber (srcloc)				principal.location.country_or_region
Lokasi Tujuan (dstloc)				target.location.country_or_region
Hierarki Grup Perangkat (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname
ID Tunnel (tunnelid)	PanOSTunnelID	TunnelID	tunnelid	additional.fields.key dan additional.fields.value.string_value
Tag Pemantauan (monitortag)	PanOSMonitorTag	MonitorTag	monitortag	additional.fields.key dan additional.fields.value.string_value
ID Sesi Induk (parent_session_id)	PanOSParentSessionID	ParentSessionID	parent_session_id	network.parent_session_id
Waktu Mulai Induk (parent_start_time)	PanOSParentStartTime	ParentStartTime	parent_start_time	additional.fields.key dan additional.fields.value.string_value
Jenis Tunnel (tunnel)	cs2	TunnelType	tunnel	additional.fields.key dan additional.fields.value.string_value
Byte (byte)	flexNumber1	totalBytes	byte	additional.fields.key dan additional.fields.value.string_value
Byte Terkirim (bytes_sent)	di	srcBytes		network.sent_bytes
Byte Diterima (bytes_received)	keluar	dstBytes		network.received_bytes
Paket (paket)	cn2	totalPackets	paket	additional.fields.key dan additional.fields.value.string_value
Paket Terkirim (pkts_sent)	PanOSPacketsSent	srcPackets	pkts_sent	network.sent_packets
Paket yang Diterima (pkts_received)	PanOSPacketsReceived	dstPackets	pkts_received	network.received_packets
Enkapsulasi Maksimum (max_encap)	flexNumber2	MaximumEncapsulation	max_encap	additional.fields.key dan additional.fields.value.string_value
Protokol Tidak Diketahui (unknown_proto)	cfp1	UnknownProtocol	unknown_proto	additional.fields.key dan additional.fields.value.string_value
Pemeriksaan Ketat (strict_check)	cfp2	StrictChecking	strict_check	additional.fields.key dan additional.fields.value.string_value
Fragmen Terowongan (tunnel_fragment)	PanOSTunnelFragment	TunnelFragment	tunnel_fragment	additional.fields.key dan additional.fields.value.string_value
Sesi yang Dibuat (sessions_created)	cfp3	SessionsCreated	sessions_created	additional.fields.key dan additional.fields.value.string_value
Sesi Ditutup (sessions_closed)	cfp4	SessionsClosed	sessions_closed	additional.fields.key dan additional.fields.value.string_value
Alasan Akhir Sesi (session_end_reason)	mampu bernalar	SessionEndReason		security_result.summary
Sumber Tindakan (action_source)	cat	ActionSource	action_source	additional.fields.key dan additional.fields.value.string_value
Waktu Mulai (start)		startTime	mulai	additional.fields.key dan additional.fields.value.string_value
Waktu Berlalu (elapsed)	cn3	ElapsedTime	berlalu	network.session_duration.seconds
Aturan Inspeksi Tunnel (tunnel_insp_rule)	PanOSTunneInspectionRule			security_result.rule_name = "Tunnel Inspection Rule: %{PanOSTunnelInspectionRule}"
IP Pengguna Jarak Jauh (remote_user_ip)	PanOSRmtUserIP			principal.ip
ID Pengguna Jarak Jauh (remote_user_id)	PanOSRmtUserID		remote_user_id	principal.user.userid
UUID Aturan Keamanan (rule_uuid)	PanOSRuleUUID			security_result.rule_id
ID PCAP (pcap_id)	PanOSPcapID		pcap_id	additional.fields.key dan additional.fields.value.string_value
Nama Grup Pengguna Dinamis (dynusergroup_name)	PanDynamicUsrgrp			principal.group.group_display_name
Daftar Dinamis Eksternal Sumber (src_edl)	PanOSSourceEDL		src_edl	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Daftar Dinamis Eksternal Tujuan (dst_edl)	PanOSDestinationEDL		dst_edl	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (stempel waktu high_res)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Slice Differentiator (nssai_sd)			nssai_sd	additional.fields.key dan additional.fields.value.string_value
Jenis Layanan Slice (nssai_sd)			nssai_sd1	additional.fields.key dan additional.fields.value.string_value
ID Sesi PDU (pdu_session_id)			pdu_session_id	additional.fields.key dan additional.fields.value.string_value
Subkategori Aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori Aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi Aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko Aplikasi (risk_of_app)			risk_of_app	additional.fields.key dan additional.fields.value.string_value
Karakteristik Aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Penampung Aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
SaaS Aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Aplikasi yang Di-tunnel (tunneled_app)				additional.fields.key dan additional.fields.value.string_value
Offloaded (offloaded)				additional.fields.key dan additional.fields.value.string_value
Jenis Alur (flow_type)				additional.fields.key dan additional.fields.value.string_value
Nama Cluster (cluster_name)				principal.resource.name
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value

Autentikasi

Tabel berikut mencantumkan kolom log dari jenis log autentikasi dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
IP Sumber (ip)	src	src		principal.ip
Pengguna (user)	duser	usrName		target.user.userid
Menormalisasi Pengguna (normalize_user)	cs2	NormalizeUser		target.user.user_display_name
Objek (object)	fname	ObjectName	objek	target.resource.name
Kebijakan Autentikasi (authpolicy)	cs4	AuthPolicy	authpolicy	additional.fields.key dan additional.fields.value.string_value
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
ID Autentikasi (authid)	cn2	AuthenticationID	authid	additional.fields.key dan additional.fields.value.string_value
Vendor (vendor)	flexString2	Vendor	vendor	additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6	LogForwardingProfile	logset	additional.fields.key dan additional.fields.value.string_value
Profil Server (serverprofile)	cs1	ServerProfile	serverprofile	additional.fields.key dan additional.fields.value.string_value
Deskripsi (desc)	PanOSDesc	AdditionalAuthInfo		security_result.description
Jenis Klien (clienttype)	cs5	ClientType	clienttype	additional.fields.key dan additional.fields.value.string_value
Jenis Peristiwa (peristiwa)	msg	msg		extensions.auth.auth_details
Nomor Faktor (factorno)	cn1	FactorNumber	factorno	additional.fields.key dan additional.fields.value.string_value
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname
ID Sistem Virtual (vsys_id)				intermediary.resource.product_object_id
Protokol Autentikasi (authproto)			authproto	additional.fields.key dan additional.fields.value.string_value
UUID untuk aturan (rule_uuid)	PanOSRuleUUID/RuleUUID			security_result.rule_id
Stempel Waktu Resolusi Tinggi (high_res _timestamp)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Kategori Perangkat Sumber (src_category)	PanOSSourceDeviceCategory		src_category	principal.asset.category
Profil Perangkat Sumber (src_profile)	PanOSSourceDeviceProfile		src_profile	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Sumber (src_model)	PanOSSourceDeviceModel		src_model	principal.asset.hardware.model
Vendor Perangkat Sumber (src_vendor)	PanOSSourceDeviceVendor		src_vendor	principal.asset.hardware.manufacturer
Kategori OS Perangkat Sumber (src_osfamily)	PanOSSourceDeviceOSFamily			principal.platform
Versi OS Perangkat Sumber (src_osversion)	PanOSSourceDeviceOSVersion			principal.platform_version
Nama Host Sumber (src_host)	PanOSSourceHostname			principal.hostname
Alamat MAC Sumber (src_mac)	PanOSSourceMac			principal.asset.mac
Region (region)	PanOSTrafficOriginRegion			principal.location.country_or_region
Agen Pengguna (user_agent)	PanOSHTTPUserAgent			network.http.user_agent
ID Sesi(sessionid)	PanOSTrafficSessionID			network.session_id
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details
Nama Cluster (cluster_name)				principal.resource.name

URL

Tabel berikut mencantumkan kolom log dari jenis log URL dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Receive Time (cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor seri (serial)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Pembuatan				metadata.event_timestamp
Alamat sumber (src)	src	src		principal.ip
Alamat tujuan (dst)	dst	dst		target.ip
IP Sumber NAT (natsrc)	sourceTranslatedAddress	srcPostNAT		principal.nat_ip
IP Tujuan NAT (natdst)	destinationTranslatedAddress	dstPostNAT		target.nat_ip
Aturan (rule)	cs1	RuleName		security_result.rule_name
Pengguna Sumber (srcuser)	suser	SourceUser		principal.user.userid
Pengguna Tujuan (dstuser)	duser	DestinationUser		target.user.userid
Aplikasi (app)	aplikasi	Aplikasi		network.application_protocol
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)	cs4	SourceZone	dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)	cs5	DestinationZone	sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)	deviceInboundInterface	IngressInterface	inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)	deviceOutboundInterface	EgressInterface	outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6	LogForwardingProfile	logset	additional.fields.key dan additional.fields.value.string_value
Waktu yang Dicatat			time_logged	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)	cn1	SessionID		network.session_id
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)	spt	srcPort		principal.port
Port Tujuan (dport)	dpt	dstPort		target.port
Port Sumber NAT (natsport)	sourceTranslatedPort	srcPostNATPort		principal.nat_port
Port Tujuan NAT (natdport)	destinationTranslatedPort	dstPostNATPort		target.nat_port
Flag (flags)	flexString1	Flag	flag	additional.fields.key dan additional.fields.value.string_value
Protokol IP (proto)	proto	proto		network.ip_protocol
Tindakan (action)	act	tindakan		security_result.action_details security_result.action
URL/Nama file (lain-lain)		Lain-lain		target.file.names target.url
Nama Ancaman/Konten (threatid)	cat	ThreatID		security_result.threat_id
Kategori (category)	cs2	URLCategory	category	security_result.category_details
Tingkat keparahan (severity)	number-of-severity (Header)	Keparahan		security_result.severity security_result.severity_details
Direction (arah)	flexString2	Arah		network.direction
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Negara Sumber (srcloc)		SourceLocation		principal.location.country_or_region
Negara Tujuan (dstloc)		DestinationLocation		target.location.country_or_region
contenttype (contenttype)	requestContext	ContentType	contenttype	additional.fields.key dan additional.fields.value.string_value
pcap_id (pcap_id)	fileId	PCAP_ID	pcap_id	additional.fields.key dan additional.fields.value.string_value
filedigest (filedigest)		FileDigest		target.file.sha1/md5/sha256
cloud (cloud)		Cloud	cloud	additional.fields.key dan additional.fields.value.string_value
url_idx (url_idx)		URLIndex	url_idx	additional.fields.key dan additional.fields.value.string_value
user_agent (user_agent)	requestClientApplication	UserAgent		network.http.user_agent
filetype (filetype)				target.file.mime_type
xff (xff)	PanOSXForwarderfor	identSrc	xff	principal.ip
referer (referer)	PanOSReferer	Referer		network.http.referral_url
pengirim (sender)				network.email.from
subject (subjek)		Subjek		network.email.subject
penerima (penerima)				network.email.to
reportid (reportid)			reportid	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 1 (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 2 (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 3 (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 4 (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname
file_url (file_url)				target.url
UUID VM Sumber (src_uuid)		SrcUUID		principal.asset.product_object_id
UUID VM tujuan (dst_uuid)		DstUUID		target.asset.product_object_id
http_method (http_method)	requestMethod	RequestMethod		network.http.method
ID Tunnel/IMSI (tunnelid)	PanOSTunnelID	TunnelID	tunnelid	additional.fields.key dan additional.fields.value.string_value
Tag/IMEI Pemantauan (monitortag)	PanOSMonitorTag	MonitorTag	monitortag	additional.fields.key dan additional.fields.value.string_value
ID Sesi Induk (parent_session_id)	PanOSParentSessionID	ParentSessionID	parent_session_id	network.parent_session_id
Waktu Mulai Sesi Induk (parent_start_time)	PanOSParentStartTime	ParentStartTime	parent_start_time	additional.fields.key dan additional.fields.value.string_value
Tunnel (tunnel)	PanOSTunnelType	TunnelType	tunnel	additional.fields.key dan additional.fields.value.string_value
thr_category (thr_category)	PanOSThreatCategory	ThreatCategory	thr_category	security_result.detection_fields.key/value
contentver (contentver)	PanOSContentVer	ContentVer	contentver	additional.fields.key dan additional.fields.value.string_value
sig_flags (sig_flags)			sig_flags	additional.fields.key dan additional.fields.value.string_value
ID Pengaitan SCTP (assoc_id)	PanOSAssocID		assoc_id	additional.fields.key dan additional.fields.value.string_value
ID Protokol Payload (ppid)	PanOSPPID		ppid	additional.fields.key dan additional.fields.value.string_value
http_headers (http_headers)	PanOSHTTPHeader		http_headers	target.url.last_http_response_headers
Daftar Kategori URL (url_category_list)	PanOSURLCatList		url_category_list	additional.fields.key dan additional.fields.value.string_value
UUID untuk aturan (rule_uuid)	PanOSRuleUUID		rule_uuid	security_result.rule_id
Koneksi HTTP/2 (http2_connection)	PanOSHTTP2Con		http2_connection	network.application_protocol_version
dynusergroup_name (dynusergroup_name)	PanDynamicUsrgrp		dynusergroup_name	additional.fields.key dan additional.fields.value.string_value
Alamat XFF (xff_ip)	PanXFFIP			principal.ip
Kategori Perangkat Sumber (src_category)	PanSrcDeviceCat		src_category	principal.asset.category
Profil Perangkat Sumber (src_profile)	PanSrcDeviceProf		src_profile	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Sumber (src_model)	PanSrcDeviceModel		src_model	principal.asset.hardware.model
Vendor Perangkat Sumber (src_vendor)	PanSrcDeviceVendor		src_vendor	principal.asset.hardware.manufacturer
Kategori OS Perangkat Sumber (src_osfamily)	PanSrcDeviceOS			principal.platform
Versi OS Perangkat Sumber (src_osversion)	PanSrcDeviceOSv			principal.platform_version
Nama Host Sumber (src_host)	PanSrcHostname		src_host	principal.hostname
Alamat MAC Sumber (src_mac)	PanSrcMac			principal.mac
Kategori Perangkat Tujuan (dst_category)	PanDstDeviceCat		dst_category	target.asset.category
Profil Perangkat Tujuan (dst_profile)	PanDstDeviceProf		dst_profile	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Tujuan (dst_model)	PanDstDeviceModel		dst_model	target.asset.hardware.model
Vendor Perangkat Tujuan (dst_vendor)	PanDstDeviceVendor		dst_vendor	target.asset.hardware.manufacturer
Kategori OS Perangkat Tujuan (dst_osfamily)	PanDstDeviceOS			target.platform
Versi OS Perangkat Tujuan (dst_osversion)	PanDstDeviceOSv			target.platform_version
Nama Host Tujuan (dst_host)	PanPODNamespace			target.hostname
Alamat MAC Tujuan (dst_mac)	PanDstMac			target.mac
ID Penampung (container_id)	PanContainerName		container_id	intermediary.resource.product_object_id
Namespace POD (pod_namespace)	PanPODNamespace		pod_namespace	target.resource.attribute.labels.key/value
Nama POD (pod_name)	PanPODName		pod_name	target.resource.name
Daftar Dinamis Eksternal Sumber (src_edl)	PanSrcEDL		src_edl	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Daftar Dinamis Eksternal Tujuan (dst_edl)	PanDstEDL		dst_edl	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
ID Host (hostid)	PanGPHostID		hostid	principal.asset.asset_id
Nomor Seri (serialnumber)	PanEPSerial			principal.asset.hardware.serial_number
domain_edl (domain_edl)	PanDomainEDL		domain_edl	additional.fields.key dan additional.fields.value.string_value
Grup Alamat Dinamis Sumber (src_dag)	PanSrcDAG			principal.group.group_display_name
Destination Dynamic Address Group (dst_dag)	PanDstDAG			target.group.group_display_name
partial_hash (partial_hash)	PanPartialHash		partial_hash	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (high_res_timestamp)	PanTimeHighRes			additional.fields.key dan additional.fields.value.string_value
Alasan (reason)	PanReasonFilteringAction		mampu bernalar	security_result.summary
justification (justification)	PanJustification		justification	additional.fields.key dan additional.fields.value.string_value
nssai_sst (nssai_sst)	PanASServiceType		nssai_sst	additional.fields.key dan additional.fields.value.string_value
Subkategori aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko aplikasi (risk_of_app)			risk_of_app	additional.fields.key dan additional.fields.value.string_value
Karakteristik aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Container aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
Aplikasi yang di-tunnel (tunneled_app)			tunneled_app	additional.fields.key dan additional.fields.value.string_value
SaaS aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value
ID Laporan Cloud (cloud_reportid)				additional.fields.key dan additional.fields.value.string_value
Nama Cluster (cluster_name)				principal.resource.name
Jenis Alur (flow_type)				additional.fields.key dan additional.fields.value.string_value

Data

Tabel berikut mencantumkan kolom log dari jenis log data dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Receive Time (cef-formatted-receive_time)	rt	devTime		metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor seri (serial)	deviceExternalId	SerialNumber		intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)	cat		metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Pembuatan				metadata.event_timestamp
Alamat sumber (src)	src	src		principal.ip
Alamat tujuan (dst)	dst	dst		target.ip
IP Sumber NAT (natsrc)	sourceTranslatedAddress	srcPostNAT		principal.nat_ip
IP Tujuan NAT (natdst)	destinationTranslatedAddress	dstPostNAT		target.nat_ip
Aturan (rule)	cs1	RuleName		security_result.rule_name
Pengguna Sumber (srcuser)	suser	SourceUser		principal.user.userid
Pengguna Tujuan (dstuser)	duser	DestinationUser		target.user.userid
Aplikasi (app)	aplikasi	Aplikasi		network.application_protocol
Sistem Virtual (vsys)	cs3	VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)	cs4	SourceZone	dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)	cs5	DestinationZone	sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)	deviceInboundInterface	IngressInterface	inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)	deviceOutboundInterface	EgressInterface	outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)	cs6	LogForwardingProfile	logset	additional.fields.key dan additional.fields.value.string_value
Waktu yang Dicatat			time_logged	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)	cn1	SessionID		network.session_id
Jumlah Pengulangan (repeatcnt)	cnt	RepeatCount	repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)	spt	srcPort		principal.port
Port Tujuan (dport)	dpt	dstPort		target.port
Port Sumber NAT (natsport)	sourceTranslatedPort	srcPostNATPort		principal.nat_port
Port Tujuan NAT (natdport)	destinationTranslatedPort	dstPostNATPort		target.nat_port
Flag (flags)	flexString1	Flag	flag	additional.fields.key dan additional.fields.value.string_value
Protokol IP (proto)	proto	proto		network.ip_protocol
Tindakan (action)	act	tindakan		security_result.action_details security_result.action
URL/Nama file (lain-lain)		Lain-lain		target.file.names target.url
Nama Ancaman/Konten (threatid)	cat	ThreatID		security_result.threat_id
Kategori (category)	cs2	URLCategory	category	security_result.category_details
Tingkat keparahan (severity)	number-of-severity (Header)	Keparahan		security_result.severity security_result.severity_details
Direction (arah)	flexString2	Arah		network.direction
Nomor Urut (seqno)	externalId	urutan		metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags	ActionFlags	actionflags	additional.fields.key dan additional.fields.value.string_value
Negara Sumber (srcloc)		SourceLocation		principal.location.country_or_region
Negara Tujuan (dstloc)		DestinationLocation		target.location.country_or_region
contenttype (contenttype)		ContentType	contenttype	additional.fields.key dan additional.fields.value.string_value
pcap_id (pcap_id)	fileId	PCAP_ID	pcap_id	additional.fields.key dan additional.fields.value.string_value
filedigest (filedigest)		FileDigest		target.file.sha1/md5/sha256
cloud (cloud)		Cloud	cloud	additional.fields.key dan additional.fields.value.string_value
url_idx (url_idx)		URLIndex	url_idx	additional.fields.key dan additional.fields.value.string_value
user_agent (user_agent)				network.http.user_agent
filetype (filetype)				target.file.mime_type
xff (xff)			xff	principal.ip
referer (referer)				network.http.referral_url
pengirim (sender)				network.email.from
subject (subjek)		Subjek		network.email.subject
penerima (penerima)				network.email.to
reportid (reportid)			reportid	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 1 (dg_hier_level_1)	PanOSDGl1	DeviceGroupHierarchyL1	dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 2 (dg_hier_level_2)	PanOSDGl2	DeviceGroupHierarchyL2	dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 3 (dg_hier_level_3)	PanOSDGl3	DeviceGroupHierarchyL3	dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
DG Hierarchy Level 4 (dg_hier_level_4)	PanOSDGl4	DeviceGroupHierarchyL4	dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)	PanOSVsysName	vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)	dvchost	DeviceName		intermediary.hostname
file_url (file_url)				target.url
UUID VM Sumber (src_uuid)		SrcUUID		principal.asset.product_object_id
UUID VM tujuan (dst_uuid)		DstUUID		target.asset.product_object_id
http_method (http_method)		RequestMethod		network.http.method
ID Tunnel/IMSI (tunnelid)	PanOSTunnelID	TunnelID	tunnelid	additional.fields.key dan additional.fields.value.string_value
Tag/IMEI Pemantauan (monitortag)	PanOSMonitorTag	MonitorTag	monitortag	additional.fields.key dan additional.fields.value.string_value
ID Sesi Induk (parent_session_id)	PanOSParentSessionID	ParentSessionID	parent_session_id	network.parent_session_id
Waktu Mulai Sesi Induk (parent_start_time)	PanOSParentStartTime	ParentStartTime	parent_start_time	additional.fields.key dan additional.fields.value.string_value
Tunnel (tunnel)	PanOSTunnelType	TunnelType	tunnel	additional.fields.key dan additional.fields.value.string_value
thr_category (thr_category)	PanOSThreatCategory	ThreatCategory	thr_category	security_result.detection_fields.key/value
contentver (contentver)	PanOSContentVer	ContentVer	contentver	additional.fields.key dan additional.fields.value.string_value
sig_flags (sig_flags)			sig_flags	additional.fields.key dan additional.fields.value.string_value
ID Pengaitan SCTP (assoc_id)	PanOSAssocID		assoc_id	additional.fields.key dan additional.fields.value.string_value
ID Protokol Payload (ppid)	PanOSPPID		ppid	additional.fields.key dan additional.fields.value.string_value
http_headers (http_headers)	PanOSHTTPHeader		http_headers	target.url.last_http_response_headers
Daftar Kategori URL (url_category_list)			url_category_list	additional.fields.key dan additional.fields.value.string_value
UUID untuk aturan (rule_uuid)	PanOSRuleUUID		rule_uuid	security_result.rule_id
Koneksi HTTP/2 (http2_connection)			http2_connection	network.application_protocol_version
dynusergroup_name (dynusergroup_name)			dynusergroup_name	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Alamat XFF (xff_ip)				principal.ip
Kategori Perangkat Sumber (src_category)			src_category	principal.asset.category
Profil Perangkat Sumber (src_profile)			src_profile	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Sumber (src_model)			src_model	principal.asset.hardware.model
Vendor Perangkat Sumber (src_vendor)			src_vendor	principal.asset.hardware.manufacturer
Kategori OS Perangkat Sumber (src_osfamily)				principal.platform
Versi OS Perangkat Sumber (src_osversion)				principal.platform_version
Nama Host Sumber (src_host)			src_host	principal.hostname
Alamat MAC Sumber (src_mac)				principal.mac
Kategori Perangkat Tujuan (dst_category)			dst_category	target.asset.category
Profil Perangkat Tujuan (dst_profile)			dst_profile	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Model Perangkat Tujuan (dst_model)			dst_model	target.asset.hardware.model
Vendor Perangkat Tujuan (dst_vendor)			dst_vendor	target.asset.hardware.manufacturer
Kategori OS Perangkat Tujuan (dst_osfamily)				target.platform
Versi OS Perangkat Tujuan (dst_osversion)				target.platform_version
Nama Host Tujuan (dst_host)				target.hostname
Alamat MAC Tujuan (dst_mac)				target.mac
ID Penampung (container_id)			container_id	intermediary.resource.product_object_id
Namespace POD (pod_namespace)			pod_namespace	target.resource.attribute.labels.key/value
Nama POD (pod_name)			pod_name	target.resource.name
Daftar Dinamis Eksternal Sumber (src_edl)			src_edl	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Daftar Dinamis Eksternal Tujuan (dst_edl)			dst_edl	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
ID Host (hostid)			hostid	principal.asset.asset_id
Nomor Seri (serialnumber)				principal.asset.hardware.serial_number
domain_edl (domain_edl)			domain_edl	additional.fields.key dan additional.fields.value.string_value
Grup Alamat Dinamis Sumber (src_dag)				principal.group.group_display_name
Destination Dynamic Address Group (dst_dag)				target.group.group_display_name
partial_hash (partial_hash)			partial_hash	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (high_res_timestamp)				additional.fields.key dan additional.fields.value.string_value
Alasan (reason)			mampu bernalar	security_result.summary
justification (justification)			justification	additional.fields.key dan additional.fields.value.string_value
nssai_sst (nssai_sst)			nssai_sst	additional.fields.key dan additional.fields.value.string_value
Subkategori aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko aplikasi (risk_of_app)			risk_of_app	additional.fields.key dan additional.fields.value.string_value
Karakteristik aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Container aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
Aplikasi yang di-tunnel (tunneled_app)			tunneled_app	additional.fields.key dan additional.fields.value.string_value
SaaS aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value
ID Laporan Cloud (cloud_reportid)				additional.fields.key dan additional.fields.value.string_value
Nama Cluster (cluster_name)				principal.resource.name
Jenis Alur (flow_type)				additional.fields.key dan additional.fields.value.string_value

GlobalProtect

Tabel berikut mencantumkan kolom log dari jenis log GlobalProtect dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time)	rt		received_time	metadata.event_timestamp
Nomor seri (serial)	PanOSDeviceSN		intermediary_asset_hardware_serial_number	intermediary.asset.hardware.serial_number
Jenis (type)	type (Header)			metadata.product_event_type
Jenis Ancaman/Konten (subjenis)	subtype (Header)	Subjenis		metadata.product_event_type
Waktu Pembuatan (time_generated)	PanOSLogTimeStamp		generated_timestamp	metadata.event_timestamp
Sistem Virtual (vsys)	PanOSVirtualSystem		vsys	intermediary.asset.attribute.labels.key/value
ID Peristiwa (eventid)	PanOSEventID		event_id	additional.fields.key dan additional.fields.value.string_value
Tahap (stage)	PanOSStage		tahap	additional.fields.key dan additional.fields.value.string_value
Metode Autentikasi (auth_method)	PanOSAuthMethod		extension_auth_auth_details	extensions.auth.auth_details
Jenis Tunnel (tunnel_type)	PanOSTunnelType		tunnel	additional.fields.key dan additional.fields.value.string_value
Pengguna Sumber (srcuser)	PanOSSourceUserName		src_user	principal.user.email_address principal.user.userid principal.administrative_domain
Region Sumber (srcregion)	PanOSSourceRegion		src_region	principal.location.country_or_region
Nama Perangkat (machinename)	PanOSEndpointDeviceName		machine_name	principal.hostname
IP Publik (public_ip)	PanOSPublicIPv4			principal.nat_ip
IPv6 Publik (public_ipv6)	PanOSPublicIPv6			principal.nat_ip
IP Pribadi (private_ip)	PanOSPrivateIPv4			principal.ip
IPv6 pribadi (private_ipv6)	PanOSPrivateIPv6			principal.ip
ID Host (hostid)	PanOSHostID		hostid	principal.asset.asset_id
Nomor Seri (serialnumber)	PanOSDeviceSN			principal.asset.hardware.serial_number
Versi Klien (client_ver)	PanOSGlobalProtectClientVersion		client_ver	additional.fields.key dan additional.fields.value.string_value
OS Klien (client_os)	PanOSEndpointOSType			principal.platform
Versi OS Klien (client_os_ver)	PanOSEndpointOSVersion			principal.platform_version
Jumlah Pengulangan (repeatcnt)	PanOSCountOfRepeats		repeatcnt	additional.fields.key dan additional.fields.value.string_value
Alasan (reason)	PanOSQuarantineReason			security_result.summary
Error (error)	PanOSConnectionError		error	security_result.description
Deskripsi (buram)	PanOSDescription			security_result.description
Status (status)	PanOSEventStatus		status	additional.fields.key dan additional.fields.value.string_value
Lokasi (location)	PanOSGPGatewayLocation			target.location.country_or_region
Durasi Login (login_duration)	PanOSLoginDuration			network.session_duration
Metode Koneksi (connect_method)	PanOSConnectionMethod		connect_method	additional.fields.key dan additional.fields.value.string_value
Kode Error (error_code)	PanOSConnectionErrorID		error_code	additional.fields.key dan additional.fields.value.string_value
Portal (portal)	PanOSPortal		portal	additional.fields.key dan additional.fields.value.string_value
Nomor Urut (seqno)	PanOSSequenceNo			metadata.product_log_id
Action Flags (actionflags)	PanOSActionFlags		actionflags	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (high_res_timestamp)	PanOSTimeGeneratedHighResolution			additional.fields.key dan additional.fields.value.string_value
Metode Pemilihan Gateway (selection_type)	PanOSGatewaySelectionType		selection_type	additional.fields.key dan additional.fields.value.string_value
Waktu Respons SSL (response_time)	PanOSSSLResponseTime		response_time	additional.fields.key dan additional.fields.value.string_value
Prioritas Gateway (priority)	PanOSGatewayPriority		priority	additional.fields.key dan additional.fields.value.string_value
Gateway yang Dicoba (attempted_gateways)	PanOSAttemptedGateways		attempted_gateways	additional.fields.key dan additional.fields.value.string_value
Nama Gateway (gateway)	PanOSAttemptedGateways		gateway	target.resource.name
Hierarki Grup Perangkat (dg_hier_level_1)			dg_hier_level_1	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_2)			dg_hier_level_2	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_3)			dg_hier_level_3	additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat (dg_hier_level_4)			dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)				intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)				intermediary.hostname
ID Sistem Virtual (vsys_id)				intermediary.resource.product_object_id
Tingkat keparahan (severity)	number-of-severity(header)			security_result.severity dan security_result.severity_details
Nama Cluster (cluster_name)				principal.resource.name

Korelasi

Tabel berikut mencantumkan kolom log dari jenis log Korelasi dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Dibuat (time_generated atau cef-formatted-time_generated)		startTime	generated_timestamp	metadata.event_timestamp
Alamat Sumber (src)		src		principal.ip
Pengguna Sumber (srcuser)		SourceUser / usrName		principal.user.userid
Sistem Virtual (vsys)		VirtualSystem	vsys	intermediary.asset.attribute.labels.key/value
Kategori (category)				security_result.category_details
Tingkat keparahan (severity)		Keparahan		security_result.severity dan security_result.severity_details
Hierarki Grup Perangkat Level 1		DeviceGroupHierarchyL1		additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat Level 2		DeviceGroupHierarchyL2		additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat Level 3		DeviceGroupHierarchyL3		additional.fields.key dan additional.fields.value.string_value
Hierarki Grup Perangkat Level 4		DeviceGroupHierarchyL4		additional.fields.key dan additional.fields.value.string_value
Nama Sistem Virtual (vsys_name)		vSrcName		intermediary.asset.attribute.labels.key/value
Nama Perangkat (device_name)		DeviceName		intermediary.hostname intermediary.asset.hostname target.hostname target.asset.hostname
ID Sistem Virtual (vsys_id)		VirtualSystemID		intermediary.resource.product_object_id
Nama Objek (objectname)		ObjectName		target.resource.name
ID Objek (object_id)		ObjectID		target.resource.product_object_id
Bukti (evidence)		msg		security_result.summary

GTP

Tabel berikut mencantumkan kolom log dari jenis log gtp dan kolom UDM yang sesuai.

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)				metadata.collected_timestamp, metadata.event_timestamp (jika "Generate Time" tidak ada)
Nomor Seri (serial)				intermediary.asset.hardware.serial_number
Jenis (type)				metadata.product_event_type
Jenis Ancaman/Konten (subjenis)				metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)				metadata.event_timestamp
Alamat Sumber (src)				principal.ip
Alamat Tujuan (dst)				target.ip
Nama Aturan (rule)				security_result.rule_name
Aplikasi (app)				network.application_protocol
Sistem Virtual (vsys)			vsys	intermediary.asset.attribute.labels.key/value
Zona Sumber (dari)			dari	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)			sampai	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)			inbound_if	principal.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)			outbound_if	target.resource.attribute.labels.key/value additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)			logset	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)				network.session_id
Port Sumber (sport)				principal.port
Port Tujuan (dport)				target.port
Protokol IP (proto)				network.ip_protocol
Tindakan (action)				security_result.action_details security_result.action
Jenis Peristiwa GTP (event_type)			gtp_event_type	additional.fields.key dan additional.fields.value.string_value
MSISDN (msisdn)			msisdn	additional.fields.key dan additional.fields.value.string_value
Nama Poin Akses (APN)			apn	additional.fields.key dan additional.fields.value.string_value
Teknologi Akses Radio (rat)			tikus	additional.fields.key dan additional.fields.value.string_value
Jenis Pesan GTP (msg_type)			gtp_msg_type	additional.fields.key dan additional.fields.value.string_value
Alamat IP Akhir (end_ip_adr)				principal.ip
Tunnel Endpoint Identifier1 (teid1)			teid1	additional.fields.key dan additional.fields.value.string_value
Tunnel Endpoint Identifier2 (teid2)			teid2	additional.fields.key dan additional.fields.value.string_value
Antarmuka GTP (gtp_interface)			gtp_interface	additional.fields.key dan additional.fields.value.string_value
Penyebab GTP (cause_code)			gtp_cause_code	additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)				security_result.severity dan security_result.severity_details
MCC Jaringan Penayangan (mcc)			mcc	additional.fields.key dan additional.fields.value.string_value
MNC Jaringan Penyaji (mnc)			mnc	additional.fields.key dan additional.fields.value.string_value
Kode Area (area_code)			area_code	additional.fields.key dan additional.fields.value.string_value
ID Sel (cell_id)			cell_id	additional.fields.key dan additional.fields.value.string_value
Kode Peristiwa GTP (event_code)			event_code	additional.fields.key dan additional.fields.value.string_value
Lokasi Sumber (srcloc)				principal.location.country_or_region
Lokasi Tujuan (dstloc)				target.location.country_or_region
ID Tunnel/IMSI (imsi)			tunnelid	additional.fields.key dan additional.fields.value.string_value
Tag/IMEI Monitor (imei)			monitortag	additional.fields.key dan additional.fields.value.string_value
Waktu Mulai (start)			mulai	additional.fields.key dan additional.fields.value.string_value
Waktu Berlalu (elapsed)				network.session_duration.seconds
Tunnel Aturan Inspeksi Tunnel (tunnel_insp_rule)			tunnel_insp_rule	security_result.detection_fields.key/value
IP Pengguna Jarak Jauh (remote_user_ip)				principal.ip
ID Pengguna Jarak Jauh (remote_user_id)			remote_user_id	principal.user.userid
UUID untuk aturan (rule_uuid)				security_result.rule_id
ID PCAP (pcap_id)			pcap_id	additional.fields.key dan additional.fields.value.string_value
Stempel Waktu Resolusi Tinggi (high_res_timestamp)				additional.fields.key dan additional.fields.value.string_value
Jenis Layanan Slice (nsdsai_sst)			nsdsai_sst	additional.fields.key dan additional.fields.value.string_value
Slice Differentiator (nsdsai_sd)			nsdsai_sd	additional.fields.key dan additional.fields.value.string_value
Subkategori Aplikasi (subcategory_of_app)			subcategory_of_app	additional.fields.key dan additional.fields.value.string_value
Kategori Aplikasi (category_of_app)			category_of_app	additional.fields.key dan additional.fields.value.string_value
Teknologi Aplikasi (technology_of_app)			technology_of_app	additional.fields.key dan additional.fields.value.string_value
Risiko Aplikasi (risk_of_app)			risk_of_app	additional.fields.key dan additional.fields.value.string_value
Karakteristik Aplikasi (characteristic_of_app)			characteristic_of_app	additional.fields.key dan additional.fields.value.string_value
Penampung Aplikasi (container_of_app)			container_of_app	additional.fields.key dan additional.fields.value.string_value
SaaS Aplikasi (is_saas_of_app)			is_saas_of_app	additional.fields.key dan additional.fields.value.string_value
Status Aplikasi yang Disetujui (sanctioned_state_of_app)			sanctioned_state_of_app	additional.fields.key dan additional.fields.value.string_value

SCTP

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Penerimaan (receive_time atau cef-formatted-receive_time)			receive_time atau cef-formatted-receive_time	metadata.collected_timestamp
Nomor Seri (serial)			serial	intermediary.asset.hardware.serial_number
Jenis (type)			jenis	metadata.product_event_type
Waktu Dibuat (time_generated atau cef-formatted-time_generated)			time_generated atau cef-formatted-time_generated	metadata.event_timestamp
Alamat Sumber (src)			src	principal.ip
Alamat Tujuan (dst)			dst	target.ip
Nama Aturan (rule)			aturan	security_result.rule_name
Zona Sumber (dari)			dari	additional.fields.key dan additional.fields.value.string_value
Zona Tujuan (ke)			sampai	additional.fields.key dan additional.fields.value.string_value
Antarmuka Masuk (inbound_if)			inbound_if	additional.fields.key dan additional.fields.value.string_value
Antarmuka Keluar (outbound_if)			outbound_if	additional.fields.key dan additional.fields.value.string_value
Tindakan Log (logset)			logset	additional.fields.key dan additional.fields.value.string_value
ID Sesi (sessionid)			sessionid	network.session_id
Jumlah Pengulangan (repeatcnt)			repeatcnt	additional.fields.key dan additional.fields.value.string_value
Port Sumber (sport)			olahraga	principal.port
Port Tujuan (dport)			dport	target.port
Protokol IP (proto)			proto	network.ip_protocol (enum)
Tindakan (action)			tindakan	security_result.action_details security_result.action
Hierarki Grup Perangkat (dg_hier_level_1 hingga dg_hier_level_4)			dg_hier_level_1 hingga dg_hier_level_4	additional.fields.key dan additional.fields.value.string_value
Nama Perangkat (device_name)			device_name	intermediary.hostname
Nomor Urut (seqno)			seqno	metadata.product_log_id
ID Pengaitan SCTP (assoc_id)			assoc_id	additional.fields.key dan additional.fields.value.string_value
ID Protokol Payload (ppid)			ppid	additional.fields.key dan additional.fields.value.string_value
Tingkat keparahan (severity)			tingkat keseriusan,	security_result.severity dan security_result.severity_details
Jenis Chunk SCTP (sctp_chunk_type)			sctp_chunk_type	additional.fields.key dan additional.fields.value.string_value
Jenis Peristiwa SCTP (sctp_event_type)			sctp_event_type	additional.fields.key dan additional.fields.value.string_value
Tag Verifikasi SCTP 1 (verif_tag_1)			verif_tag_1	additional.fields.key dan additional.fields.value.string_value
Tag Verifikasi SCTP 2 (verif_tag_2)			verif_tag_2	additional.fields.key dan additional.fields.value.string_value
Kode Penyebab SCTP (sctp_cause_code)			sctp_cause_code	additional.fields.key dan additional.fields.value.string_value
ID Aplikasi Diameter (diam_app_id)			diam_app_id	additional.fields.key dan additional.fields.value.string_value
Kode Perintah Diameter (diam_cmd_code)			diam_cmd_code	additional.fields.key dan additional.fields.value.string_value
Kode AVP Diameter (diam_avp_code)			diam_avp_code	additional.fields.key dan additional.fields.value.string_value
ID Aliran Data SCTP (stream_id)			stream_id	additional.fields.key dan additional.fields.value.string_value
Alasan Akhir Pengaitan SCTP (assoc_end_reason)			assoc_end_reason	additional.fields.key dan additional.fields.value.string_value
Kode Operasi (op_code)			op_code	additional.fields.key dan additional.fields.value.string_value
SSN Pihak yang Menelepon SCCP (sccp_calling_ssn)			sccp_calling_ssn	additional.fields.key dan additional.fields.value.string_value
SCCP Calling Party Global Title (sccp_calling_gt)			sccp_calling_gt	additional.fields.key dan additional.fields.value.string_value
Filter SCTP (sctp_filter)			sctp_filter	additional.fields.key dan additional.fields.value.string_value
SCTP Chunks (chunks)			bongkahan	additional.fields.key dan additional.fields.value.string_value
SCTP Chunks Sent (chunks_sent)			chunks_sent	additional.fields.key dan additional.fields.value.string_value
SCTP Chunks Received (chunks_received)			chunks_received	additional.fields.key dan additional.fields.value.string_value
Paket (paket)			paket	additional.fields.key dan additional.fields.value.string_value
UUID untuk aturan (rule_uuid)			rule_uuid	security_result.rule_id
Sistem Virtual (vsys)			vsys	intermediary.asset.attribute.labels.key/value
Nama Sistem Virtual (vsys_name)			vsys_name	intermediary.asset.attribute.labels.key/value
Paket Terkirim (pkts_sent)			pkts_sent	network.sent_packets
Paket yang Diterima (pkts_received)			pkts_received	network.received_packets

Audit

Kolom CSV	Kolom CEF	Kolom LEEF	Kunci label Google Security Operations	Kolom UDM
Waktu Pembuatan				metadata.event_timestamp
Jenis				metadata.product_event_type
Jenis Konten (subjenis)				metadata.product_event_type
ID Peristiwa				additional.fields.key dan additional.fields.value.string_value
Objek				principal.user.userid
Deskripsi				metadata.description
Status				additional.fields.key dan additional.fields.value.string_value
Nomor Seri				intermediary.asset.hardware.serial_number

Referensi pemetaan kolom: Jenis log ke jenis peristiwa UDM

Tabel berikut mencantumkan jenis log firewall Palo Alto Networks dan jenis peristiwa UDM yang sesuai.

Jenis log	Jenis peristiwa UDM
Traffic	NETWORK_CONNECTION
Ancaman	NETWORK_CONNECTION
Pemfilteran URL	NETWORK_CONNECTION
WildFire	SCAN_UNCATEGORIZED Log pengiriman WildFire adalah subjenis dari jenis log Ancaman dan menggunakan format syslog yang sama.
Pemfilteran Data	NETWORK_UNCATEGORIZED
Globalprotect	USER_LOGIN/USER_LOGOUT/USER_RESOURCE_ACCESS Jika kolom log ID Peristiwa (eventid) berisi nilai "auth" atau "login" atau kolom log Tahap (stage) berisi nilai "login", USER_LOGIN akan ditetapkan. Jika kolom log ID Peristiwa (eventid) berisi nilai "logout" atau kolom log Tahap (stage) berisi nilai "logout", USER_LOGOUT akan ditetapkan. Jika kolom log ID Peristiwa (eventid) atau Tahap (stage) berisi nilai lain, USER_RESOURCE_ACCESS akan ditetapkan.
Terowongan	NETWORK_CONNECTION
GTP	NETWORK_CONNECTION
Konfigurasi	SETTING_MODIFICATION/SETTING_CREATION/SETTING_DELETION/SETTING_UNCATEGORIZED Nilai kolom "Command (cmd)" menentukan pemetaan jenis peristiwa UDM. Jika nilai kolom cmd adalah add atau clone, SETTING_CREATION akan ditetapkan. Jika nilai kolom cmd adalah delete, SETTING_DELETION akan ditetapkan. Jika nilai kolom cmd adalah edit, move, rename, set, atau commit, SETTING_MODIFICATION akan ditetapkan. Jika nilai kolom cmd tidak berisi nilai apa pun, SETTING_UNCATEGORIZED akan ditetapkan.
Sistem	Jika nilai subjenis adalah "dhcp", NETWORK_DHCP akan ditetapkan. Jika nilai subjenis adalah "auth", USER_LOGIN akan ditetapkan. Jika nilai deskripsi adalah "sedang login", USER_LOGIN akan ditetapkan. Jika nilai deskripsi adalah "logged out", USER_LOGOUT akan ditetapkan. Untuk nilai subjenis lainnya, GENERIC_EVENT ditetapkan.
HIP Match	NETWORK_CONNECTION
Tag IP	GENERIC_EVENT
User-ID	USER_LOGIN/USER_LOGOUT/USER_UNCATEGORIZED Jika nilai subjenis adalah "login", USER_LOGIN akan ditetapkan. Jika nilai subjenis adalah "logout", USER_LOGOUT akan ditetapkan. Jika subjenis tidak berisi nilai apa pun, USER_UNCATEGORIZED akan ditetapkan.
Dekripsi	NETWORK_CONNECTION
Authentication	STATUS_UNCATEGORIZED
SCTP	NETWORK_CONNECTION
Audit	GENERIC_EVENT
KORELASI	GENERIC_EVENT

Layanan Logging Strata Firewall Palo Alto Networks

Ringkasan

Palo Alto Networks Strata Logging Service menyediakan penyimpanan dan agregasi log terpusat berbasis cloud untuk firewall lokal dan virtual (cloud pribadi dan cloud publik), untuk Prisma Access, dan untuk layanan yang dikirimkan melalui cloud seperti Cortex XDR. Strata Logging Service aman, tangguh, dan fault-tolerant, serta membantu memastikan data logging Anda selalu terbaru dan tersedia saat Anda membutuhkannya. Strata Logging Service menyediakan infrastruktur logging yang skalabel, sehingga Anda tidak perlu merencanakan dan men-deploy Log Collector untuk memenuhi kebutuhan retensi log. Jika Anda sudah memiliki Log Collector lokal, Strata Logging Service dapat melengkapi penyiapan yang ada untuk memperluas kapasitas operasional seiring pertumbuhan bisnis Anda, atau untuk memenuhi kebutuhan kapasitas untuk lokasi baru. Dengan layanan ini, Palo Alto Networks mengelola pemeliharaan dan pemantauan infrastruktur logging yang sedang berlangsung.

Bagian ini menjelaskan cara mengonfigurasi Firewall Generasi Berikutnya (NGFW) Palo Alto Networks untuk membuat log, meneruskannya ke Strata Logging Service, dan mengirimkan log ke Google SecOps menggunakan webhook HTTPS.

Tabel berikut menjelaskan platform, mode pengelolaan, versi PAN-OS, dan setelan tujuan yang didukung untuk deployment ini:

Kategori	Konfigurasi yang didukung
Platform firewall	Semua platform NGFW Palo Alto Networks: Hardware fisik: PA-400, PA-800, PA-3200, PA-5200, dan PA-7000 Series VM-Series: firewall virtual di VMware, AWS, Azure, Google Cloud, KVM, dan Hyper-V CN-Series: firewall dalam container untuk lingkungan Kubernetes
Mode pengelolaan	Mandiri: firewall yang dikelola langsung menggunakan UI web atau CLI PAN-OS Dikelola Panorama: dikelola secara terpusat menggunakan perangkat Panorama atau Panorama di cloud
Versi PAN-OS	PAN-OS 10.0 dan yang lebih baru (disarankan 11.x)
Tujuan Google SecOps	Google SecOps menggunakan Penerusan Log HTTPS Strata Logging Service (format Array JSON)

Sebelum memulai

Sebelum mengonfigurasi penerusan log melalui Strata Logging Service, verifikasi prasyarat berikut:

• Verifikasi format log dan versi PAN-OS yang didukung oleh parser Strata Logging Service. Tabel berikut mencantumkan format log dan versi PAN-OS terkait yang didukung oleh parser Strata Logging Service:

  Format log	Versi PAN-OS
  Array JSON	10.0 dan yang lebih baru

• Verifikasi jenis log firewall Palo Alto Networks yang didukung oleh parser Google SecOps. Parser Google SecOps mendukung jenis log firewall Palo Alto Networks berikut:

  • Traffic
  • Ancaman
  • Inspeksi terowongan
  • Sistem
  • Kecocokan HIP
  • IP-Tag
  • User-ID
  • Dekripsi
  • Autentikasi
  • Pemfilteran URL
  • GlobalProtect
  • SCTP
  • Audit
  • Konfigurasi
  • DNS

• Versi PAN-OS: Instal PAN-OS 10.0 atau yang lebih baru di semua platform firewall (PA-Series, VM-Series, dan CN-Series). Untuk petunjuk penyiapan firewall umum, lihat Panduan Administrator PAN-OS dan Prasyarat deployment Strata Logging Service.

• Lisensi Strata Logging Service: Pastikan lisensi PAN-LGS-DL aktif di akun Customer Support Portal (CSP) yang sama dengan firewall.

• Cloud Logging diaktifkan di semua platform: Di setiap firewall, buka Device > Setup > Management > Cloud Logging, pilih Enable Cloud Logging, lalu pilih Region Anda. Setelan ini diperlukan untuk VM-Series (PAVM), CN-Series, dan firewall fisik.

  Catatan: Setelah Anda men-deploy firewall VM-Series (PAVM), buka Device > Setup > Management > Cloud Logging dan aktifkan Cloud Logging sebelum melanjutkan. Firewall tidak akan mengirim log ke Strata Logging Service hingga Anda mengaktifkan setelan ini secara eksplisit.

• Akses jaringan dan firewall: Pastikan antarmuka pengelolaan firewall dapat menjangkau nama domain yang sepenuhnya memenuhi syarat (FQDN) berikut di port TCP 443 tanpa dekripsi SSL:

  • api.paloaltonetworks.com
  • apitrusted.paloaltonetworks.com
  • certificate.paloaltonetworks.com
  • certificatetrusted.paloaltonetworks.com
  • lic.lc.prod.us.cs.paloaltonetworks.com

• Kredensial administrator: Pastikan Anda memiliki peran Superuser atau device-admin di firewall dan akses ke konsol Strata Hub.

• URL webhook Google SecOps: Dapatkan URL endpoint HTTPS khusus region dari instance Google SecOps Anda (lihat Langkah 2: Konfigurasi profil penerusan HTTPS).

• Sertifikat SSL/TLS: Dapatkan sertifikat CA yang valid untuk webhook HTTPS. Certificate authority (CA) yang dipercaya secara publik, seperti GlobalSign dan DigiCert, telah dipercaya sebelumnya oleh Strata Logging Service. Jika Anda menggunakan sertifikat CA pribadi atau yang ditandatangani sendiri, Anda harus menguploadnya secara manual.

• Plugin Panorama (jika dikelola Panorama): Instal Cloud Services Plugin 2.x atau yang lebih baru di Panorama.

Ringkasan arsitektur

Penyerapan log melalui Strata Logging Service mengikuti pipeline tiga tahap dari firewall PAN-OS Anda ke Google SecOps:

1. PAN-OS NGFW (PA-Series, VM-Series, atau CN-Series) meneruskan log melalui Cloud Logging (TLS di port TCP 443).
2. Strata Logging Service (https://stratacloudmanager.paloaltonetworks.com/) menormalisasi, mengindeks, dan menyimpan log di penyimpanan cloud regional.
3. Google SecOps (endpoint khusus region chronicle.googleapis.com) menerima payload Array JSON yang dikompresi GZIP dari Strata Logging Service melalui webhook HTTPS.

Tabel berikut menjelaskan setiap tahap arsitektur penerusan log:

Tahap	Komponen	Transport	Deskripsi
Fase 1	PAN-OS NGFW (PA-Series, VM-Series, CN-Series; mandiri atau dikelola Panorama)	Cloud Logging (TLS di port TCP 443)	Firewall menghasilkan berbagai jenis log. Log Forwarding Profile ditetapkan ke aturan Kebijakan Keamanan untuk mengaktifkan penerusan log. Cloud Logging harus diaktifkan secara eksplisit di setiap firewall.
Fase 2	Strata Logging Service ((https://stratacloudmanager.paloaltonetworks.com/), penyimpanan cloud regional)	Penyimpanan cloud (diindeks dan dinormalisasi)	Infrastruktur logging berbasis cloud Palo Alto Networks menerima log dari semua firewall yang diaktivasi, serta menormalisasi dan mengindeksnya. Layanan ini menyediakan aplikasi Log Forwarding untuk mengirim log keluar ke platform eksternal, dan mendukung hingga 200 tujuan per instance.
Fase 3	Google SecOps (chronicle.googleapis.com, URL khusus wilayah)	Webhook HTTPS, Array JSON (dikompresi GZIP)	Strata Log Forwarding mengirim log ke Google SecOps menggunakan HTTPS POST. Sertifikat SSL/TLS dan kredensial Basic Authorization membantu mengamankan koneksi. URL Google SecOps harus cocok dengan region Strata Logging Service Anda.

Tahap 1: Membuat log di firewall PAN-OS

Untuk mengonfigurasi firewall PAN-OS agar membuat dan meneruskan log keamanan dan sistem, selesaikan langkah-langkah berikut:

1. Buka Device > Log Settings. Pastikan log System, Configuration, dan HIP Match aktif dengan tingkat keparahan yang sesuai (minimum Informational untuk log System). PAN-OS membuat log tingkat sistem ini secara otomatis tanpa memerlukan profil tambahan.
2. Buka Objects > Log Forwarding > Add untuk membuat profil penerusan log. Tentukan jenis log yang akan diteruskan: Traffic, Threat, WildFire, URL Filtering, dan Auth. Tetapkan profil server (Syslog atau HTTP) dan konfigurasikan filter jika diperlukan.
3. Buka Policies > Security, edit setiap aturan, lalu pilih tab Actions. Pilih profil Log Forwarding, lalu pilih Log at Session End (dan secara opsional Log at Session Start). Klik OK, lalu klik Commit.

Untuk mengetahui informasi selengkapnya, lihat referensi Palo Alto Networks berikut:

• Mengonfigurasi penerusan log di PAN-OS
• Mengonfigurasi profil penerusan log
• Mengonfigurasi pemantauan syslog

Fase 2: Melakukan orientasi dan meneruskan log ke Strata

Untuk mengaktifkan Strata Logging Service, melakukan aktivasi firewall, dan memverifikasi pengiriman log, selesaikan langkah-langkah berikut:

1. Login ke konsol Strata Hub dan aktifkan lisensi PAN-LGS-DL Anda. Pilih CSP Account, Tenant/TSG, dan Region tempat log akan disimpan.

2. Di setiap firewall (termasuk PA-Series, VM-Series, dan CN-Series), buka Device > Setup > Management > Cloud Logging:

   1. Pilih Enable Cloud Logging.
   2. Pilih Region yang cocok dengan instance Strata Logging Service Anda.
   3. Opsional: Untuk mengirim salinan log ke Strata Logging Service dan Panorama lokal, pilih Enable Duplicate Logging.
   4. Klik OK, lalu klik Commit.
   Catatan: Di PAN-OS versi sebelum 10.1, setelan ini mungkin muncul sebagai Cortex Data Lake atau Logging Service. Untuk firewall CN-Series, buka panel Cloud Logging di Panorama, pilih Enable Cloud Logging, lalu klik Commit & Push.

3. Verifikasi konektivitas antara firewall dan Strata Logging Service:

   1. Buka Perangkat > Penyiapan > Pengelolaan > Cloud Logging, lalu klik Tampilkan Status. Pastikan statusnya menampilkan Connected.
   2. Buka Strata Log Viewer di konsol Strata Hub untuk mengonfirmasi bahwa log sedang masuk.

   3. Untuk memverifikasi konektivitas dari CLI PAN-OS, jalankan perintah berikut:

      show logging-status
      

4. Opsional: Untuk mengambil kueri DNS, string agen pengguna HTTP, dan metadata sesi (diperlukan untuk Cortex XSIAM dan IoT Security), di setelan Cloud Logging, pilih Enable Enhanced Application Logging.

Peringatan: Jangan aktifkan dekripsi SSL/TLS untuk traffic yang ditujukan ke FQDN Strata Logging Service. Strata Logging Service menggunakan autentikasi TLS bersama; mengaktifkan dekripsi akan memutuskan koneksi dan menghentikan pengiriman log.

Untuk mengetahui informasi selengkapnya, lihat referensi Palo Alto Networks berikut:

• Mengorientasikan firewall ke Strata Logging Service
• Mulai mengirim log ke Strata Logging Service
• Prasyarat dan perencanaan deployment Strata Logging Service
• Panduan untuk melakukan aktivasi dan menyerap log dari firewall ke Strata

Tahap 3: Mengonfigurasi webhook HTTPS untuk meneruskan log

Untuk meneruskan log dari Strata Logging Service ke Google SecOps menggunakan webhook HTTPS, selesaikan langkah-langkah berikut.

Catatan: Sertifikat CA yang valid harus ada sebelum Anda dapat menyimpan atau menguji webhook HTTPS. Strata Logging Service menggunakan sertifikat ini untuk mengautentikasi penerima HTTPS Anda (autentikasi server). CA tepercaya publik, seperti GlobalSign dan DigiCert, dipercaya secara default dan tidak memerlukan upload. Jika Anda menggunakan CA PKI pribadi atau yang ditandatangani sendiri, upload file sertifikat CA menggunakan Upload CA Certificate.

Langkah 1: Konfigurasi pipeline Google SecOps dengan prosesor Unroll

Untuk membagi log Array JSON Palo Alto Networks Strata Logging Service menjadi peristiwa log individual menggunakan pemroses Unroll, selesaikan langkah-langkah berikut:

1. Buat feed webhook untuk jenis log Palo Alto Networks Firewall (PAN_FIREWALL). Buat URL webhook menggunakan format berikut:

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

2. Buat pipeline pemrosesan data Google SecOps dan tambahkan aliran data menggunakan feed webhook yang Anda buat.

3. Tambahkan pemroses Parse JSON untuk mengurai payload JSON mentah (ini adalah persyaratan untuk pemroses Unroll).

4. Tambahkan pemroses Unroll untuk memisahkan log Array JSON menjadi peristiwa log individual, lalu simpan dan aktifkan pipeline.

Langkah 2: Konfigurasi profil penerusan HTTPS

1. Untuk membuat profil penerusan HTTPS, login ke konsol Strata Hub, buka instance Strata Logging Service, lalu buka Log Forwarding > Add.

2. Konfigurasi nama profil dan URL Google SecOps:

   • Profile Name: Masukkan nama deskriptif (misalnya, PAVM-Chronicle-HTTPS). Profile Type telah ditetapkan ke Log Forwarding.

   • URL: Masukkan URL webhook HTTPS Google SecOps khusus wilayah (dimulai dengan https:// di port default 443 dalam format ENDPOINT_URL?key=API_KEY&secret=SECRET) yang cocok dengan region Strata Logging Service Anda, seperti yang ditunjukkan dalam tabel berikut.

     Untuk mengetahui informasi selengkapnya, lihat Menyiapkan webhook SIEM.

   Region Strata Logging Service	URL penyerapan Google SecOps
   AS	https://chronicle.googleapis.com
   Eropa	https://europe-chronicle.googleapis.com
   Asia	https://asia-southeast1-chronicle.googleapis.com

Langkah 3: Konfigurasi autentikasi server

Di bagian Server Authentication, konfigurasikan sertifikat SSL/TLS untuk endpoint HTTPS Anda:

1. Jika Anda menggunakan CA yang ditandatangani sendiri atau pribadi, tarik file sertifikat CA atau klik Upload CA Certificate. Jika Anda menggunakan CA yang dipercaya secara publik (misalnya, GlobalSign), root publik default sudah dipercaya dan tidak perlu diupload. Klik Delete hanya jika Anda perlu mengganti sertifikat yang ada.
2. Pastikan Detail Sertifikat cocok dengan CA endpoint Anda. Pastikan penerima HTTPS Anda menampilkan sertifikat TLS yang ditandatangani oleh CA ini; jika rantai sertifikat tidak cocok, langkah Uji Koneksi akan gagal.

Anda dapat mendownload root certificate dari bagian Root CA di halaman repositori Layanan Kepercayaan Google.

Tabel berikut menunjukkan contoh detail sertifikat yang ditampilkan di bagian Server Authentication:

Kolom sertifikat	Nilai contoh
Nama umum	GlobalSign Root CA
Berakhir pada	1/28/2028
Diterbitkan oleh	GlobalSign Root CA
Tujuan	Autentikasi server (memverifikasi sertifikat TLS penerima HTTPS Anda)

Langkah 4: Konfigurasi autentikasi klien dan otorisasi klien

Autentikasi klien memungkinkan Google SecOps memverifikasi bahwa permintaan masuk berasal dari Strata Logging Service. Otorisasi klien memberikan kredensial yang digunakan Strata Logging Service saat memanggil endpoint Google SecOps Anda.

Di bagian Client Authorization, konfigurasikan kolom berikut:

• Type: Pilih Basic Authorization.
• Username: Masukkan nilai placeholder, seperti test. Endpoint HTTPS Google SecOps tidak memerlukan nama pengguna.
• Password: Masukkan nilai placeholder, seperti test. Endpoint HTTPS Google SecOps tidak memerlukan sandi.

Tabel berikut menjelaskan konfigurasi otorisasi klien untuk Google SecOps:

Jenis otorisasi	Kapan digunakan	Konfigurasi untuk Google SecOps
Otorisasi Dasar	Penerima HTTPS memerlukan kredensial nama pengguna dan sandi	Masukkan nilai placeholder, seperti test, untuk nama pengguna dan sandi karena endpoint HTTPS Google SecOps tidak memerlukan kredensial ini

Langkah 5: Uji koneksi dan simpan

1. Klik Test Connection di bagian bawah bagian Client Authorization. Strata Logging Service mengirimkan payload pengujian ke endpoint HTTPS Google SecOps Anda:
   • Berhasil: Status ini menunjukkan bahwa koneksi berhasil. Klik Berikutnya.
   • Kegagalan: Verifikasi kecocokan sertifikat CA, konfirmasi bahwa URL Google SecOps cocok dengan region Anda, periksa kredensial Anda, dan pastikan endpoint menerima payload Array JSON yang dikompresi GZIP.
2. Setelah Test Connection berhasil, klik Next.
3. Dalam daftar Payload Format, pilih Array JSON.

4. Pilih jenis log yang akan diteruskan ke Google SecOps:

   • Log traffic (action = deny direkomendasikan untuk pemberitahuan bernilai tinggi)
   • Log ancaman (severity >= High)
   • Log WildFire
   • Log Sistem dan Auth (severity = Critical)

5. Klik Simpan. Buat peristiwa pengujian di firewall (misalnya, akses URL yang diblokir) dan pastikan peristiwa tersebut muncul di konsol Google SecOps dalam waktu 1 hingga 5 menit.

Untuk mengetahui informasi selengkapnya, lihat referensi Palo Alto Networks berikut:

• Meneruskan log ke server HTTPS
• Meneruskan log dari Strata Logging Service
• Meneruskan log ke server Syslog
• Validasi sertifikat server
• Catatan rilis Log Forwarding API
• Referensi log layanan Strata Logging Service
• Ringkasan administrasi Strata Logging Service

Format log yang didukung

Parser firewall Palo Alto Networks Strata Logging Service mendukung log dalam format JSON dan Array JSON.

Contoh log yang didukung

Contoh log berikut menunjukkan format Strata Logging Service yang didukung:

• Array JSON

  [{  "TimeReceived": "2026-06-23T10:20:00.000000Z",  "DeviceSN": "023201024129",  "LogType": "TRAFFIC",  "Subtype": "end",  "ConfigVersion": "11.2",  "TimeGenerated": "2026-06-23T10:19:50.000000Z",  "SourceAddress": "198.51.100.0",  "DestinationAddress": "198.51.100.1",  "NATSource": "198.51.100.2",  "NATDestination": "198.51.100.1",  "Rule": "PAMGMT_INTERNET_RULE",  "SourceUser": null,  "DestinationUser": null,  "Application": "dns-base",  "VirtualLocation": "vsys1",  "FromZone": "Vlan-Zone",  "ToZone": "outside",  "InboundInterface": "ethernet1/6.20",  "OutboundInterface": "ethernet1/5",  "LogSetting": "IoT Security Default Profile",  "SessionID": 141475,  "RepeatCount": 1,  "SourcePort": 47343,  "DestinationPort": 53,  "NATSourcePort": 35449,  "NATDestinationPort": 53,  "Protocol": "udp",  "Action": "allow",  "Bytes": 354,  "BytesSent": 149,  "BytesReceived": 205,  "PacketsTotal": 2,  "SessionStartTime": "2026-06-23T10:19:22.000000Z",  "SessionDuration": 1,  "URLCategory": "any",  "SequenceNo": 7650419021796487925,  "SourceLocation": "198.51.100.3-198.51.100.4",  "DestinationLocation": "US",  "PacketsSent": 1,  "PacketsReceived": 1,  "SessionEndReason": "aged-out",  "DGHierarchyLevel1": 0,  "DGHierarchyLevel2": 0,  "DGHierarchyLevel3": 0,  "DGHierarchyLevel4": 0,  "VirtualSystemName": "",  "DeviceName": "PA-450",  "ActionSource": "from-policy",  "SourceUUID": null,  "DestinationUUID": null,  "IMSI": 0,  "IMEI": null,  "ParentSessionID": 0,  "ParentStarttime": "1970-01-01T00:00:00.000000Z",  "Tunnel": "N/A",  "EndpointAssociationID": 0,  "ChunksTotal": 0,  "ChunksSent": 0,  "ChunksReceived": 0,  "RuleUUID": "29222f63-8656-476f-b70e-6ec3332ff5fe",  "HTTP2Connection": 0,  "LinkChangeCount": 0,  "SDWANPolicyName": null,  "LinkSwitches": null,  "SDWANCluster": null,  "SDWANDeviceType": null,  "SDWANClusterType": null,  "SDWANSite": null,  "DynamicUserGroupName": null,  "X-Forwarded-ForIP": "",  "SourceDeviceCategory": null,  "SourceDeviceProfile": null,  "SourceDeviceModel": null,  "SourceDeviceVendor": null,  "SourceDeviceOSFamily": null,  "SourceDeviceOSVersion": null,  "SourceDeviceHost": null,  "SourceDeviceMac": null,  "DestinationDeviceCategory": null,  "DestinationDeviceProfile": null,  "DestinationDeviceModel": null,  "DestinationDeviceVendor": null,  "DestinationDeviceOSFamily": null,  "DestinationDeviceOSVersion": null,  "DestinationDeviceHost": null,  "DestinationDeviceMac": null,  "ContainerID": null,  "ContainerNameSpace": null,  "ContainerName": null,  "SourceEDL": null,  "DestinationEDL": null,  "GPHostID": null,  "EndpointSerialNumber": null,  "SourceDynamicAddressGroup": null,  "DestinationDynamicAddressGroup": null,  "HASessionOwner": null,  "TimeGeneratedHighResolution": "2026-06-23T10:19:51.048000Z",  "NSSAINetworkSliceType": null,  "NSSAINetworkSliceDifferentiator": null},{  "TimeReceived": "2026-06-23T10:20:00.000000Z",  "DeviceSN": "023201024129",  "LogType": "TRAFFIC",  "Subtype": "end",  "ConfigVersion": "11.2",  "TimeGenerated": "2026-06-23T10:19:51.000000Z",  "SourceAddress": "198.51.100.0",  "DestinationAddress": "198.51.100.1",  "NATSource": "198.51.100.5",  "NATDestination": "198.51.100.1",  "Rule": "PAMGMT_INTERNET_RULE",  "SourceUser": null,  "DestinationUser": null,  "Application": "dns-base",  "VirtualLocation": "vsys1",  "FromZone": "Vlan-Zone",  "ToZone": "outside",  "InboundInterface": "ethernet1/6.20",  "OutboundInterface": "ethernet1/8",  "LogSetting": "IoT Security Default Profile",  "SessionID": 195791,  "RepeatCount": 1,  "SourcePort": 53359,  "DestinationPort": 53,  "NATSourcePort": 51905,  "NATDestinationPort": 53,  "Protocol": "udp",  "Action": "allow",  "Bytes": 278,  "BytesSent": 133,  "BytesReceived": 145,  "PacketsTotal": 2,  "SessionStartTime": "2026-06-23T10:19:22.000000Z",  "SessionDuration": 1,  "URLCategory": "any",  "SequenceNo": 7650419021796487926,  "SourceLocation": "198.51.100.3-198.51.100.4",  "DestinationLocation": "US",  "PacketsSent": 1,  "PacketsReceived": 1,  "SessionEndReason": "aged-out",  "DGHierarchyLevel1": 0,  "DGHierarchyLevel2": 0,  "DGHierarchyLevel3": 0,  "DGHierarchyLevel4": 0,  "VirtualSystemName": "",  "DeviceName": "PA-450",  "ActionSource": "from-policy",  "SourceUUID": null,  "DestinationUUID": null,  "IMSI": 0,  "IMEI": null,  "ParentSessionID": 0,  "ParentStarttime": "1970-01-01T00:00:00.000000Z",  "Tunnel": "N/A",  "EndpointAssociationID": 0,  "ChunksTotal": 0,  "ChunksSent": 0,  "ChunksReceived": 0,  "RuleUUID": "29222f63-8656-476f-b70e-6ec3332ff5fe",  "HTTP2Connection": 0,  "LinkChangeCount": 0,  "SDWANPolicyName": null,  "LinkSwitches": null,  "SDWANCluster": null,  "SDWANDeviceType": null,  "SDWANClusterType": null,  "SDWANSite": null,  "DynamicUserGroupName": null,  "X-Forwarded-ForIP": "",  "SourceDeviceCategory": null,  "SourceDeviceProfile": null,  "SourceDeviceModel": null,  "SourceDeviceVendor": null,  "SourceDeviceOSFamily": null,  "SourceDeviceOSVersion": null,  "SourceDeviceHost": null,  "SourceDeviceMac": null,  "DestinationDeviceCategory": null,  "DestinationDeviceProfile": null,  "DestinationDeviceModel": null,  "DestinationDeviceVendor": null,  "DestinationDeviceOSFamily": null,  "DestinationDeviceOSVersion": null,  "DestinationDeviceHost": null,  "DestinationDeviceMac": null,  "ContainerID": null,  "ContainerNameSpace": null,  "ContainerName": null,  "SourceEDL": null,  "DestinationEDL": null,  "GPHostID": null,  "EndpointSerialNumber": null,  "SourceDynamicAddressGroup": null,  "DestinationDynamicAddressGroup": null,  "HASessionOwner": null,  "TimeGeneratedHighResolution": "2026-06-23T10:19:51.048000Z",  "NSSAINetworkSliceType": null,  "NSSAINetworkSliceDifferentiator": null},{  "TimeReceived": "2026-06-23T10:20:00.000000Z",  "DeviceSN": "023201024129",  "LogType": "TRAFFIC",  "Subtype": "end",  "ConfigVersion": "11.2",  "TimeGenerated": "2026-06-23T10:19:51.000000Z",  "SourceAddress": "198.51.100.6",  "DestinationAddress": "198.51.100.1",  "NATSource": "198.51.100.2",  "NATDestination": "198.51.100.1",  "Rule": "PAMGMT_INTERNET_RULE",  "SourceUser": null,  "DestinationUser": null,  "Application": "dns-base",  "VirtualLocation": "vsys1",  "FromZone": "Vlan-Zone",  "ToZone": "outside",  "InboundInterface": "ethernet1/6.20",  "OutboundInterface": "ethernet1/5",  "LogSetting": "IoT Security Default Profile",  "SessionID": 262531,  "RepeatCount": 1,  "SourcePort": 56168,  "DestinationPort": 53,  "NATSourcePort": 32784,  "NATDestinationPort": 53,  "Protocol": "udp",  "Action": "allow",  "Bytes": 351,  "BytesSent": 149,  "BytesReceived": 202,  "PacketsTotal": 2,  "SessionStartTime": "2026-06-23T10:19:23.000000Z",  "SessionDuration": 0,  "URLCategory": "any",  "SequenceNo": 7650419021796487928,  "SourceLocation": "198.51.100.3-198.51.100.4",  "DestinationLocation": "US",  "PacketsSent": 1,  "PacketsReceived": 1,  "SessionEndReason": "aged-out",  "DGHierarchyLevel1": 0,  "DGHierarchyLevel2": 0,  "DGHierarchyLevel3": 0,  "DGHierarchyLevel4": 0,  "VirtualSystemName": "",  "DeviceName": "PA-450",  "ActionSource": "from-policy",  "SourceUUID": null,  "DestinationUUID": null,  "IMSI": 0,  "IMEI": null,  "ParentSessionID": 0,  "ParentStarttime": "1970-01-01T00:00:00.000000Z",  "Tunnel": "N/A",  "EndpointAssociationID": 0,  "ChunksTotal": 0,  "ChunksSent": 0,  "ChunksReceived": 0,  "RuleUUID": "29222f63-8656-476f-b70e-6ec3332ff5fe",  "HTTP2Connection": 0,  "LinkChangeCount": 0,  "SDWANPolicyName": null,  "LinkSwitches": null,  "SDWANCluster": null,  "SDWANDeviceType": null,  "SDWANClusterType": null,  "SDWANSite": null,  "DynamicUserGroupName": null,  "X-Forwarded-ForIP": "",  "SourceDeviceCategory": null,  "SourceDeviceProfile": null,  "SourceDeviceModel": null,  "SourceDeviceVendor": null,  "SourceDeviceOSFamily": null,  "SourceDeviceOSVersion": null,  "SourceDeviceHost": null,  "SourceDeviceMac": null,  "DestinationDeviceCategory": null,  "DestinationDeviceProfile": null,  "DestinationDeviceModel": null,  "DestinationDeviceVendor": null,  "DestinationDeviceOSFamily": null,  "DestinationDeviceOSVersion": null,  "DestinationDeviceHost": null,  "DestinationDeviceMac": null,  "ContainerID": null,  "ContainerNameSpace": null,  "ContainerName": null,  "SourceEDL": null,  "DestinationEDL": null,  "GPHostID": null,  "EndpointSerialNumber": null,  "SourceDynamicAddressGroup": null,  "DestinationDynamicAddressGroup": null,  "HASessionOwner": null,  "TimeGeneratedHighResolution": "2026-06-23T10:19:51.048000Z",  "NSSAINetworkSliceType": null,  "NSSAINetworkSliceDifferentiator": null},{  "TimeReceived": "2026-06-23T10:20:00.000000Z",  "DeviceSN": "023201024129",  "LogType": "TRAFFIC",  "Subtype": "end",  "ConfigVersion": "11.2",  "TimeGenerated": "2026-06-23T10:19:53.000000Z",  "SourceAddress": "198.51.100.0",  "DestinationAddress": "198.51.100.1",  "NATSource": "198.51.100.2",  "NATDestination": "198.51.100.1",  "Rule": "PAMGMT_INTERNET_RULE",  "SourceUser": null,  "DestinationUser": null,  "Application": "dns-base",  "VirtualLocation": "vsys1",  "FromZone": "Vlan-Zone",  "ToZone": "outside",  "InboundInterface": "ethernet1/6.20",  "OutboundInterface": "ethernet1/5",  "LogSetting": "IoT Security Default Profile",  "SessionID": 76996,  "RepeatCount": 1,  "SourcePort": 49024,  "DestinationPort": 53,  "NATSourcePort": 9559,  "NATDestinationPort": 53,  "Protocol": "udp",  "Action": "allow",  "Bytes": 342,  "BytesSent": 145,  "BytesReceived": 197,  "PacketsTotal": 2,  "SessionStartTime": "2026-06-23T10:19:24.000000Z",  "SessionDuration": 1,  "URLCategory": "any",  "SequenceNo": 7650419021796489539,  "SourceLocation": "198.51.100.3-198.51.100.4",  "DestinationLocation": "US",  "PacketsSent": 1,  "PacketsReceived": 1,  "SessionEndReason": "aged-out",  "DGHierarchyLevel1": 0,  "DGHierarchyLevel2": 0,  "DGHierarchyLevel3": 0,  "DGHierarchyLevel4": 0,  "VirtualSystemName": "",  "DeviceName": "PA-450",  "ActionSource": "from-policy",  "SourceUUID": null,  "DestinationUUID": null,  "IMSI": 0,  "IMEI": null,  "ParentSessionID": 0,  "ParentStarttime": "1970-01-01T00:00:00.000000Z",  "Tunnel": "N/A",  "EndpointAssociationID": 0,  "ChunksTotal": 0,  "ChunksSent": 0,  "ChunksReceived": 0,  "RuleUUID": "29222f63-8656-476f-b70e-6ec3332ff5fe",  "HTTP2Connection": 0,  "LinkChangeCount": 0,  "SDWANPolicyName": null,  "LinkSwitches": null,  "SDWANCluster": null,  "SDWANDeviceType": null,  "SDWANClusterType": null,  "SDWANSite": null,  "DynamicUserGroupName": null,  "X-Forwarded-ForIP": "",  "SourceDeviceCategory": null,  "SourceDeviceProfile": null,  "SourceDeviceModel": null,  "SourceDeviceVendor": null,  "SourceDeviceOSFamily": null,  "SourceDeviceOSVersion": null,  "SourceDeviceHost": null,  "SourceDeviceMac": null,  "DestinationDeviceCategory": null,  "DestinationDeviceProfile": null,  "DestinationDeviceModel": null,  "DestinationDeviceVendor": null,  "DestinationDeviceOSFamily": null,  "DestinationDeviceOSVersion": null,  "DestinationDeviceHost": null,  "DestinationDeviceMac": null,  "ContainerID": null,  "ContainerNameSpace": null,  "ContainerName": null,  "SourceEDL": null,  "DestinationEDL": null,  "GPHostID": null,  "EndpointSerialNumber": null,  "SourceDynamicAddressGroup": null,  "DestinationDynamicAddressGroup": null,  "HASessionOwner": null,  "TimeGeneratedHighResolution": "2026-06-23T10:19:53.080000Z",  "NSSAINetworkSliceType": null,  "NSSAINetworkSliceDifferentiator": null},{  "TimeReceived": "2026-06-23T10:20:00.000000Z",  "DeviceSN": "023201024129",  "LogType": "TRAFFIC",  "Subtype": "end",  "ConfigVersion": "11.2",  "TimeGenerated": "2026-06-23T10:19:53.000000Z",  "SourceAddress": "198.51.100.0",  "DestinationAddress": "198.51.100.1",  "NATSource": "198.51.100.5",  "NATDestination": "198.51.100.1",  "Rule": "PAMGMT_INTERNET_RULE",  "SourceUser": null,  "DestinationUser": null,  "Application": "dns-base",  "VirtualLocation": "vsys1",  "FromZone": "Vlan-Zone",  "ToZone": "outside",  "InboundInterface": "ethernet1/6.20",  "OutboundInterface": "ethernet1/8",  "LogSetting": "IoT Security Default Profile",  "SessionID": 117181,  "RepeatCount": 1,  "SourcePort": 43566,  "DestinationPort": 53,  "NATSourcePort": 37003,  "NATDestinationPort": 53,  "Protocol": "udp",  "Action": "allow",  "Bytes": 348,  "BytesSent": 148,  "BytesReceived": 200,  "PacketsTotal": 2,  "SessionStartTime": "2026-06-23T10:19:24.000000Z",  "SessionDuration": 1,  "URLCategory": "any",  "SequenceNo": 7650419021796489538,  "SourceLocation": "198.51.100.3-198.51.100.4",  "DestinationLocation": "US",  "PacketsSent": 1,  "PacketsReceived": 1,  "SessionEndReason": "aged-out",  "DGHierarchyLevel1": 0,  "DGHierarchyLevel2": 0,  "DGHierarchyLevel3": 0,  "DGHierarchyLevel4": 0,  "VirtualSystemName": "",  "DeviceName": "PA-450",  "ActionSource": "from-policy",  "SourceUUID": null,  "DestinationUUID": null,  "IMSI": 0,  "IMEI": null,  "ParentSessionID": 0,  "ParentStarttime": "1970-01-01T00:00:00.000000Z",  "Tunnel": "N/A",  "EndpointAssociationID": 0,  "ChunksTotal": 0,  "ChunksSent": 0,  "ChunksReceived": 0,  "RuleUUID": "29222f63-8656-476f-b70e-6ec3332ff5fe",  "HTTP2Connection": 0,  "LinkChangeCount": 0,  "SDWANPolicyName": null,  "LinkSwitches": null,  "SDWANCluster": null,  "SDWANDeviceType": null,  "SDWANClusterType": null,  "SDWANSite": null,  "DynamicUserGroupName": null,  "X-Forwarded-ForIP": "",  "SourceDeviceCategory": null,  "SourceDeviceProfile": null,  "SourceDeviceModel": null,  "SourceDeviceVendor": null,  "SourceDeviceOSFamily": null,  "SourceDeviceOSVersion": null,  "SourceDeviceHost": null,  "SourceDeviceMac": null,  "DestinationDeviceCategory": null,  "DestinationDeviceProfile": null,  "DestinationDeviceModel": null,  "DestinationDeviceVendor": null,  "DestinationDeviceOSFamily": null,  "DestinationDeviceOSVersion": null,  "DestinationDeviceHost": null,  "DestinationDeviceMac": null,  "ContainerID": null,  "ContainerNameSpace": null,  "ContainerName": null,  "SourceEDL": null,  "DestinationEDL": null,  "GPHostID": null,  "EndpointSerialNumber": null,  "SourceDynamicAddressGroup": null,  "DestinationDynamicAddressGroup": null,  "HASessionOwner": null,  "TimeGeneratedHighResolution": "2026-06-23T10:19:53.080000Z",  "NSSAINetworkSliceType": null,  "NSSAINetworkSliceDifferentiator": null}]
  

Referensi pemetaan kolom: Kolom log ke kolom UDM

Bagian ini menjelaskan cara parser memetakan kolom log firewall Palo Alto Networks Strata Logging Service ke kolom peristiwa UDM Google SecOps untuk setiap jenis log.

Lihat bagian berikut untuk mengetahui referensi pemetaan setiap jenis log:

• Sistem
• Ancaman
• Traffic
• ID Pengguna
• Pencocokan HIP
• Tag IP
• Dekripsi
• Tunnel
• Authentication
• URL
• GlobalProtect
• SCTP
• Audit
• Konfigurasi
• DNS

Sistem

Tabel berikut mencantumkan kolom log dari jenis log Sistem dan kolom UDM yang sesuai.

Log field	UDM mapping
AgentContentVersion	additional.fields.key/value.string_value
AgentDataCollectionStatus	target.resource.attribute.labels
AgentID	target.resource.attribute.labels
AgentIsolationStatus	target.resource.attribute.labels
AgentStatus	target.resource.attribute.labels
AgentVersion	target.asset.software.version
ConfigVersion	additional.fields.key/value.string_value
TenantID	metadata.product_deployment_id
DeviceGroup	target.group.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
EndpointCPUArchitecture	target.asset.hardware.cpu_platform
EndpointDeviceDomain	target.asset.administrative_domain
EndpointDeviceName	target.asset.hostname
EndpointIPaddress	target.asset.ip
VDIEndpoint	target.asset.attribute.labels
EndpointOSType	additional.fields.key/value.string_value
EndpointOSVersion	target.platform_version
AgentTimeZoneOffset	additional.fields.key/value.string_value
EndpointUserDomain	additional.fields.key/value.string_value
EndpointUserName	target.user.user_display_name
EndpointUserUUID	target.user.userid
EventComponent	additional.fields.key/value.string_value
EventDescription	metadata.description
EventName	additional.fields.key/value.string_value
EventTime	metadata.event_timestamp
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogCategory	security_result.category_details
LogSource	target.resource.attribute.labels
LogSourceGroupID	target.resource.attribute.labels
LogSourceID	target.resource.attribute.labels
LogSourceName	target.resource.attribute.labels
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
LogTime	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
Severity	security_result.severity
Subtype	metadata.product_event_type
Template	target.resource.attribute.labels
TimeGeneratedHighResolution	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details
VirtualLocation	target.asset.attribute.labels
VirtualSystemID	target.resource.product_object_id
VirtualSystemName	target.asset.attribute.labels

Ancaman

Tabel berikut mencantumkan kolom log dari jenis log Threat dan kolom UDM yang sesuai.

Log field	UDM mapping
Action	security_result.action
Application	target.application
ApplicationCategory	additional.fields.key/value.string_value
ApplicationSubcategory	additional.fields.key/value.string_value
ApplianceOrCloud	additional.fields.key/value.string_value
CloudHostname	additional.fields.key/value.string_value
CloudReportID	security_result.detection_fields.key/value
ConfigVersion	additional.fields.key/value.string_value
ContainerID	intermediary.resource.product_object_id
ApplicationContainer	additional.fields.key/value.string_value
ContentVersion	additional.fields.key/value.string_value
RepeatCount	additional.fields.key/value.string_value
CortexDataLakeTenantID	metadata.product_deployment_id
DestinationDeviceCategory	target.asset.category
DestinationDeviceClass	additional.fields.key/value.string_value
DestinationDeviceHost	target.asset.hostname
DestinationDeviceMac	target.asset.mac
DestinationDeviceModel	target.asset.hardware.model
DestinationDeviceOS	additional.fields.key/value.string_value
DestinationDeviceOSFamily	additional.fields.key/value.string_value
DestinationDeviceOSVersion	target.platform_version
DestinationDeviceProfile	additional.fields.key/value.string_value
DestinationDeviceVendor	target.asset.hardware.manufacturer
DestinationDynamicAddressGroup	target.group.group_display_name
DestinationEDL	additional.fields.key/value.string_value
DestinationAddress	target.ip
DestinationLocation	target.location.country_or_region
DestinationPort	target.port
DestinationUser	target.user.userid
DestinationUserDomain	target.administrative_domain
DestinationUserName	target.user.user_display_name
DestinationUserUUID	target.user.product_object_id
DestinationUUID	target.resource.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
DirectionOfAttack	security_result.detection_fields.key/value
DomainEDL	additional.fields.key/value.string_value
DynamicUserGroupName	additional.fields.key/value.string_value
EndpointSerialNumber	principal.asset.hardware.serial_number
FileName	target.file.names
FileHash	target.file.sha1
FileType	additional.fields.key/value.string_value
FileURL	target.url
FlowType	additional.fields.key/value.string_value
FromZone	additional.fields.key/value.string_value
HostID	principal.asset.asset_id
HTTP2Connection	network.application_protocol_version
HTTPMethod	network.http.method
InboundInterface	additional.fields.key/value.string_value
InboundInterfaceDetailsPort	additional.fields.key/value.string_value
InboundInterfaceDetailsSlot	additional.fields.key/value.string_value
InboundInterfaceDetailsType	additional.fields.key/value.string_value
InboundInterfaceDetailsUnit	additional.fields.key/value.string_value
CaptivePortal	additional.fields.key/value.string_value
IsClienttoServer	additional.fields.key/value.string_value
IsContainer	additional.fields.key/value.string_value
IsDecryptMirror	additional.fields.key/value.string_value
IsDecrypted	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
IsEncrypted	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsIPV6	additional.fields.key/value.string_value
IsMptcpOn	additional.fields.key/value.string_value
NAT	additional.fields.key/value.string_value
IsNonStandardDestinationPort	additional.fields.key/value.string_value
IsPacketCapture	additional.fields.key/value.string_value
IsPhishing	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
IsProxy	additional.fields.key/value.string_value
IsReconExcluded	additional.fields.key/value.string_value
IsSaaSApplication	additional.fields.key/value.string_value
IsServertoClient	additional.fields.key/value.string_value
IsSourceXForwarded	additional.fields.key/value.string_value
IsSystemReturn	additional.fields.key/value.string_value
IsTransaction	additional.fields.key/value.string_value
IsTunnelInspected	additional.fields.key/value.string_value
IsURLDenied	additional.fields.key/value.string_value
K8SClusterID	target.resource.attribute.labels
LocalDeepLearningAnalyzed	additional.fields.key/value.string_value
Location	observer.location.country_or_region
LogSetting	intermediary.resource.attribute.labels
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
IMEI	additional.fields.key/value.string_value
NATDestination	target.nat_ip
NATDestinationPort	target.nat_port
NATSource	principal.nat_ip
NATSourcePort	principal.nat_port
NonStandardDestinationPort	additional.fields.key/value.string_value
NSSAINetworkSliceType	additional.fields.key/value.string_value
OutboundInterface	additional.fields.key/value.string_value
OutboundInterfaceDetailsPort	additional.fields.key/value.string_value
OutboundInterfaceDetailsSlot	additional.fields.key/value.string_value
OutboundInterfaceDetailsType	additional.fields.key/value.string_value
OutboundInterfaceDetailsUnit	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
ParentSessionID	network.parent_session_id
ParentStarttime	additional.fields.key/value.string_value
PartialHash	additional.fields.key/value.string_value
PayloadProtocolID	additional.fields.key/value.string_value
Packet	additional.fields.key/value.string_value
PacketID	additional.fields.key/value.string_value
PlatformType	additional.fields.key/value.string_value
ContainerName	target.resource.name
ContainerNameSpace	target.resource.attribute.labels
Protocol	network.ip_protocol
RecipientEmail	target.user.email_addresses
ReportID	security_result.detection_fields.key/value
ApplicationRisk	additional.fields.key/value.string_value
Rule	security_result.rule_name
RuleUUID	security_result.rule_id
SanctionedStateOfApp	additional.fields.key/value.string_value
SenderEmail	principal.user.email_addresses
SequenceNo	metadata.product_log_id
SessionID	network.session_id
Severity	security_result.severity
SigFlags	additional.fields.key/value.string_value
SourceDeviceCategory	principal.asset.category
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceHost	principal.hostname
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOS	additional.fields.key/value.string_value
SourceDeviceOSFamily	additional.fields.key/value.string_value
SourceDeviceOSVersion	principal.platform_version
SourceDeviceProfile	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceDynamicAddressGroup	principal.group.group_display_name
SourceEDL	additional.fields.key/value.string_value
SourceAddress	principal.ip
SourceLocation	principal.location.country_or_region
SourcePort	principal.port
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SourceUUID	principal.resource.product_object_id
Subtype	metadata.product_event_type
EmailSubject	network.email.subject
ApplicationTechnology	additional.fields.key/value.string_value
ThreatCategory	security_result.detection_fields.key/value.key/value
ThreatID	security_result.threat_id
ThreatName	security_result.threat_name
ThreatNameFirewall	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
ToZone	additional.fields.key/value.string_value
Tunnel	additional.fields.key/value.string_value
TunneledApplication	additional.fields.key/value.string_value
IMSI	additional.fields.key/value.string_value
URLDomain	target.domain.name
URLCounter	additional.fields.key/value.string_value
Users	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details
Verdict	additional.fields.key/value.string_value
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels
X-Forwarded-ForIP	principal.ip

Traffic

Tabel berikut mencantumkan kolom log dari jenis log Traffic dan kolom UDM yang sesuai.

Log field	UDM mapping
Action	security_result.action
ActionSource	additional.fields.key/value.string_value
AIFwdError	additional.fields.key/value.string_value
AITraffic	additional.fields.key/value.string_value
Application	target.application
ApplicationCategory	additional.fields.key/value.string_value
ApplicationSubcategory	additional.fields.key/value.string_value
BytesReceived	network.received_bytes
BytesSent	network.sent_bytes
Bytes	additional.fields.key/value.string_value
ChunksReceived	additional.fields.key/value.string_value
ChunksSent	additional.fields.key/value.string_value
ChunksTotal	additional.fields.key/value.string_value
ConfigVersion	additional.fields.key/value.string_value
ContainerID	intermediary.resource.product_object_id
ApplicationContainer	additional.fields.key/value.string_value
RepeatCount	additional.fields.key/value.string_value
CortexDataLakeTenantID	metadata.product_deployment_id
DestinationDeviceCategory	target.asset.category
DestinationDeviceClass	additional.fields.key/value.string_value
DestinationDeviceHost	target.asset.hostname
DestinationDeviceMac	target.asset.mac
DestinationDeviceModel	target.asset.hardware.model
DestinationDeviceOS	additional.fields.key/value.string_value
DestinationDeviceOSFamily	additional.fields.key/value.string_value
DestinationDeviceOSVersion	target.platform_version
DestinationDeviceProfile	additional.fields.key/value.string_value
DestinationDeviceVendor	target.asset.hardware.manufacturer
DestinationDynamicAddressGroup	target.group.group_display_name
DestinationEDL	additional.fields.key/value.string_value
DestinationAddress	target.ip
DestinationLocation	target.location.country_or_region
DestinationPort	target.port
DestinationUser	target.user.userid
DestinationUserDomain	target.administrative_domain
DestinationUserName	target.user.user_display_name
DestinationUserUUID	target.user.product_object_id
DestinationUUID	target.resource.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
DynamicUserGroupName	additional.fields.key/value.string_value
EndpointSerialNumber	principal.asset.hardware.serial_number
EndpointAssociationID	additional.fields.key/value.string_value
FlowType	additional.fields.key/value.string_value
FromZone	additional.fields.key/value.string_value
HASessionOwner	additional.fields.key/value.string_value
GPHostID	additional.fields.key/value.string_value
HTTP2Connection	network.application_protocol_version
InboundInterface	additional.fields.key/value.string_value
InboundInterfaceDetailsPort	additional.fields.key/value.string_value
InboundInterfaceDetailsSlot	additional.fields.key/value.string_value
InboundInterfaceDetailsType	additional.fields.key/value.string_value
InboundInterfaceDetailsUnit	additional.fields.key/value.string_value
CaptivePortal	additional.fields.key/value.string_value
IsClienttoServer	additional.fields.key/value.string_value
IsContainer	additional.fields.key/value.string_value
IsDecryptMirror	additional.fields.key/value.string_value
IsDecrypted	additional.fields.key/value.string_value
IsDecryptedPayloadForward	additional.fields.key/value.string_value
IsDecryptedLog	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
IsEncrypted	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsIPV6	additional.fields.key/value.string_value
IsInspectionBeforeSession	additional.fields.key/value.string_value
IsMptcpOn	additional.fields.key/value.string_value
NAT	additional.fields.key/value.string_value
IsNonStandardDestinationPort	additional.fields.key/value.string_value
IsOffloaded	additional.fields.key/value.string_value
IsPacketCapture	additional.fields.key/value.string_value
IsPhishing	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
IsProxy	additional.fields.key/value.string_value
IsReconExcluded	additional.fields.key/value.string_value
IsSaaSApplication	additional.fields.key/value.string_value
IsServertoClient	additional.fields.key/value.string_value
IsSourceXForwarded	additional.fields.key/value.string_value
IsSystemReturn	additional.fields.key/value.string_value
IsTransaction	additional.fields.key/value.string_value
IsTunnelInspected	additional.fields.key/value.string_value
IsURLDenied	additional.fields.key/value.string_value
K8SClusterID	target.resource.attribute.labels
LinkChangeCount	additional.fields.key/value.string_value
LinkSwitches	additional.fields.key/value.string_value
Location	observer.location.country_or_region
LogSetting	intermediary.resource.attribute.labels
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
IMEI	additional.fields.key/value.string_value
NATDestination	target.nat_ip
NATDestinationPort	target.nat_port
NATSource	principal.nat_ip
NATSourcePort	principal.nat_port
NonStandardDestinationPort	additional.fields.key/value.string_value
NSSAINetworkSliceType	additional.fields.key/value.string_value
OutboundInterface	additional.fields.key/value.string_value
OutboundInterfaceDetailsPort	additional.fields.key/value.string_value
OutboundInterfaceDetailsSlot	additional.fields.key/value.string_value
OutboundInterfaceDetailsType	additional.fields.key/value.string_value
OutboundInterfaceDetailsUnit	additional.fields.key/value.string_value
PacketsReceived	network.received_packets
PacketsSent	network.sent_packets
PacketsTotal	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
ParentSessionID	network.parent_session_id
ParentStarttime	additional.fields.key/value.string_value
PlatformType	additional.fields.key/value.string_value
ContainerName	target.resource.name
ContainerNameSpace	target.resource.attribute.labels
SDWANPolicyName	additional.fields.key/value.string_value
Protocol	network.ip_protocol
ApplicationRisk	additional.fields.key/value.string_value
Rule	security_result.rule_name
RuleUUID	security_result.rule_id
SanctionedStateOfApp	additional.fields.key/value.string_value
SDWANFECRatio	additional.fields.key/value.string_value
SDWANCluster	additional.fields.key/value.string_value
SDWANClusterType	additional.fields.key/value.string_value
SDWANDeviceType	additional.fields.key/value.string_value
SDWANSite	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
SessionOwnerMidx	additional.fields.key/value.string_value
SessionEndReason	security_result.summary
SessionID	network.session_id
SessionStartTime	additional.fields.key/value.string_value
SessionTracker	additional.fields.key/value.string_value
SourceDeviceCategory	principal.asset.category
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceHost	principal.hostname
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOS	additional.fields.key/value.string_value
SourceDeviceOSFamily	additional.fields.key/value.string_value
SourceDeviceOSVersion	principal.platform_version
SourceDeviceProfile	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceDynamicAddressGroup	principal.group.group_display_name
SourceEDL	additional.fields.key/value.string_value
SourceAddress	principal.ip
SourceLocation	principal.location.country_or_region
SourcePort	principal.port
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SourceUUID	principal.resource.product_object_id
Subtype	metadata.product_event_type
ApplicationTechnology	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
ToZone	additional.fields.key/value.string_value
SessionDuration	network.session_duration
Tunnel	additional.fields.key/value.string_value
TunneledApplication	additional.fields.key/value.string_value
IMSI	additional.fields.key/value.string_value
URLCategory	target.url_metadata.categories
Users	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels
X-Forwarded-ForIP	principal.ip

User-ID

Tabel berikut mencantumkan kolom log dari jenis log User-Id dan kolom UDM yang sesuai.

Log field	UDM mapping
AuthFactorNo	security_result.detection_fields.key/value
AuthenticatedUserDomain	target.user.administrative_domain
AuthenticatedUserName	target.user.userid
AuthenticatedUserUUID	target.user.product_object_id
ConfigVersion	additional.fields.key/value.string_value
CountofRepeats	additional.fields.key/value.string_value
CortexDataLakeTenantID	metadata.product_deployment_id
DestinationPort	target.port
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
EventID	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
IsDuplicateUser	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaNetworks	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
MappingDataSource	additional.fields.key/value.string_value
MappingDataSourceName	additional.fields.key/value.string_value
MappingDataSourceType	additional.fields.key/value.string_value
MappingTimeout	additional.fields.key/value.string_value
MFAFactorType	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
SourceIP	principal.ip
SourcePort	principal.port
Subtype	metadata.product_event_type
Tag	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
UGFlags	additional.fields.key/value.string_value
User	target.user.userid
UserGroupFound	additional.fields.key/value.string_value
UserIdentifiedBySource	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels

Kecocokan HIP

Tabel berikut mencantumkan kolom log dari jenis log kecocokan HIP dan kolom UDM yang sesuai.

Log field	UDM mapping
ConfigVersion	additional.fields.key/value.string_value
CountOfRepeats	additional.fields.key/value.string_value
TenantID	metadata.product_deployment_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
EndpointDeviceName	principal.asset.hostname
EndpointOSType	additional.fields.key/value.string_value
EndpointSerialNumber	principal.asset.hardware.serial_number
HipMatchName	target.resource.attribute.labels
HipMatchType	target.resource.attribute.labels
HostID	principal.asset.asset_id
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaNetworks	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	target.asset.hardware.serial_number
DeviceName	target.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	metadata.product_event_type
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
Source	additional.fields.key/value.string_value
SourceDeviceCategory	principal.asset.category
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceHost	principal.hostname
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOS	additional.fields.key/value.string_value
SourceDeviceOSFamily	additional.fields.key/value.string_value
SourceDeviceOSVersion	principal.platform_version
SourceDeviceProfile	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceIP	principal.ip
SourceIPv6	principal.ip
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
Subtype	metadata.product_event_type
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
TimestampDeviceIdentification	principal.asset.first_seen_time
UUID	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualLocation	target.asset.attribute.labels
VirtualSystemID	target.resource.product_object_id
VirtualSystemName	target.asset.attribute.labels

Tag IP

Tabel berikut mencantumkan kolom log dari jenis log tag IP dan kolom UDM yang sesuai.

Log field	UDM mapping
ConfigVersion	additional.fields.key/value.string_value
CountOfRepeats	additional.fields.key/value.string_value
TenantID	metadata.product_deployment_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
EventID	additional.fields.key/value.string_value
IPSubnetRange	network.ip_subnet_range
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaNetworks	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogSetting	target.resource.attribute.labels
LogSource	target.resource.attribute.labels
LogSourceGroupID	target.resource.attribute.labels
DeviceSN	target.asset.hardware.serial_number
DeviceName	target.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
MappingDataSource	additional.fields.key/value.string_value
MappingDataSourceSubType	additional.fields.key/value.string_value
MappingDataSourceType	additional.fields.key/value.string_value
MappingTimeout	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
RuleMatched	security_result.rule_name
RuleMatchedUUID	security_result.rule_id
SequenceNo	metadata.product_log_id
SourceIP	principal.ip
Subtype	metadata.product_event_type
TagName	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualLocation	target.asset.attribute.labels
VirtualSystemID	target.resource.product_object_id
VirtualSystemName	target.asset.attribute.labels

Dekripsi

Tabel berikut mencantumkan kolom log dari jenis log Decryption dan kolom UDM yang sesuai.

Log field	UDM mapping
Action	security_result.action
Application	target.application
ApplicationCategory	additional.fields.key/value.string_value
ApplicationSubcategory	additional.fields.key/value.string_value
CertificateFlags	additional.fields.key/value.string_value
CertificateSerial	network.tls.server.certificate.serial
CertificateSize	additional.fields.key/value.string_value
CertificateVersion	network.tls.server.certificate.version
ChainStatus	additional.fields.key/value.string_value
ApplicationCharacteristics	additional.fields.key/value.string_value
ClientToFirewall	additional.fields.key/value.string_value
CommonName	additional.fields.key/value.string_value
CommonNameLength	additional.fields.key/value.string_value
ContainerID	intermediary.resource.product_object_id
ApplicationContainer	additional.fields.key/value.string_value
Cpadding	additional.fields.key/value.string_value
DestinationDeviceCategory	target.asset.category
DestinationDeviceClass	additional.fields.key/value.string_value
DestinationDeviceHost	target.asset.hostname
DestinationDeviceMac	target.asset.mac
DestinationDeviceModel	target.asset.hardware.model
DestinationDeviceOS	additional.fields.key/value.string_value
DestinationDeviceOSFamily	additional.fields.key/value.string_value
DestinationDeviceOSVersion	target.platform_version
DestinationDeviceProfile	additional.fields.key/value.string_value
DestinationDeviceVendor	target.asset.hardware.manufacturer
DestinationDynamicAddressGroup	target.group.group_display_name
DestinationEDL	additional.fields.key/value.string_value
DestinationAddress	target.ip
DestinationLocation	target.location.country_or_region
DestinationPort	target.port
DestinationUser	target.user.userid
DestinationUserDomain	target.administrative_domain
DestinationUserName	target.user.user_display_name
DestinationUserUUID	target.user.product_object_id
DestinationUUID	target.resource.product_object_id
Domain	target.hostname
EllipticCurve	network.tls.curve
ErrorIndex	additional.fields.key/value.string_value
ErrorMessage	additional.fields.key/value.string_value
Fingerprint	network.tls.server.certificate.md5/sha1/sha256
FirewallToClient	additional.fields.key/value.string_value
FromZone	additional.fields.key/value.string_value
InboundInterface	additional.fields.key/value.string_value
InboundInterfaceDetailsPort	additional.fields.key/value.string_value
InboundInterfaceDetailsSlot	additional.fields.key/value.string_value
InboundInterfaceDetailsType	additional.fields.key/value.string_value
InboundInterfaceDetailsUnit	additional.fields.key/value.string_value
CaptivePortal	additional.fields.key/value.string_value
IsCertECDSA	additional.fields.key/value.string_value
IsCertRSA	additional.fields.key/value.string_value
IsCertCNTruncated	additional.fields.key/value.string_value
IsClienttoServer	additional.fields.key/value.string_value
IsContainer	additional.fields.key/value.string_value
IsDecryptMirror	additional.fields.key/value.string_value
IsDecrypted	additional.fields.key/value.string_value
IsEncrypted	additional.fields.key/value.string_value
IsForwarded	additional.fields.key/value.string_value
IsIPV6	additional.fields.key/value.string_value
IsIssuerCNTruncated	additional.fields.key/value.string_value
IsMptcpOn	additional.fields.key/value.string_value
IsNAT	additional.fields.key/value.string_value
IsNonStandardDestinationPort	additional.fields.key/value.string_value
PacketCapture	additional.fields.key/value.string_value
IsPhishing	additional.fields.key/value.string_value
IsProxy	additional.fields.key/value.string_value
IsReconExcluded	additional.fields.key/value.string_value
IsResumeSession	additional.fields.key/value.string_value
IsRootCNTruncated	additional.fields.key/value.string_value
IsSaaSApplication	additional.fields.key/value.string_value
IsServertoClient	additional.fields.key/value.string_value
IsSNITruncated	additional.fields.key/value.string_value
IsSourceXForwarded	additional.fields.key/value.string_value
IsSystemReturn	additional.fields.key/value.string_value
IsTransaction	additional.fields.key/value.string_value
IsTunnelInspected	additional.fields.key/value.string_value
IsURLDenied	additional.fields.key/value.string_value
IssuerCommonName	network.tls.server.certificate.issuer
IssuerNameLength	additional.fields.key/value.string_value
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
NATDestination	target.nat_ip
NATDestinationPort	target.nat_port
NATSource	principal.nat_ip
NATSourcePort	principal.nat_port
TimeNotAfter	additional.fields.key/value.string_value
TimeNotBefore	additional.fields.key/value.string_value
OutboundInterface	additional.fields.key/value.string_value
OutboundInterfaceDetailsPort	additional.fields.key/value.string_value
OutboundInterfaceDetailsSlot	additional.fields.key/value.string_value
OutboundInterfaceDetailsType	additional.fields.key/value.string_value
OutboundInterfaceDetailsUnit	additional.fields.key/value.string_value
Padding	additional.fields.key/value.string_value
Padding3	additional.fields.key/value.string_value
ContainerName	target.resource.name
ContainerNameSpace	target.resource.attribute.labels
PolicyName	additional.fields.key/value.string_value
Protocol	network.ip_protocol
ProxyType	additional.fields.key/value.string_value
ApplicationRisk	additional.fields.key/value.string_value
RootCommonName	additional.fields.key/value.string_value
RootCNLength	additional.fields.key/value.string_value
RootStatus	additional.fields.key/value.string_value
Rule	security_result.rule_name
RuleUUID	security_result.rule_id
SanctionedStateOfApp	additional.fields.key/value.string_value
SessionID	network.session_id
ServerNameIndication	network.tls.client.server_name
SNILength	additional.fields.key/value.string_value
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceOS	additional.fields.key/value.string_value
SourceDynamicAddressGroup	principal.group.group_display_name
SourceEDL	additional.fields.key/value.string_value
SourceAddress	principal.ip
SourceLocation	principal.location.country_or_region
SourcePort	principal.port
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SourceUUID	principal.resource.product_object_id
ApplicationTechnology	additional.fields.key/value.string_value
TimeReceivedManagementPlane	additional.fields.key/value.string_value
TLSAuth	additional.fields.key/value.string_value
TLSEncryptionAlgorithm	additional.fields.key/value.string_value
TLSKeyExchange	additional.fields.key/value.string_value
TLSVersion	network.tls.version
ToZone	additional.fields.key/value.string_value
Tpadding	additional.fields.key/value.string_value
Tunnel	additional.fields.key/value.string_value
TunneledApplication	additional.fields.key/value.string_value
Vpadding	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogSetting	intermediary.resource.attribute.labels
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
SourceDeviceCategory	principal.asset.category
SourceDeviceHost	principal.hostname
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOSFamily	additional.fields.key/value.string_value
SourceDeviceOSVersion	principal.platform_version
SourceDeviceProfile	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
Subtype	metadata.product_event_type
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels

Terowongan

Tabel berikut mencantumkan kolom log dari jenis log Tunnel dan kolom UDM yang sesuai.

Log field	UDM mapping
AccessPointName	additional.fields.key/value.string_value
Action	security_result.action
ActionSource	additional.fields.key/value.string_value
Application	target.application
ApplicationCategory	additional.fields.key/value.string_value
ApplicationSubcategory	additional.fields.key/value.string_value
BytesReceived	network.received_bytes
BytesSent	network.sent_bytes
Bytes	additional.fields.key/value.string_value
ConfigVersion	additional.fields.key/value.string_value
ContainerID	intermediary.resource.product_object_id
ApplicationContainer	additional.fields.key/value.string_value
ContentVersion	additional.fields.key/value.string_value
RepeatCount	additional.fields.key/value.string_value
LoggingServiceID	additional.fields.key/value.string_value
DestinationDeviceClass	additional.fields.key/value.string_value
DestinationDeviceMac	target.asset.mac
DestinationDeviceModel	target.asset.hardware.model
DestinationDeviceOS	additional.fields.key/value.string_value
DestinationDeviceVendor	target.asset.hardware.manufacturer
DestinationDynamicAddressGroup	target.group.group_display_name
DestinationEDL	additional.fields.key/value.string_value
DestinationAddress	target.ip
DestinationLocation	target.location.country_or_region
DestinationPort	target.port
DestinationUser	target.user.userid
DestinationUserDomain	target.administrative_domain
DestinationUserName	target.user.user_display_name
DestinationUserUUID	target.user.product_object_id
DestinationUUID	target.resource.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
DynamicUserGroupName	additional.fields.key/value.string_value
FromZone	additional.fields.key/value.string_value
InboundInterface	additional.fields.key/value.string_value
InboundInterfaceDetailsPort	additional.fields.key/value.string_value
InboundInterfaceDetailsSlot	additional.fields.key/value.string_value
InboundInterfaceDetailsType	additional.fields.key/value.string_value
InboundInterfaceDetailsUnit	additional.fields.key/value.string_value
CaptivePortal	additional.fields.key/value.string_value
IsClienttoServer	additional.fields.key/value.string_value
IsContainer	additional.fields.key/value.string_value
IsDecryptMirror	additional.fields.key/value.string_value
IsDecryptedPayloadForward	additional.fields.key/value.string_value
IsDecryptedLog	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsIPV6	additional.fields.key/value.string_value
IsInspectionBeforeSession	additional.fields.key/value.string_value
IsMptcpOn	additional.fields.key/value.string_value
NAT	additional.fields.key/value.string_value
IsNonStandardDestinationPort	additional.fields.key/value.string_value
IsPacketCapture	additional.fields.key/value.string_value
IsPhishing	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
IsProxy	additional.fields.key/value.string_value
IsReconExcluded	additional.fields.key/value.string_value
IsSaaSApplication	additional.fields.key/value.string_value
IsServertoClient	additional.fields.key/value.string_value
IsSourceXForwarded	additional.fields.key/value.string_value
IsSystemReturn	additional.fields.key/value.string_value
IsTransaction	additional.fields.key/value.string_value
IsTunnelInspected	additional.fields.key/value.string_value
IsURLDenied	additional.fields.key/value.string_value
LogSetting	intermediary.resource.attribute.labels
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
MobileAreaCode	additional.fields.key/value.string_value
MobileBaseStationCode	additional.fields.key/value.string_value
MobileCountryCode	additional.fields.key/value.string_value
MobileIP	additional.fields.key/value.string_value
MobileNetworkCode	additional.fields.key/value.string_value
MobileSubscriberISDN	additional.fields.key/value.string_value
IMEI	additional.fields.key/value.string_value
NATDestination	target.nat_ip
NATDestinationPort	target.nat_port
NATSource	principal.nat_ip
NATSourcePort	principal.nat_port
NonStandardDestinationPort	additional.fields.key/value.string_value
NSSAINetworkSliceDifferentiator	additional.fields.key/value.string_value
NSSAINetworkSliceType	additional.fields.key/value.string_value
OutboundInterface	additional.fields.key/value.string_value
OutboundInterfaceDetailsPort	additional.fields.key/value.string_value
OutboundInterfaceDetailsSlot	additional.fields.key/value.string_value
OutboundInterfaceDetailsType	additional.fields.key/value.string_value
OutboundInterfaceDetailsUnit	additional.fields.key/value.string_value
PacketsDroppedMax	additional.fields.key/value.string_value
PacketsDroppedStrict	additional.fields.key/value.string_value
PacketsDroppedTunnel	additional.fields.key/value.string_value
PacketsDroppedProtocol	additional.fields.key/value.string_value
PacketsReceived	network.received_packets
PacketsSent	network.sent_packets
PacketsTotal	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
ParentSessionID	network.parent_session_id
ParentStarttime	additional.fields.key/value.string_value
ProtocolDataUnitsessionID	additional.fields.key/value.string_value
PlatformType	additional.fields.key/value.string_value
ContainerName	target.resource.name
ContainerNameSpace	target.resource.attribute.labels
Protocol	network.ip_protocol
RadioAccessTechnology	additional.fields.key/value.string_value
ApplicationRisk	additional.fields.key/value.string_value
Rule	security_result.rule_name
RuleUUID	security_result.rule_id
SanctionedStateOfApp	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
SessionOwnerMidx	additional.fields.key/value.string_value
SessionEndReason	security_result.summary
SessionID	network.session_id
SessionStartTime	additional.fields.key/value.string_value
SessionTracker	additional.fields.key/value.string_value
Severity	security_result.severity
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOS	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceDynamicAddressGroup	principal.group.group_display_name
SourceEDL	additional.fields.key/value.string_value
SourceAddress	principal.ip
SourceLocation	principal.location.country_or_region
SourcePort	principal.port
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SourceUUID	principal.resource.product_object_id
StandardPortsOfApp	additional.fields.key/value.string_value
Subtype	metadata.product_event_type
ApplicationTechnology	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
ToZone	additional.fields.key/value.string_value
SessionDuration	network.session_duration
Tunnel	additional.fields.key/value.string_value
TunnelCauseCode	additional.fields.key/value.string_value
TunnelEndpointID1	additional.fields.key/value.string_value
TunnelEndpointID2	additional.fields.key/value.string_value
TunnelEventCode	additional.fields.key/value.string_value
TunnelEventType	additional.fields.key/value.string_value
TunnelInspectionRule	additional.fields.key/value.string_value
TunnelInterface	additional.fields.key/value.string_value
TunnelMessageType	additional.fields.key/value.string_value
TunnelRemoteIMSIID	additional.fields.key/value.string_value
TunnelRemoteUserIP	principal.ip
TunnelSessionsClosed	additional.fields.key/value.string_value
TunnelSessionsCreated	additional.fields.key/value.string_value
TunneledApplication	additional.fields.key/value.string_value
IMSI	additional.fields.key/value.string_value
URLCategory	target.url_metadata.categories
Users	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels

Autentikasi

Tabel berikut mencantumkan kolom log dari jenis log Authentication dan kolom UDM yang sesuai.

Log field	UDM mapping
AuthenticationDescription	security_result.description
AuthEvent	metadata.description
AuthFactorNo	security_result.detection_fields.key/value
AuthenticationPolicy	security_result.detection_fields.key/value
AuthenticationProtocol	additional.fields.key/value.string_value
AuthServerProfile	additional.fields.key/value.string_value
AuthenticatedUserDomain	target.administrative_domain
AuthenticatedUserName	target.user.userid
AuthenticatedUserUUID	target.user.product_object_id
ClientType	additional.fields.key/value.string_value
ClientTypeName	additional.fields.key/value.string_value
CountOfRepeats	additional.fields.key/value.string_value
CortexDataLakeTenantID	metadata.product_deployment_id
IsPrismaNetworks	additional.fields.key/value.string_value
Location	target.location.country_or_region
LogSetting	intermediary.resource.attribute.labels
LogType	additional.fields.key/value.string_value
MFAAuthenticationID	additional.fields.key/value.string_value
MFAVendor	additional.fields.key/value.string_value
NormalizeUser	target.user.user_display_name
Object	target.resource.name
RuleMatched	security_result.rule_name
RuleMatchedUUID	security_result.rule_id
AuthCacheServiceRegion	additional.fields.key/value.string_value
SessionID	network.session_id
SourceDeviceCategory	principal.asset.category
SourceDeviceHost	principal.hostname
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOSFamily	additional.fields.key/value.string_value
SourceDeviceOSVersion	principal.platform_version
SourceDeviceProfile	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceIP	principal.ip
TimeGenerated	metadata.event_timestamp
User	target.user.userid
UserAgentString	network.http.user_agent
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
Subtype	metadata.product_event_type
TimeGeneratedHighResolution	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels

URL

Tabel berikut mencantumkan kolom log dari jenis log URL dan kolom UDM yang sesuai.

Log field	UDM mapping
Action	security_result.action
Application	target.application
ApplicationCategory	additional.fields.key/value.string_value
ApplicationSubcategory	additional.fields.key/value.string_value
CloudHostname	additional.fields.key/value.string_value
CloudReportID	security_result.detection_fields.key/value
ConfigVersion	additional.fields.key/value.string_value
ContainerID	intermediary.resource.product_object_id
ApplicationContainer	additional.fields.key/value.string_value
ContentType	additional.fields.key/value.string_value
ContentVersion	additional.fields.key/value.string_value
RepeatCount	additional.fields.key/value.string_value
CortexDataLakeTenantID	metadata.product_deployment_id
DestinationDeviceCategory	target.asset.category
DestinationDeviceClass	additional.fields.key/value.string_value
DestinationDeviceHost	target.asset.hostname
DestinationDeviceMac	target.asset.mac
DestinationDeviceModel	target.asset.hardware.model
DestinationDeviceOS	additional.fields.key/value.string_value
DestinationDeviceOSFamily	additional.fields.key/value.string_value
DestinationDeviceOSVersion	target.platform_version
DestinationDeviceProfile	additional.fields.key/value.string_value
DestinationDeviceVendor	target.asset.hardware.manufacturer
DestinationDynamicAddressGroup	target.group.group_display_name
DestinationEDL	additional.fields.key/value.string_value
DestinationAddress	target.ip
DestinationLocation	target.location.country_or_region
DestinationPort	target.port
DestinationUser	target.user.userid
DestinationUserDomain	target.administrative_domain
DestinationUserName	target.user.user_display_name
DestinationUserUUID	target.user.product_object_id
DestinationUUID	target.resource.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
DirectionOfAttack	security_result.detection_fields.key/value
DynamicUserGroupName	additional.fields.key/value.string_value
EndpointSerialNumber	principal.asset.hardware.serial_number
FileURL	target.url
FlowType	additional.fields.key/value.string_value
FromZone	additional.fields.key/value.string_value
HostID	principal.asset.asset_id
HTTP2Connection	network.application_protocol_version
HTTPHeaders	additional.fields.key/value.string_value
HTTPMethod	network.http.method
InboundInterface	additional.fields.key/value.string_value
InboundInterfaceDetailsPort	additional.fields.key/value.string_value
InboundInterfaceDetailsSlot	additional.fields.key/value.string_value
InboundInterfaceDetailsType	additional.fields.key/value.string_value
InboundInterfaceDetailsUnit	additional.fields.key/value.string_value
InlineMLVerdict	additional.fields.key/value.string_value
CaptivePortal	additional.fields.key/value.string_value
IsClienttoServer	additional.fields.key/value.string_value
IsContainer	additional.fields.key/value.string_value
IsDecryptMirror	additional.fields.key/value.string_value
IsDecrypted	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
IsEncrypted	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsIPV6	additional.fields.key/value.string_value
IsMptcpOn	additional.fields.key/value.string_value
NAT	additional.fields.key/value.string_value
IsNonStandardDestinationPort	additional.fields.key/value.string_value
IsPacketCapture	additional.fields.key/value.string_value
IsPhishing	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
IsProxy	additional.fields.key/value.string_value
IsReconExcluded	additional.fields.key/value.string_value
IsSaaSApplication	additional.fields.key/value.string_value
IsServertoClient	additional.fields.key/value.string_value
IsSourceXForwarded	additional.fields.key/value.string_value
IsSystemReturn	additional.fields.key/value.string_value
IsTransaction	additional.fields.key/value.string_value
IsTunnelInspected	additional.fields.key/value.string_value
IsURLDenied	additional.fields.key/value.string_value
K8SClusterID	target.resource.attribute.labels
Location	observer.location.country_or_region
LogSetting	intermediary.resource.attribute.labels
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
IMEI	additional.fields.key/value.string_value
NATDestination	target.nat_ip
NATDestinationPort	target.nat_port
NATSource	principal.nat_ip
NATSourcePort	principal.nat_port
NonStandardDestinationPort	additional.fields.key/value.string_value
NSSAINetworkSliceType	additional.fields.key/value.string_value
OutboundInterface	additional.fields.key/value.string_value
OutboundInterfaceDetailsPort	additional.fields.key/value.string_value
OutboundInterfaceDetailsSlot	additional.fields.key/value.string_value
OutboundInterfaceDetailsType	additional.fields.key/value.string_value
OutboundInterfaceDetailsUnit	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
ParentSessionID	network.parent_session_id
ParentStarttime	additional.fields.key/value.string_value
Packet	additional.fields.key/value.string_value
PacketID	additional.fields.key/value.string_value
PlatformType	additional.fields.key/value.string_value
ContainerName	target.resource.name
ContainerNameSpace	target.resource.attribute.labels
Protocol	network.ip_protocol
Referer	network.http.referral_url
HTTPRefererFQDN	additional.fields.key/value.string_value
HTTPRefererPort	additional.fields.key/value.string_value
HTTPRefererProtocol	additional.fields.key/value.string_value
HTTPRefererURLPath	additional.fields.key/value.string_value
ApplicationRisk	additional.fields.key/value.string_value
Rule	security_result.rule_name
RuleUUID	security_result.rule_id
SanctionedStateOfApp	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
SessionID	network.session_id
Severity	security_result.severity
SigFlags	additional.fields.key/value.string_value
SourceDeviceCategory	principal.asset.category
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceHost	principal.hostname
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOS	additional.fields.key/value.string_value
SourceDeviceOSFamily	additional.fields.key/value.string_value
SourceDeviceOSVersion	principal.platform_version
SourceDeviceProfile	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceDynamicAddressGroup	principal.group.group_display_name
SourceEDL	additional.fields.key/value.string_value
SourceAddress	principal.ip
SourceLocation	principal.location.country_or_region
SourcePort	principal.port
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SourceUUID	principal.resource.product_object_id
Subtype	metadata.product_event_type
ApplicationTechnology	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
ToZone	additional.fields.key/value.string_value
Tunnel	additional.fields.key/value.string_value
TunneledApplication	additional.fields.key/value.string_value
IMSI	additional.fields.key/value.string_value
URL	target.url_metadata.URL
URLCategory	target.url_metadata.categories
URLCategoryList	additional.fields.key/value.string_value
URLDomain	target.domain.name
URLCounter	additional.fields.key/value.string_value
UserAgent	network.http.user_agent
Users	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels
X-Forwarded-For	additional.fields.key/value.string_value
X-Forwarded-ForIP	principal.ip

GlobalProtect

Tabel berikut mencantumkan kolom log dari jenis log GlobalProtect dan kolom UDM yang sesuai.

Log field	UDM mapping
AttemptedGateways	additional.fields.key/value.string_value
AuthMethod	extensions.auth.auth_details
ConnectionMethod	additional.fields.key/value.string_value
ConnectionErrorID	additional.fields.key/value.string_value
ConnectionError	additional.fields.key/value.string_value
CountOfRepeats	additional.fields.key/value.string_value
EndpointDeviceName	principal.asset.hostname
GlobalProtectClientVersion	additional.fields.key/value.string_value
EndpointOSType	additional.fields.key/value.string_value
EndpointSN	principal.asset.hardware.serial_number
EventIDValue	additional.fields.key/value.string_value
Gateway	target.resource.name
GatewayPriority	additional.fields.key/value.string_value
GatewaySelectionType	additional.fields.key/value.string_value
GlobalProtectGatewayLocation	target.location.country_or_region
HostID	principal.asset.asset_id
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LoginDuration	network.session_duration
Description	security_result.description
Portal	target.hostname
PrivateIPv4	principal.ip
PrivateIPv6	principal.ip
ProjectName	additional.fields.key/value.string_value
PublicIPv4	principal.nat_ip
PublicIPv6	principal.nat_ip
QuarantineReason	security_result.summary
SequenceNo	metadata.product_log_id
SourceRegion	principal.location.country_or_region
SourceUserName	principal.user.user_display_name
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SSLResponseTime	additional.fields.key/value.string_value
Stage	additional.fields.key/value.string_value
EventStatus	additional.fields.key/value.string_value
LogSubtype	metadata.product_event_type
TunnelType	additional.fields.key/value.string_value
VirtualSystem	intermediary.asset.attribute.labels
VirtualSystemName	intermediary.asset.attribute.labels
EndpointOSVersion	principal.platform_version
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaNetworks	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	metadata.product_event_type
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VirtualSystemID	intermediary.resource.product_object_id

SCTP

Tabel berikut mencantumkan kolom log dari jenis log SCTP dan kolom UDM yang sesuai.

Log field	UDM mapping
Action	security_result.action
Application	target.application
AssocationEndReason	additional.fields.key/value.string_value
ChunksReceived	additional.fields.key/value.string_value
ChunksSent	additional.fields.key/value.string_value
ChunksTotal	additional.fields.key/value.string_value
ConfigVersion	additional.fields.key/value.string_value
ContainerID	intermediary.resource.product_object_id
ContentVersion	additional.fields.key/value.string_value
RepeatCount	additional.fields.key/value.string_value
CortexDataLakeTenantID	metadata.product_deployment_id
DestinationDeviceClass	target.asset.category
DestinationDeviceMac	target.asset.mac
DestinationDeviceModel	target.asset.hardware.model
DestinationDeviceOS	additional.fields.key/value.string_value
DestinationDeviceVendor	target.asset.hardware.manufacturer
DestinationDynamicAddressGroup	target.group.group_display_name
DestinationEDL	additional.fields.key/value.string_value
DestinationIP	target.ip
DestinationLocation	target.location.country_or_region
DestinationPort	target.port
DestinationUser	target.user.userid
DestinationUserDomain	target.administrative_domain
DestinationUserName	target.user.user_display_name
DestinationUserUUID	target.user.product_object_id
DestinationUUID	target.resource.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
DiamAppID	additional.fields.key/value.string_value
DiamAvpCode	additional.fields.key/value.string_value
DiameterCommandCode	additional.fields.key/value.string_value
DiameterRequestFlag	additional.fields.key/value.string_value
DeviceName	principal.asset.hostname
SCTPEventType	additional.fields.key/value.string_value
FromZone	additional.fields.key/value.string_value
InboundInterface	additional.fields.key/value.string_value
InboundInterfaceDetailsPort	additional.fields.key/value.string_value
InboundInterfaceDetailsSlot	additional.fields.key/value.string_value
InboundInterfaceDetailsType	additional.fields.key/value.string_value
InboundInterfaceDetailsUnit	additional.fields.key/value.string_value
CaptivePortal	additional.fields.key/value.string_value
IsClienttoServer	additional.fields.key/value.string_value
IsContainer	additional.fields.key/value.string_value
IsDecryptMirror	additional.fields.key/value.string_value
IsDecryptedPayloadForward	additional.fields.key/value.string_value
IsDecryptedLog	additional.fields.key/value.string_value
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsIPV6	additional.fields.key/value.string_value
IsInspectionBeforeSession	additional.fields.key/value.string_value
IsMptcpOn	additional.fields.key/value.string_value
NAT	additional.fields.key/value.string_value
IsNonStandardDestinationPort	additional.fields.key/value.string_value
IsPacketCapture	additional.fields.key/value.string_value
IsPhishing	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
IsProxy	additional.fields.key/value.string_value
IsReconExcluded	additional.fields.key/value.string_value
IsServertoClient	additional.fields.key/value.string_value
IsSourceXForwarded	additional.fields.key/value.string_value
IsSystemReturn	additional.fields.key/value.string_value
IsTransaction	additional.fields.key/value.string_value
IsTunnelInspected	additional.fields.key/value.string_value
IsURLFiltering	additional.fields.key/value.string_value
IsWildfire	additional.fields.key/value.string_value
LogAction	additional.fields.key/value.string_value
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
DeviceName	intermediary.hostname
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
MapAppCode	additional.fields.key/value.string_value
NATDestination	target.nat_ip
NATDestinationPort	target.nat_port
NATSource	principal.nat_ip
NATSourcePort	principal.nat_port
OutboundInterface	additional.fields.key/value.string_value
OutboundInterfaceDetailsPort	additional.fields.key/value.string_value
OutboundInterfaceDetailsSlot	additional.fields.key/value.string_value
OutboundInterfaceDetailsType	additional.fields.key/value.string_value
OutboundInterfaceDetailsUnit	additional.fields.key/value.string_value
PacketsReceived	network.received_packets
PacketsSent	network.sent_packets
PacketsTotal	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PayloadProtocolID	additional.fields.key/value.string_value
PlatformType	additional.fields.key/value.string_value
ContainerName	target.resource.name
ContainerNameSpace	target.resource.attribute.labels
Protocol	network.ip_protocol
Rule	security_result.rule_name
RuleUUID	security_result.rule_id
SccpCallingGt	additional.fields.key/value.string_value
SccpCallingSSN	additional.fields.key/value.string_value
SctpCauseCode	additional.fields.key/value.string_value
SctpChunkType	additional.fields.key/value.string_value
SctpFilter	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
SessionOwnerMidx	additional.fields.key/value.string_value
SessionEndReason	security_result.summary
SessionID	network.session_id
SessionTracker	additional.fields.key/value.string_value
Severity	security_result.severity
SourceDeviceClass	additional.fields.key/value.string_value
SourceDeviceMac	principal.asset.mac
SourceDeviceModel	principal.asset.hardware.model
SourceDeviceOS	additional.fields.key/value.string_value
SourceDeviceVendor	principal.asset.hardware.manufacturer
SourceDynamicAddressGroup	principal.group.group_display_name
SourceEDL	additional.fields.key/value.string_value
SourceIP	principal.ip
SourceLocation	principal.location.country_or_region
SourcePort	principal.port
SourceUser	principal.user.userid
SourceUserDomain	principal.administrative_domain
SourceUserName	principal.user.user_display_name
SourceUserUUID	principal.user.product_object_id
SourceUUID	principal.resource.product_object_id
Subtype	metadata.product_event_type
TimeGenerated	metadata.event_timestamp
TimeGeneratedHighResolution	additional.fields.key/value.string_value
ToZone	additional.fields.key/value.string_value
Tunnel	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details
VerificationTag1	additional.fields.key/value.string_value
VerificationTag2	additional.fields.key/value.string_value
VirtualLocation	intermediary.asset.attribute.labels
VirtualSystemID	intermediary.resource.product_object_id
VirtualSystemName	intermediary.asset.attribute.labels

Audit

Tabel berikut mencantumkan kolom log dari jenis log Audit dan kolom UDM yang sesuai.

Log field	UDM mapping
EventCategory	network.http.method
EventDescription	metadata.description
EventDestinationURL	target.url
EventDestinationUserUserID	target.user.userid
DestinationVendor	additional.fields.key/value.string_value
EventDetails	additional.fields.key/value.string_value
EventID	metadata.product_log_id
EventName	additional.fields.key/value.string_value
EventResult	security_result.summary
EventSourceUserUserID	principal.user.userid
EventTime	metadata.event_timestamp
LogSource	target.resource.attribute.labels
LogSourceGroupID	target.resource.attribute.labels
DeviceSN	target.asset.hardware.serial_number
DeviceName	target.hostname
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
PlatformType	additional.fields.key/value.string_value
Subtype	metadata.product_event_type
TSGID	additional.fields.key/value.string_value
Vendor	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details

Konfigurasi

Tabel berikut mencantumkan kolom log dari jenis log Config dan kolom UDM yang sesuai.

Log field	UDM mapping
AdminUsername	principal.user.userid
AdminUserDomain	principal.administrative_domain
AdminUserName	principal.user.user_display_name
AdminUserUUID	principal.user.product_object_id
Client	additional.fields.key/value.string_value
ConfigVersion	additional.fields.key/value.string_value
TenantID	metadata.product_deployment_id
DeviceGroup	target.group.product_object_id
DGHierarchyLevel1	additional.fields.key/value.string_value
DGHierarchyLevel2	additional.fields.key/value.string_value
DGHierarchyLevel3	additional.fields.key/value.string_value
DGHierarchyLevel4	additional.fields.key/value.string_value
IPaddress	principal.ip/hostname
EventDescription	metadata.description
EventDetails	additional.fields.key/value.string_value
EventName	additional.fields.key/value.string_value
EventPath	target.resource.name
EventResult	security_result.summary
EventTime	metadata.event_timestamp
IsDuplicateLog	additional.fields.key/value.string_value
LogExported	additional.fields.key/value.string_value
LogForwarded	additional.fields.key/value.string_value
IsPrismaNetwork	additional.fields.key/value.string_value
IsPrismaUsers	additional.fields.key/value.string_value
LogCategory	security_result.category_details
LogSource	target.resource.attribute.labels
LogSourceGroupID	target.resource.attribute.labels
LogSourceID	target.resource.attribute.labels
LogSourceName	target.resource.attribute.labels
LogSourceTimeZoneOffset	additional.fields.key/value.string_value
LogTime	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
SequenceNo	metadata.product_log_id
Severity	security_result.severity
Subtype	metadata.product_event_type
Template	target.resource.attribute.labels
TimeGeneratedHighResolution	additional.fields.key/value.string_value
VendorName	additional.fields.key/value.string_value
VendorSeverity	security_result.severity_details
VirtualLocation	target.asset.attribute.labels
VirtualSystemID	target.resource.product_object_id
VirtualSystemName	target.asset.attribute.labels

DNS

Tabel berikut mencantumkan kolom log dari jenis log DNS dan kolom UDM yang sesuai.

Log field	UDM mapping
Action	security_result.action
CortexDataLakeTenantID	metadata.product_deployment_id
DNSResolverIP	target.ip
DNSResponse	network.dns.answers.data
DNSResponseCode	additional.fields.key/value.string_value
DestinationUser	target.user.userid
ToZone	additional.fields.key/value.string_value
FQDN	network.dns.questions.name
FromZone	additional.fields.key/value.string_value
ThreatID	security_result.threat_id
LogSource	intermediary.resource.attribute.labels
LogSourceGroupID	intermediary.resource.attribute.labels
DeviceSN	intermediary.asset.hardware.serial_number
TimeReceived	metadata.collected_timestamp
LogType	additional.fields.key/value.string_value
PanoramaSN	observer.asset.hardware.serial_number
PlatformType	additional.fields.key/value.string_value
DNSSecurityVersion	additional.fields.key/value.string_value
RecordType	network.dns.questions.type
SourceAddress	principal.ip
SourceUser	principal.user.userid
Subtype	metadata.product_event_type
ThreatName	security_result.threat_name
TimeGenerated	metadata.event_timestamp
SessionDuration	network.session_duration
VendorName	additional.fields.key/value.string_value
DNSCategory	security_result.category_details

Referensi pemetaan kolom: Jenis log ke jenis peristiwa UDM

Tabel berikut mencantumkan jenis log firewall Palo Alto Networks Strata Logging Service dan jenis peristiwa UDM yang sesuai.

Jenis log	Jenis peristiwa UDM
Traffic	NETWORK_CONNECTION
Ancaman	NETWORK_CONNECTION
Pemfilteran URL	NETWORK_CONNECTION
Terowongan	NETWORK_CONNECTION
Sistem	Jika nilai subjenis adalah "dhcp", NETWORK_DHCP akan ditetapkan. Jika nilai subjenis adalah "auth", USER_LOGIN akan ditetapkan. Jika nilai deskripsi adalah "sedang login", USER_LOGIN akan ditetapkan. Jika nilai deskripsi adalah "logged out", USER_LOGOUT akan ditetapkan. Untuk nilai subjenis lainnya, GENERIC_EVENT ditetapkan.
HIP Match	NETWORK_CONNECTION
Tag IP	GENERIC_EVENT
User-ID	USER_LOGIN/USER_LOGOUT/USER_UNCATEGORIZED Jika nilai subjenis adalah "login", USER_LOGIN akan ditetapkan. Jika nilai subjenis adalah "logout", USER_LOGOUT akan ditetapkan. Jika subjenis tidak berisi nilai apa pun, USER_UNCATEGORIZED akan ditetapkan.
Dekripsi	NETWORK_CONNECTION
Authentication	STATUS_UNCATEGORIZED
Globalprotect	USER_LOGIN/USER_LOGOUT/USER_RESOURCE_ACCESS Jika nilai kolom log Stage adalah "login", USER_LOGIN akan ditetapkan. Jika nilai kolom log Stage adalah "logout", USER_LOGOUT akan ditetapkan. Jika kolom log Stage memiliki nilai lain, USER_RESOURCE_ACCESS akan ditetapkan.
SCTP	NETWORK_CONNECTION
Audit	GENERIC_EVENT
Konfigurasi	SETTING_MODIFICATION/SETTING_CREATION/SETTING_DELETION/SETTING_UNCATEGORIZED/GENERIC_EVENT Jika nilai kolom log EventName adalah "add" atau "clone", SETTING_CREATION akan ditetapkan. Jika nilai kolom log EventName adalah "delete", SETTING_DELETION akan ditetapkan. Jika nilai kolom log EventName adalah "edit", "move", "rename", "set", atau "commit", SETTING_MODIFICATION akan ditetapkan. Jika kolom log EventName memiliki nilai lain, SETTING_UNCATEGORIZED akan ditetapkan. Jika kolom utama tidak ada, GENERIC_EVENT akan ditetapkan.
DNS	NETWORK_DNS

Langkah berikutnya

• Penyerapan data ke Google SecOps

Log Perubahan

Melihat Log Perubahan untuk parser ini

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.