Mengumpulkan log pemberitahuan Palo Alto Prisma Cloud

Didukung di:

Google SecOps SIEM

Parser ini mengekstrak log pemberitahuan dari Palo Alto Prisma Cloud dalam format JSON, lalu mengubahnya menjadi UDM. Parser melakukan normalisasi data, konversi jenis, dan logika kondisional untuk mengisi kolom UDM yang sesuai. Alat ini juga menangani struktur dan array JSON bertingkat dalam data log untuk mengekstrak informasi yang relevan. Informasi dalam dokumen ini berlaku untuk parser dengan label penyerapan PAN_PRISMA_CA.

Sebelum memulai

Pastikan Anda memiliki prasyarat berikut:

• Instance Google SecOps.
• Akses istimewa ke Palo Alto Prisma Cloud.

Menyiapkan feed

Untuk mengonfigurasi feed, ikuti langkah-langkah berikut:

1. Buka Setelan > Pengelolaan Data > Feed. Jika Anda menggunakan platform khusus SIEM, buka Settings > Feeds.
2. Klik Tambahkan Feed Berita Baru.
3. Di halaman berikutnya, klik Konfigurasi satu feed.
4. Di kolom Feed name, masukkan nama untuk feed; misalnya, PAN Prisma Cloud Alerts.
5. Pilih Webhook sebagai Jenis sumber.
6. Pilih Palo Alto Prisma Cloud Alerts payload sebagai Log type.
7. Klik Berikutnya.
8. Opsional: Tentukan nilai untuk parameter input berikut:
   • Pembatas pemisahan: pembatas yang digunakan untuk memisahkan baris log, seperti \n.
9. Klik Berikutnya.
10. Tinjau konfigurasi feed di layar Finalisasi, lalu klik Kirim.
11. Klik Buat Kunci Rahasia untuk membuat kunci rahasia guna mengautentikasi feed ini.
12. Salin dan simpan kunci rahasia. Anda tidak dapat melihat kunci rahasia ini lagi. Jika perlu, Anda dapat membuat ulang kunci rahasia baru, tetapi tindakan ini akan membuat kunci rahasia sebelumnya tidak berlaku lagi.
13. Dari tab Details, salin URL endpoint feed dari kolom Endpoint Information. Anda harus menentukan URL endpoint ini di aplikasi klien Anda.
14. Klik Done.

Membuat kunci API untuk feed webhook

1. Buka Google Cloud console > Credentials.

   Buka Kredensial

2. Klik Create credentials, lalu pilih API key.

3. Batasi akses kunci API ke Google Security Operations API.

Menentukan URL endpoint

1. Di aplikasi klien Anda, tentukan URL endpoint HTTPS yang disediakan di feed webhook.

2. Aktifkan autentikasi dengan menentukan kunci API dan kunci rahasia sebagai bagian dari header kustom dalam format berikut:

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   Rekomendasi: Tentukan kunci API sebagai header, bukan menentukannya di URL.

3. Jika klien webhook Anda tidak mendukung header kustom, Anda dapat menentukan kunci API dan kunci rahasia menggunakan parameter kueri dalam format berikut:

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

   Ganti kode berikut:

   • ENDPOINT_URL: URL endpoint feed.
   • API_KEY: kunci API untuk melakukan autentikasi ke Google Security Operations.
   • SECRET: kunci rahasia yang Anda buat untuk mengautentikasi feed.

Mengonfigurasi webhook Palo Alto Prisma Cloud ke Google SecOps

1. Login ke Palo Alto Prisma Cloud.
2. Pilih Setelan > Integrasi & Notifikasi ((and_then)) Integrasi.
3. Klik Add Integration.
4. Pilih Webhook.
5. Tentukan nilai untuk parameter input berikut:
   • Integration Name: Berikan nama yang unik dan deskriptif (misalnya, Google SecOps)
   • URL Webhook: Masukkan ENDPOINT_URL.
   • Opsional: Berikan Deskripsi integrasi.
   • Opsional: Aktifkan Custom Payload > klik Next untuk meninjau atau merevisi payload kustom.
6. Klik Berikutnya.
7. Test dan Save Integration.

Mengonfigurasi pemberitahuan Palo Alto Prisma Cloud

1. Di konsol Palo Alto Prisma Cloud, buka Alerts > View Alert Rules.
2. Pilih aturan pemberitahuan yang ada untuk diedit.
3. Opsional: Buat Pemberitahuan baru untuk Infrastruktur Cloud.
4. Opsional: Create new Alert for Cloud Workload.
5. Buka Configure Notifications.
6. Pilih Webhook.
7. Opsional: Pilih Saluran yang ingin Anda kirimi notifikasi pemberitahuan yang dipicu oleh aturan pemberitahuan.
8. Klik Berikutnya.
9. Klik Simpan.

Tabel pemetaan UDM

Tabel berikut mencantumkan kolom UDM yang dipetakan dari kolom log payload Palo Alto Prisma Cloud Alert:

Kolom log	pemetaan UDM
_id	metadata.product_log_id
account.cloudType	principal.resource.attribute.cloud.environment
account.id	additional.fields
account.name	additional.fields
account_id_body	target.user.userid
accountId	target.resource.product_object_id
accountIDs	additional.fields
accountName	target.resource.attribute.labels
accountOwners	principal.user.email_addresses, principal.user.attribute.labels
acknowledged	security_result.detection_fields
additionalInfo.*	security_result.detection_fields
aggregatedAlerts.*	about.resource.attribute.labels, target.resource.attribute.labels
aggregatedAlerts.accountIDs	target.resource.attribute.labels
aggregatedAlerts.clusters	target.resource.attribute.labels
aggregatedAlerts.collections	target.resource.attribute.labels
aggregatedAlerts.command	about.process.command_line
aggregatedAlerts.complianceIssues.*	security_result.detection_fields
aggregatedAlerts.container	about.resource.name
aggregatedAlerts.containerID	about.resource.product_object_id
aggregatedAlerts.forensics	about.url
aggregatedAlerts.fqdn	about.domain.name
aggregatedAlerts.host	about.hostname
aggregatedAlerts.labels.aadpodidbinding	about.resource.attribute.labels
aggregatedAlerts.labels.app_kubernetes.io_component	about.resource.attribute.labels
aggregatedAlerts.labels.app_kubernetes.io_part_of	about.resource.attribute.labels
aggregatedAlerts.labels.io.kubernetes.container.name	about.resource.attribute.labels
aggregatedAlerts.labels.io.kubernetes.pod.namespace	about.resource.attribute.labels
aggregatedAlerts.labels.io.kubernetes.pod.uid	about.resource.attribute.labels
aggregatedAlerts.labels.networking/gateway-ingress	about.resource.attribute.labels
aggregatedAlerts.labels.pod-template-hash	about.resource.attribute.labels
aggregatedAlerts.labels.product	about.resource.attribute.labels
aggregatedAlerts.labels.role	about.resource.attribute.labels
aggregatedAlerts.namespaces	target.resource.attribute.labels
aggregatedAlerts.region	about.resource.attribute.cloud.availability_zone
aggregatedAlerts.user	about.user.userid
aggregatedAlerts.vulnerabilities.accountIDs	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.clusters	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.collections	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.distribution	extensions.vulns.vulnerabilities.name
aggregatedAlerts.vulnerabilities.imageID	extensions.vulns.vulnerabilities.about.file.sha256
aggregatedAlerts.vulnerabilities.imageName	extensions.vulns.vulnerabilities.about.file.full_path
aggregatedAlerts.vulnerabilities.namespaces	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.cve	extensions.vulns.vulnerabilities.cve_id
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.link	extensions.vulns.vulnerabilities.about.url
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packages	target.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion	target.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.severity	extensions.vulns.vulnerabilities.severity, extensions.vulns.vulnerabilities.severity_details
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage	target.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.status	extensions.vulns.vulnerabilities.description
alarmType	principal.asset.attribute.cloud.environment, security_result.detection_fields
alertId	security_result.detection_fields
alertRemediationCli	security_result.detection_fields
alertRemediationCliDescription	security_result.detection_fields
alertRemediationImpact	security_result.detection_fields
alertRuleId	security_result.rule_id
alertRuleName	security_result.rule_name
alertStatus	security_result.detection_fields
alertTime	security_result.first_discovered_time
alertTs	security_result.first_discovered_time
App	principal.application
audits._id	additional.fields
audits.accountID	about.resource.attribute.labels
audits.attackTechniques	additional.fields
audits.attackType	security_result.threat_name, security_result.detection_fields
audits.cluster	about.resource.attribute.labels
audits.command	about.process.command_line
audits.container	additional.fields
audits.containerId	about.resource.attribute.labels
audits.containerName	about.resource.attribute.labels
audits.count	additional.fields
audits.effect	security_result.action_details, security_result.detection_fields
audits.hostname	about.hostname
audits.imageId	about.resource.attribute.labels
audits.imageName	about.resource.attribute.labels
audits.msg	metadata.description, about.resource.attribute.labels
audits.namespace	about.namespace
audits.os	about.platform_version
audits.pid	about.process.pid
audits.processPath	about.process.file.full_path
audits.profileId	about.resource.attribute.labels
audits.provider	about.resource.attribute.cloud.environment
audits.region	about.location.country_or_region
audits.ruleName	security_result.rule_name, security_result.detection_fields
audits.severity	security_result.severity, security_result.severity_details, security_result.detection_fields
audits.time	about.resource.attribute.labels
audits.type	metadata.product_event_type, about.resource.attribute.labels
audits.user	about.user.userid
body	additional.fields
callbackUrl	metadata.url_back_to_product
category	security_result.category_details
cluster	principal.resource.attribute.labels
clusters	additional.fields
cloudAccountGroups	target.user.group_identifiers
cloudAccountOwners	target.user.email_addresses, target.user.attribute.labels
cloudServiceName	target.resource.attribute.labels
cloudType	principal.resource.attribute.cloud.environment
collections	additional.fields
command	principal.process.command_line
complianceIssues.*	security_result.detection_fields
complianceIssues.category	security_result.category_details, security_result.detection_fields
complianceIssues.description	security_result.description, security_result.detection_fields
complianceIssues.id	security_result.detection_fields
complianceIssues.severity	security_result.severity, security_result.severity_details, security_result.detection_fields
complianceIssues.title	security_result.action_details, security_result.detection_fields
complianceIssues.type	security_result.detection_fields
complianceMetadata.*	security_result.detection_fields
container	target.resource.name
containerID	principal.asset.asset_id, target.resource.product_object_id
containerName	principal.resource.name
data.allocationId	principal.resource.product_object_id
data.attachments.*	additional.fields
data.createTime	target.resource.attribute.creation_time
data.publicIp	principal.ip, principal.asset.ip
data.*	additional.fields
deleted	additional.fields
description	metadata.description
dropped	security_result.detection_fields
email_add	principal.user.email_addresses
errorMessage	metadata.description
firstSeen	principal.asset.first_seen_time
forensics	security_result.url_back_to_product
fqdn	principal.domain.name
hasFinding	security_result.detection_fields
host	principal.hostname, principal.asset.hostname
hostname	principal.hostname, principal.asset.hostname
id	metadata.product_log_id
image	target.process.file.full_path
imageID	principal.process.file.sha256, target.process.file.sha256
imageName	principal.process.file.full_path
incidentTime	security_result.first_discovered_time
investigateOptions.*	security_result.detection_fields
labels	additional.fields
labels.aadpodidbinding	target.resource.attribute.labels
labels.app	target.application
labels.app_kubernetes.io_component	target.resource.attribute.labels
labels.app_kubernetes.io_part_of	target.resource.attribute.labels
labels.io.kubernetes.container.name	target.resource.attribute.labels
labels.io.kubernetes.pod.name	target.hostname, target.asset.hostname
labels.io.kubernetes.pod.namespace	target.resource.attribute.labels
labels.io.kubernetes.pod.uid	target.resource.attribute.labels
labels.networking/gateway-ingress	target.resource.attribute.labels
labels.owner	target.user.userid
labels.pod-template-hash	target.resource.attribute.labels
labels.product	target.resource.attribute.labels
labels.role	target.resource.attribute.labels
lastModifiedBy	principal.user.email_addresses
lastModifiedOn	security_result.detection_fields
lastSeen	principal.asset.first_discover_time
lastUpdated	security_result.detection_fields
message	security_result.description
msg_metadata.remediable	security_result.detection_fields
msg_metadata.saveSearchId	security_result.detection_fields
name	security_result.summary
namespace	principal.namespace
namespaces	additional.fields
notificationRuleName	security_result.rule_name
policy.complianceMetadata.*	security_result.detection_fields
policy.description	security_result.detection_fields
policy.deleted	additional.fields
policy.hasSearchExecutionSupport	security_result.detection_fields
policy.id	security_result.detection_fields
policy.lastModifiedBy	principal.user.email_addresses
policy.lastModifiedOn	security_result.detection_fields
policy.name	security_result.description
policy.policyId	security_result.detection_fields
policy.policyType	security_result.detection_fields
policy.policyTs	security_result.detection_fields
policy.recommendation	security_result.detection_fields
policy.remediable	security_result.detection_fields
policy.severity	security_result.severity, security_result.severity_details
policy.systemDefault	security_result.detection_fields
policyDescription	security_result.detection_fields
policyId	security_result.detection_fields
policyLabels	additional.fields
policyName	security_result.description
policyRecommendation	security_result.detection_fields
policyType	security_result.detection_fields
profileID	additional.fields
provider	target.resource.attribute.cloud.environment
reason	security_result.summary
recommendation	security_result.detection_fields
remediable	security_result.detection_fields
region	principal.location.country_or_region, principal.location.state, target.resource.attribute.cloud.availability_zone
resource.account	additional.fields
resource.accountId	target.resource.product_object_id, additional.fields
resource.additionalInfo.*	security_result.detection_fields
resource.cloudAccountGroups	target.user.group_identifiers
resource.cloudAccountOwners	target.user.email_addresses, target.user.attribute.labels
resource.cloudServiceName	target.resource.attribute.labels
resource.cloudType	principal.resource.attribute.cloud.environment, principal.resource.attribute.labels
resource.data.*	additional.fields
resource.data.addonsConfig.dnsCacheConfig.enabled	additional.fields
resource.data.addonsConfig.gcePersistentDiskCsiDriverConfig.enabled	additional.fields
resource.data.addonsConfig.gcpFilestoreCsiDriverConfig.enabled	additional.fields
resource.data.addonsConfig.gcsFuseCsiDriverConfig.enabled	additional.fields
resource.data.addonsConfig.kubernetesDashboard.disabled	additional.fields
resource.data.addonsConfig.networkPolicyConfig.disabled	additional.fields
resource.data.allowed.IPProtocol	additional.fields
resource.data.allowed.ports	additional.fields
resource.data.arn	principal.resource.attribute.labels
resource.data.attributes.access_logs.s3.enabled	additional.fields
resource.data.attributes.deletion_protection.enabled	additional.fields
resource.data.attributes.dns_record.client_routing_policy	additional.fields
resource.data.attributes.load_balancing.cross_zone.enabled	additional.fields
resource.data.attributes.secondary_ips.auto_assigned.per_subnet	additional.fields
resource.data.attributes.zonal_shift.config.enabled	additional.fields
resource.data.authenticatorGroupsConfig.enabled	target.group.attribute.labels
resource.data.authenticatorGroupsConfig.securityGroup	target.group.email_addresses
resource.data.authorizationRules.*	additional.fields
resource.data.authorizationRules.properties.rights	additional.fields
resource.data.autoscaling.autoscalingProfile	additional.fields
resource.data.availabilityZones.*	additional.fields
resource.data.blockDeviceMappings.deviceName	additional.fields
resource.data.blockDeviceMappings.ebs.*	additional.fields
resource.data.capacityReservationSpecification.capacityReservationPreference	additional.fields
resource.data.Command.*	additional.fields
resource.data.Command.ScriptLocation	target.process.file.full_path
resource.data.conditions.*	additional.fields
resource.data.controlPlaneEndpointsConfig.dnsEndpointConfig.*	additional.fields
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.*	additional.fields
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.authorizedNetworksConfig.privateEndpointEnforcementEnabled	additional.fields
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.privateEndpoint	target.ip, target.asset.ip
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.publicEndpoint	target.ip, target.asset.ip
resource.data.cpuOptions.coreCount	additional.fields
resource.data.cpuOptions.threadsPerCore	additional.fields
resource.data.createDate	principal.resource.attribute.labels
resource.data.createdDate	principal.resource.attribute.labels
resource.data.createdTime	target.resource.attribute.creation_time
resource.data.CreatedOn	target.resource.attribute.creation_time
resource.data.createTime	target.resource.attribute.creation_time
resource.data.creationTimestamp	principal.resource.attribute.labels
resource.data.databaseEncryption.*	additional.fields
resource.data.DefaultArguments.*	additional.fields
resource.data.defaultMaxPodsConstraint.maxPodsPerNode	additional.fields
resource.data.deleteRetentionPolicy.blob.*	additional.fields
resource.data.description	principal.resource.attribute.labels
resource.data.diagnosticSettings.*	additional.fields
resource.data.diagnosticSettings.properties.*	additional.fields
resource.data.diagnosticSettings.properties.logs.*	additional.fields
resource.data.diagnosticSettings.properties.metrics.*	additional.fields
resource.data.direction	principal.resource.attribute.labels, network.direction
resource.data.disks.*	additional.fields
resource.data.displayName	target.user.user_display_name
resource.data.document.Statement.*	additional.fields
resource.data.document.Statement.Action.*	additional.fields
resource.data.document.Statement.Resource.*	additional.fields
resource.data.document.Version	additional.fields
resource.data.enclaveOptions.enabled	additional.fields
resource.data.encryptionStatuses.*	additional.fields
resource.data.endpoint	target.ip, target.asset.ip
resource.data.enterpriseConfig.clusterTier	additional.fields
resource.data.entities.policyRoles.*	additional.fields
resource.data.ExecutionProperty.MaxConcurrentRuns	additional.fields
resource.data.hibernationOptions.configured	additional.fields
resource.data.id	principal.resource.attribute.labels
resource.data.identity.type	additional.fields
resource.data.instanceGroupUrls	additional.fields
resource.data.ipAllocationPolicy.*	target.resource.attribute.labels
resource.data.ipAllocationPolicy.networkTierConfig.networkTier	target.resource.attribute.labels
resource.data.kind	principal.resource.attribute.labels
resource.data.lastAccessedDate	principal.resource.attribute.labels
resource.data.lastChangedDate	principal.resource.attribute.labels
resource.data.listeners.*	additional.fields
resource.data.listeners.rules.*	additional.fields
resource.data.listeners.rules.actions.*	additional.fields
resource.data.listeners.rules.actions.forwardConfig.targetGroups.*	additional.fields
resource.data.loadBalancerName	target.resource.name
resource.data.location	principal.resource.attribute.labels
resource.data.locations	additional.fields
resource.data.logConfig.enable	additional.fields
resource.data.loggingConfig.componentConfig.enableComponents	additional.fields
resource.data.loggingProperties.blob.*	additional.fields
resource.data.loggingProperties.queue.*	additional.fields
resource.data.loggingProperties.table.*	additional.fields
resource.data.mail	target.user.email_addresses
resource.data.maintenancePolicy.resourceVersion	additional.fields
resource.data.maintenancePolicy.window.recurringWindow.recurrence	additional.fields
resource.data.maintenancePolicy.window.recurringWindow.window.endTime	additional.fields
resource.data.maintenancePolicy.window.recurringWindow.window.startTime	additional.fields
resource.data.masterAuth.clusterCaCertificate	additional.fields
resource.data.masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled	additional.fields
resource.data.metadata.items	additional.fields
resource.data.metadataOptions.*	additional.fields
resource.data.monitoring.state	additional.fields
resource.data.monitoringConfig.componentConfig.enableComponents	additional.fields
resource.data.monitoringConfig.managedPrometheusConfig.enabled	additional.fields
resource.data.msg_metadata.fingerprint	additional.fields
resource.data.msg_metadata.kind	additional.fields
resource.data.Name	target.resource.name
resource.data.name	principal.resource.attribute.labels
resource.data.network	principal.resource.attribute.labels
resource.data.networkConfig.*	additional.fields
resource.data.networkConfig.dnsConfig.clusterDns	additional.fields
resource.data.networkConfig.dnsConfig.clusterDnsScope	additional.fields
resource.data.networkConfig.gatewayApiConfig.channel	additional.fields
resource.data.networkInterfaces.*	additional.fields
resource.data.networkInterfaces.aliasIpRanges.*	additional.fields
resource.data.networkInterfaces.attachment.*	additional.fields
resource.data.networkInterfaces.groups.*	additional.fields
resource.data.networkInterfaces.macAddress	target.mac, target.asset.mac
resource.data.networkInterfaces.networkIP	target.ip, target.asset.ip
resource.data.networkInterfaces.operator.managed	additional.fields
resource.data.networkInterfaces.privateIpAddress	target.ip, target.asset.ip
resource.data.networkPerformanceOptions.bandwidthWeighting	additional.fields
resource.data.networkRuleSet.*	additional.fields
resource.data.networkRuleSet.properties.*	additional.fields
resource.data.nodeConfig.*	target.resource.attribute.labels
resource.data.nodeConfig.bootDisk.diskType	target.resource.attribute.labels
resource.data.nodeConfig.bootDisk.sizeGb	target.resource.attribute.labels
resource.data.nodeConfig.kubeletConfig.insecureKubeletReadonlyPortEnabled	target.resource.attribute.labels
resource.data.nodeConfig.kubeletConfig.maxParallelImagePulls	target.resource.attribute.labels
resource.data.nodeConfig.msg_metadata.disable-legacy-endpoints	target.resource.attribute.labels
resource.data.nodeConfig.nodeImageConfig.image	target.resource.attribute.labels
resource.data.nodeConfig.nodeImageConfig.imageProject	target.resource.attribute.labels
resource.data.nodeConfig.oauthScopes	target.resource.attribute.labels
resource.data.nodeConfig.resourceLabels.goog-gke-node-pool-provisioning-model	target.resource.attribute.labels
resource.data.nodeConfig.serviceAccount	target.user.email_addresses, target.user.userid
resource.data.nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring	target.resource.attribute.labels
resource.data.nodeConfig.tags	target.resource.attribute.labels
resource.data.nodeConfig.workloadMetadataConfig.mode	target.resource.attribute.labels
resource.data.nodePoolAutoConfig.networkTags.tags	additional.fields
resource.data.nodePoolAutoConfig.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled	additional.fields
resource.data.nodePoolDefaults.nodeConfigDefaults.loggingConfig.variantConfig.variant	additional.fields
resource.data.nodePoolDefaults.nodeConfigDefaults.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled	additional.fields
resource.data.nodePools.*	additional.fields
resource.data.nodePools.autoscaling.*	additional.fields
resource.data.nodePools.config.*	additional.fields
resource.data.nodePools.instanceGroupUrls	additional.fields
resource.data.nodePools.locations	additional.fields
resource.data.nodePools.management.*	additional.fields
resource.data.nodePools.maxPodsConstraint.*	additional.fields
resource.data.nodePools.networkConfig.*	additional.fields
resource.data.nodePools.upgradeSettings.*	additional.fields
resource.data.operator.hiddenByDefault	additional.fields
resource.data.operator.managed	additional.fields
resource.data.placement.*	additional.fields
resource.data.podAutoscaling.hpaProfile	additional.fields
resource.data.policyArn	principal.resource.attribute.labels
resource.data.policyName	principal.resource.attribute.labels
resource.data.privateClusterConfig.*	additional.fields
resource.data.privateDnsName	target.hostname, target.asset.hostname
resource.data.privateIpAddress	target.ip, target.asset.ip
resource.data.properties.*	additional.fields
resource.data.properties.aadProfile.enableAzureRBAC	additional.fields
resource.data.properties.aadProfile.managed	additional.fields
resource.data.properties.aadProfile.tenantID	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.enableSecretRotation	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.rotationPollInterval	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.enabled	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.clientId	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.objectId	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.resourceId	additional.fields
resource.data.properties.addonProfiles.azurepolicy.config.version	additional.fields
resource.data.properties.addonProfiles.azurepolicy.enabled	additional.fields
resource.data.properties.addonProfiles.azurepolicy.identity.clientId	additional.fields
resource.data.properties.addonProfiles.azurepolicy.identity.objectId	additional.fields
resource.data.properties.addonProfiles.azurepolicy.identity.resourceId	additional.fields
resource.data.properties.addonProfiles.omsagent.config.logAnalyticsWorkspaceResourceID	additional.fields
resource.data.properties.addonProfiles.omsagent.config.useAADAuth	additional.fields
resource.data.properties.addonProfiles.omsagent.enabled	additional.fields
resource.data.properties.addonProfiles.omsagent.identity.clientId	additional.fields
resource.data.properties.addonProfiles.omsagent.identity.objectId	additional.fields
resource.data.properties.addonProfiles.omsagent.identity.resourceId	additional.fields
resource.data.properties.agentPoolProfiles.*	additional.fields
resource.data.properties.agentPoolProfiles.availabilityZones	additional.fields
resource.data.properties.agentPoolProfiles.nodeLabels.nodepool	additional.fields
resource.data.properties.agentPoolProfiles.powerState.code	additional.fields
resource.data.properties.agentPoolProfiles.tags.*	additional.fields
resource.data.properties.apiServerAccessProfile.disableRunCommand	additional.fields
resource.data.properties.apiServerAccessProfile.enablePrivateCluster	additional.fields
resource.data.properties.apiServerAccessProfile.enablePrivateClusterPublicFQDN	additional.fields
resource.data.properties.apiServerAccessProfile.privateDNSZone	additional.fields
resource.data.properties.autoScalerProfile.*	additional.fields
resource.data.properties.autoUpgradeProfile.upgradeChannel	additional.fields
resource.data.properties.httpProxyConfig.effectiveNoProxy	additional.fields
resource.data.properties.httpProxyConfig.httpProxy	additional.fields
resource.data.properties.httpProxyConfig.httpsProxy	additional.fields
resource.data.properties.httpProxyConfig.noProxy	additional.fields
resource.data.properties.httpProxyConfig.trustedCa	additional.fields
resource.data.properties.identityProfile.kubeletidentity.*	additional.fields
resource.data.properties.linuxProfile.adminUsername	additional.fields
resource.data.properties.linuxProfile.ssh.publicKeys.*	additional.fields
resource.data.properties.networkProfile.*	target.resource.attribute.labels
resource.data.properties.networkProfile.dnsServiceIP	target.ip, target.asset.ip
resource.data.properties.networkProfile.ipFamilies	target.resource.attribute.labels
resource.data.properties.networkProfile.serviceCidrs	target.resource.attribute.labels
resource.data.properties.powerState.code	additional.fields
resource.data.properties.principalId	target.user.product_object_id
resource.data.properties.privateFQDN	target.hostname, target.asset.hostname
resource.data.properties.privateLinkResources.*	additional.fields
resource.data.properties.privateLinkResources.requiredMembers	additional.fields
resource.data.properties.roleDefinition.*	additional.fields
resource.data.properties.roleDefinition.properties.*	additional.fields
resource.data.properties.roleDefinition.properties.assignableScopes	additional.fields
resource.data.properties.roleDefinition.properties.permissions.actions	additional.fields
resource.data.properties.roleDefinition.properties.permissions.notActions	additional.fields
resource.data.properties.servicePrincipalProfile.clientId	additional.fields
resource.data.properties.storageProfile.diskCSIDriver.enabled	additional.fields
resource.data.properties.storageProfile.fileCSIDriver.enabled	additional.fields
resource.data.properties.storageProfile.snapshotController.enabled	additional.fields
resource.data.properties.windowsProfile.adminUsername	additional.fields
resource.data.properties.windowsProfile.enableCSIProxy	additional.fields
resource.data.rbacBindingConfig.enableInsecureBindingSystemAuthenticated	additional.fields
resource.data.rbacBindingConfig.enableInsecureBindingSystemUnauthenticated	additional.fields
resource.data.releaseChannel.channel	additional.fields
resource.data.resourceGroup	principal.resource.attribute.labels
resource.data.resourceLabels.gke-cluster	additional.fields
resource.data.resourceLabels.goog-terraform-provisioned	additional.fields
resource.data.roles	target.user.attribute.roles.name
resource.data.scheduling.automaticRestart	additional.fields
resource.data.scheduling.onHostMaintenance	additional.fields
resource.data.scheduling.preemptible	additional.fields
resource.data.secretVersionsToStages.terraform-20260122172341570100000002	principal.resource.attribute.labels
resource.data.securityPostureConfig.mode	security_result.detection_fields
resource.data.securityPostureConfig.vulnerabilityMode	security_result.detection_fields
resource.data.selfLink	principal.resource.attribute.labels
resource.data.shareDeleteRetentionPolicy.file.*	additional.fields
resource.data.shieldedInstanceConfig.enableIntegrityMonitoring	additional.fields
resource.data.shieldedInstanceConfig.enableSecureBoot	additional.fields
resource.data.shieldedInstanceConfig.enableVtpm	additional.fields
resource.data.shieldedInstanceIntegrityPolicy.updateAutoLearnPolicy	additional.fields
resource.data.sku.*	additional.fields
resource.data.sourceRanges	security_result.about.ip
resource.data.state.code	additional.fields
resource.data.state.name	additional.fields
resource.data.tags	additional.fields
resource.data.tags.*	additional.fields
resource.data.tags.Creator	target.user.email_addresses, target.user.userid
resource.data.tags.Email	target.user.email_addresses, target.user.userid
resource.data.tags.items	additional.fields
resource.data.targetGroups.*	target.resource.attribute.labels
resource.data.targetGroups.loadBalancerArns	target.resource.attribute.labels
resource.data.targetTags	additional.fields
resource.data.type	principal.resource.attribute.labels
resource.data.user	target.user.email_addresses, target.user.userid
resource.data.userPrincipalName	target.user.userid
resource.data.versionId	principal.resource.attribute.labels
resource.data.workloadIdentityConfig.workloadPool	additional.fields
resource.data.dnsname	target.hostname, target.asset.hostname
resource.id	principal.resource.product_object_id, additional.fields
resource.name	principal.resource.name, additional.fields
resource.region	principal.location.country_or_region, principal.location.state, additional.fields
resource.regionId	principal.resource.attribute.cloud.availability_zone, principal.location.country_or_region, additional.fields
resource.resourceApiName	target.resource.attribute.labels
resource.resourceConfigJsonAvailable	additional.fields
resource.resourceDetailsAvailable	additional.fields
resource.resourceId	principal.resource.product_object_id
resource.resourceName	principal.resource.name
resource.resourceTags.*	principal.resource.attribute.labels
resource.resourceTs	metadata.event_timestamp
resource.resourceType	target.resource.resource_subtype, additional.fields
resource.rrn	target.resource.attribute.labels
resource.unifiedAssetId	principal.asset.asset_id
resource.url	principal.url
resourceCloudService	principal.resource.attribute.labels
resourceConfigJsonAvailable	additional.fields
resourceDetailsAvailable	additional.fields
resourceId	principal.resource.product_object_id
resourceName	principal.resource.name
resourceRegion	principal.location.country_or_region
resourceRegionId	principal.resource.attribute.cloud.availability_zone
resourceType	target.resource.resource_subtype
rrn	target.resource.name
saveSearchId	security_result.detection_fields
sender	metadata.description
sentTs	metadata.event_timestamp
serialNum	additional.fields
service	observer.application
severity	security_result.severity, security_result.severity_details
shouldCollect	additional.fields
source	principal.application
source_type	metadata.product_event_type
startupProcess	principal.process.parent_process.command_line
status	security_result.detection_fields
systemDefault	additional.fields
tags	principal.resource.attribute.labels
time	metadata.event_timestamp
title	additional.fields
type	principal.resource.resource_subtype, security_result.category_details
unifiedAssetId	principal.asset.asset_id
url	security_result.url_back_to_product
user	principal.user.userid
vulnerabilities.accountIDs	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.clusters	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.collections	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.distribution	extensions.vulns.vulnerabilities.name
vulnerabilities.imageID	extensions.vulns.vulnerabilities.about.file.sha256
vulnerabilities.imageName	extensions.vulns.vulnerabilities.about.file.full_path
vulnerabilities.namespaces	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.cve	extensions.vulns.vulnerabilities.cve_id
vulnerabilities.newVulnerabilities.vulnerabilities.link	extensions.vulns.vulnerabilities.about.url
vulnerabilities.newVulnerabilities.vulnerabilities.packages	target.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion	target.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.severity	extensions.vulns.vulnerabilities.severity, extensions.vulns.vulnerabilities.severity_details
vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage	target.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.status	extensions.vulns.vulnerabilities.description

Referensi delta pemetaan UDM

Pada 15 September 2026, Google SecOps merilis versi baru parser payload Palo Alto Prisma Cloud Alert, yang mencakup perubahan signifikan pada pemetaan kolom log payload Palo Alto Prisma Cloud Alert ke kolom UDM.

Delta pemetaan kolom log

Tabel berikut mencantumkan delta pemetaan untuk kolom log payload Pemberitahuan Palo Alto Prisma Cloud ke UDM yang diekspos sebelum 15 September 2026 dan setelahnya (masing-masing tercantum dalam kolom Pemetaan lama dan Pemetaan saat ini):

Kolom log	Pemetaan lama	Pemetaan saat ini	Alasan perubahan
_id	additional.fields	metadata.product_log_id	Dipetakan ke ID log produk untuk identifikasi peristiwa yang berbeda.
account.cloudType	principal.cloud.environment	principal.resource.attribute.cloud.environment	Menyelaraskan kembali konteks lingkungan cloud dengan atribut resource.
accountId	target.resource.id, target.resource.product_object_id	target.resource.product_object_id	Target ID akun cloud standar.
accountId	target1.cloud.project.id	target.resource.product_object_id	Menghapus pemetaan entity target1 yang tidak digunakan lagi.
aggregatedAlerts.category	security_result.category_details	about.resource.attribute.labels	Memindahkan atribut kategori umum ke label resource about.
aggregatedAlerts.command	principal.process.command_line, security_result.detection_fields	about.process.command_line	Detail eksekusi proses gabungan di bagian about.process.
aggregatedAlerts.complianceIssues.category	security_result.category_details	security_result.detection_fields	Metadata kepatuhan yang dipertahankan di kolom deteksi.
aggregatedAlerts.complianceIssues.description	security_result.description, security_result.detection_fields	security_result.detection_fields	Pemetaan deskripsi yang disederhanakan untuk mencegah kolom yang berlebihan.
aggregatedAlerts.complianceIssues.severity	security_result.severity, severity_details, security_result.detection_fields	security_result.detection_fields	Pelacakan tingkat keparahan kepatuhan standar di kolom deteksi.
aggregatedAlerts.complianceIssues.title	security_result.action_details, security_result.detection_fields	security_result.detection_fields	Metadata judul digabungkan ke dalam kolom deteksi.
aggregatedAlerts.container	target.resource.name	about.resource.name	Detail penampung yang dialihkan dari target ke konteks about.
aggregatedAlerts.containerID	target.resource.product_object_id	about.resource.product_object_id	Menyelaraskan kembali pemetaan ID penampung ke atribut resource about.
aggregatedAlerts.forensics	principal.url	about.url	Target link forensik diperbarui ke about.url.
aggregatedAlerts.fqdn	principal.domain.name	about.domain.name	Memperbaiki pemetaan konteks domain.
aggregatedAlerts.host	principal.hostname	about.hostname	Mengalihkan konteks entity host ke about.hostname.
aggregatedAlerts.message	security_result.description	about.resource.attribute.labels	Memindahkan string pesan mentah ke key-value pair label.
aggregatedAlerts.region	target.cloud.availability_zone	about.resource.attribute.cloud.availability_zone	Memperbarui pemetaan atribut region cloud.
aggregatedAlerts.rule	security_result.rule_name	about.resource.attribute.labels	Memindahkan referensi aturan gabungan ke label resource.
aggregatedAlerts.startupProcess	principal.process.parent_process.command_line	about.resource.attribute.labels	Mengklasifikasikan ulang detail proses startup ke label resource.
aggregatedAlerts.time	metadata.event_timestamp	about.resource.attribute.labels	Mempertahankan stempel waktu pemberitahuan mentah di label resource.
aggregatedAlerts.type	security_result.category_details	about.resource.attribute.labels	Mengklasifikasikan ulang jenis pemberitahuan ke dalam label resource.
aggregatedAlerts.user	principal.user.userid	about.user.userid	Menyelaraskan kembali referensi entitas pengguna ke about.user.
alertTs	security_result.detection_fields	security_result.first_discovered_time	Memperbaiki kolom target stempel waktu deteksi.
audits.attackType	security_result.threat_name	security_result.threat_name, security_result.detection_fields	Menambahkan pemetaan sekunder ke kolom deteksi.
audits.command	principal.process.command_line	about.process.command_line	Target command line proses dialihkan ke about.
audits.effect	security_result.action_details	security_result.action_details, security_result.detection_fields	Menambahkan pemetaan sekunder ke kolom deteksi.
audits.msg	metadata.description	metadata.description, about.resource.attribute.labels	Memperluas pelacakan pesan audit ke label resource.
audits.os	principal.platform_version	about.platform_version	Memperbaiki target platform sistem operasi.
audits.pid	principal.process.pid	about.process.pid	Menyelaraskan kembali pemetaan ID proses ke about.process.
audits.processPath	principal.process.file.full_path	about.process.file.full_path	Menyelaraskan kembali jalur file yang dapat dieksekusi proses ke about.process.
audits.ruleName	security_result.rule_name	security_result.rule_name, security_result.detection_fields	Nama aturan yang dipertahankan di seluruh kolom hasil keamanan dan deteksi.
audits.severity	security_result.severity	security_result.severity, security_result.detection_fields	Mempertahankan tingkat keparahan audit di seluruh kolom hasil dan deteksi keamanan.
audits.type	metadata.product_event_type	metadata.product_event_type, about.resource.attribute.labels	Menambahkan jenis peristiwa ke label resource untuk pemfilteran yang lebih baik.
audits.user	principal.user.userid	about.user.userid	Menyelaraskan kembali ID pengguna audit ke about.user.
cloudType	principal.cloud.environment	principal.resource.attribute.cloud.environment	Memperbarui target lingkungan cloud root.
complianceMetadata.requirementId	security_result.rule_id	security_result.detection_fields	Memindahkan ID persyaratan kepatuhan ke kolom deteksi.
complianceMetadata.requirementName	security_result.summary	security_result.detection_fields	Memindahkan nama persyaratan kepatuhan ke kolom deteksi.
complianceMetadata.standardName	security_result.rule_name	security_result.detection_fields	Memindahkan nama standar kepatuhan ke kolom deteksi.
containerName	principal.application, principal.resource.name	principal.resource.name	Menghapus pemetaan entitas aplikasi yang ambigu.
imageID	principal.resource.attribute.labels	principal.process.file.sha256	Memetakan hash image container langsung ke SHA256 proses.
imageName	principal.resource.attribute.labels	principal.process.file.full_path	Nama image container yang dipetakan ke jalur file proses.
policy.complianceMetadata.requirementId	security_result.rule_id	security_result.detection_fields	Memindahkan ID persyaratan kepatuhan kebijakan ke kolom deteksi.
policy.complianceMetadata.requirementName	security_result.summary	security_result.detection_fields	Memindahkan nama persyaratan kepatuhan kebijakan ke kolom deteksi.
policy.complianceMetadata.standardName	security_result.rule_name	security_result.detection_fields	Memindahkan nama standar kepatuhan kebijakan ke kolom deteksi.
provider	target.resource.attribute.labels	target.resource.attribute.cloud.environment	Konteks lingkungan penyedia cloud standar.
resource.account	target.resource.product_object_id	additional.fields	Memindahkan string akun umum ke kolom tambahan.
resource.accountId	target.resource.id, target.resource.product_object_id	target.resource.product_object_id	Pemetaan ID akun fasilitas yang terstandardisasi.
resource.accountId	target1.cloud.project.id	target.resource.product_object_id	Menghapus referensi entity target1 lama.
resource.cloudAccountGroups	principal.resource.attribute.labels	target.user.group_identifiers	Memperbaiki pemetaan grup akun ke ID grup pengguna.
resource.cloudType	principal.cloud.environment	principal.resource.attribute.cloud.environment	Atribut lingkungan cloud resource yang distandardisasi.
resource.data.isAttached	security_result.detection_fields	additional.fields	Memindahkan flag status resource ke kolom tambahan.
resource.data.isDefaultVersion	security_result.detection_fields	additional.fields	Memindahkan flag versi ke kolom tambahan.
resource.data.isPermissionBoundarySet	security_result.detection_fields	additional.fields	Memindahkan tanda izin ke kolom tambahan.
resource.resourceApiName	principal.resource.attribute.labels	target.resource.attribute.labels	Menyelaraskan kembali label API resource ke resource target.
resource.resourceId	principal.resource.attribute.labels	principal.resource.product_object_id	ID resource yang dipromosikan ke ID objek produk.
resource.resourceName	principal.resource.attribute.labels	principal.resource.name	Nama resource yang dipromosikan ke nama resource UDM native.
resource.resourceTs	principal.resource.attribute.labels	metadata.event_timestamp	Memperbaiki kolom ekstraksi sumber stempel waktu peristiwa.
resource.rrn	principal.resource.attribute.labels	target.resource.attribute.labels	Menyelaraskan kembali RRN resource ke label target.
resourceRegionId	principal.cloud.availability_zone	principal.resource.attribute.cloud.availability_zone	Menyelaraskan kembali ID wilayah cloud dengan atribut resource.
resourceType	principal.resource.resource_subtype	target.resource.resource_subtype	Subjenis resource target yang distandardisasi.
type	principal.resource.type	principal.resource.resource_subtype	String jenis yang dipetakan ke subjenis resource.

Log Perubahan

Melihat Log Perubahan untuk parser ini

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.