Recopila registros de alertas de Palo Alto Prisma Cloud
Compatible con:
Google SecOps
SIEM
Este analizador extrae registros de alertas de Palo Alto Prisma Cloud en formato JSON y los transforma en el UDM. El analizador realiza la normalización de datos, las conversiones de tipos y la lógica condicional para completar los campos de UDM adecuados. También controla las estructuras y los arrays de JSON anidados dentro de los datos de registro para extraer información relevante. La información de este documento se aplica al analizador con la etiqueta de transferencia PAN_PRISMA_CA.
Antes de comenzar
Asegúrate de cumplir con los siguientes requisitos previos:
- Instancia de Google SecOps.
- Acceso privilegiado a Palo Alto Prisma Cloud
Configura feeds
Para configurar un feed, sigue estos pasos:
- Ve a Configuración > Administración de datos > Feeds. Si estás en una plataforma solo de SIEM, ve a Configuración > Feeds.
- Haz clic en Agregar feed nuevo.
- En la página siguiente, haz clic en Configurar un solo feed.
- En el campo Nombre del feed, ingresa un nombre para el feed, por ejemplo, Alertas de PAN Prisma Cloud.
- Selecciona Webhook como el Tipo de origen.
- Selecciona Carga útil de alertas de Palo Alto Prisma Cloud como el Tipo de registro.
- Haz clic en Siguiente.
- Opcional: Especifica valores para los siguientes parámetros de entrada:
- Delimitador de división: Es el delimitador que se usa para separar las líneas de registro, como
\n.
- Delimitador de división: Es el delimitador que se usa para separar las líneas de registro, como
- Haz clic en Siguiente.
- Revisa la configuración del feed en la pantalla Finalizar y, luego, haz clic en Enviar.
- Haz clic en Generar clave secreta para generar una clave secreta que autentique este feed.
- Copia y almacena la clave secreta. No puedes volver a ver esta clave secreta. Si es necesario, puedes volver a generar una clave secreta nueva, pero esta acción hará que la clave secreta anterior quede obsoleta.
- En la pestaña Detalles, copia la URL del extremo del feed del campo Información del extremo. Debes especificar esta URL de extremo en tu aplicación cliente.
- Haz clic en Listo.
Crea una clave de API para el feed de webhook
Ve a la consola de Google Cloud > Credenciales.
Haz clic en Crear credenciales y selecciona Clave de API.
Restringe el acceso de la clave de API a la API de Google Security Operations.
Especifica la URL del extremo
- En tu aplicación cliente, especifica la URL del extremo HTTPS que se proporciona en el feed de webhook.
Para habilitar la autenticación, especifica la clave de API y la clave secreta como parte del encabezado personalizado en el siguiente formato:
X-goog-api-key = API_KEY X-Webhook-Access-Key = SECRETRecomendación: Especifica la clave de API como un encabezado en lugar de especificarla en la URL.
Si tu cliente de webhook no admite encabezados personalizados, puedes especificar la clave de API y la clave secreta con parámetros de consulta en el siguiente formato:
ENDPOINT_URL?key=API_KEY&secret=SECRETReemplaza lo siguiente:
ENDPOINT_URL: Es la URL del extremo del feed.API_KEY: Es la clave de API para autenticarse en Google Security Operations.SECRET: Es la clave secreta que generaste para autenticar el feed.
Configura el webhook de Palo Alto Prisma Cloud para Google SecOps
- Accede a Palo Alto Prisma Cloud.
- Selecciona Configuración > Integraciones y notificaciones ((and_then)) Integraciones.
- Haz clic en Agregar integración.
- Selecciona Webhook.
- Especifica valores para los siguientes parámetros de entrada:
- Nombre de la integración: Proporciona un nombre único y descriptivo (por ejemplo, Google SecOps).
- URL de webhook: Ingresa la ENDPOINT_URL.
- Opcional: Proporciona una Descripción de la integración.
- Opcional: Habilita Carga útil personalizada > haz clic en Siguiente para revisar o modificar la carga útil personalizada.
- Haz clic en Siguiente.
- Prueba y guarda la integración.
Configura alertas de Prisma Cloud de Palo Alto
- En la consola de Palo Alto Prisma Cloud, ve a Alertas > Ver reglas de alerta.
- Selecciona una regla de alerta existente para editarla.
- Opcional: Crea una alerta nueva para infraestructura de nube.
- Opcional: Crea una alerta nueva para la carga de trabajo de Cloud.
- Ve a Configurar las notificaciones.
- Selecciona Webhook.
- Opcional: Selecciona los canales a los que quieres enviar notificaciones de las alertas que activa la regla de alerta.
- Haz clic en Siguiente.
- Haz clic en Guardar.
Tabla de asignación de UDM
En la siguiente tabla, se enumeran los campos de UDM asignados a partir de los campos de registro de la carga útil de alertas de Palo Alto Prisma Cloud:
| Campo de registro | Asignación de UDM |
|---|---|
_id |
metadata.product_log_id |
account.cloudType |
principal.resource.attribute.cloud.environment |
account.id |
additional.fields |
account.name |
additional.fields |
account_id_body |
target.user.userid |
accountId |
target.resource.product_object_id |
accountIDs |
additional.fields |
accountName |
target.resource.attribute.labels |
accountOwners |
principal.user.email_addresses,principal.user.attribute.labels |
acknowledged |
security_result.detection_fields |
additionalInfo.* |
security_result.detection_fields |
aggregatedAlerts.* |
about.resource.attribute.labels,target.resource.attribute.labels |
aggregatedAlerts.accountIDs |
target.resource.attribute.labels |
aggregatedAlerts.clusters |
target.resource.attribute.labels |
aggregatedAlerts.collections |
target.resource.attribute.labels |
aggregatedAlerts.command |
about.process.command_line |
aggregatedAlerts.complianceIssues.* |
security_result.detection_fields |
aggregatedAlerts.container |
about.resource.name |
aggregatedAlerts.containerID |
about.resource.product_object_id |
aggregatedAlerts.forensics |
about.url |
aggregatedAlerts.fqdn |
about.domain.name |
aggregatedAlerts.host |
about.hostname |
aggregatedAlerts.labels.aadpodidbinding |
about.resource.attribute.labels |
aggregatedAlerts.labels.app_kubernetes.io_component |
about.resource.attribute.labels |
aggregatedAlerts.labels.app_kubernetes.io_part_of |
about.resource.attribute.labels |
aggregatedAlerts.labels.io.kubernetes.container.name |
about.resource.attribute.labels |
aggregatedAlerts.labels.io.kubernetes.pod.namespace |
about.resource.attribute.labels |
aggregatedAlerts.labels.io.kubernetes.pod.uid |
about.resource.attribute.labels |
aggregatedAlerts.labels.networking/gateway-ingress |
about.resource.attribute.labels |
aggregatedAlerts.labels.pod-template-hash |
about.resource.attribute.labels |
aggregatedAlerts.labels.product |
about.resource.attribute.labels |
aggregatedAlerts.labels.role |
about.resource.attribute.labels |
aggregatedAlerts.namespaces |
target.resource.attribute.labels |
aggregatedAlerts.region |
about.resource.attribute.cloud.availability_zone |
aggregatedAlerts.user |
about.user.userid |
aggregatedAlerts.vulnerabilities.accountIDs |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.clusters |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.collections |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.distribution |
extensions.vulns.vulnerabilities.name |
aggregatedAlerts.vulnerabilities.imageID |
extensions.vulns.vulnerabilities.about.file.sha256 |
aggregatedAlerts.vulnerabilities.imageName |
extensions.vulns.vulnerabilities.about.file.full_path |
aggregatedAlerts.vulnerabilities.namespaces |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.cve |
extensions.vulns.vulnerabilities.cve_id |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.link |
extensions.vulns.vulnerabilities.about.url |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packages |
target.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion |
target.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.severity |
extensions.vulns.vulnerabilities.severity,extensions.vulns.vulnerabilities.severity_details |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage |
target.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.status |
extensions.vulns.vulnerabilities.description |
alarmType |
principal.asset.attribute.cloud.environment,security_result.detection_fields |
alertId |
security_result.detection_fields |
alertRemediationCli |
security_result.detection_fields |
alertRemediationCliDescription |
security_result.detection_fields |
alertRemediationImpact |
security_result.detection_fields |
alertRuleId |
security_result.rule_id |
alertRuleName |
security_result.rule_name |
alertStatus |
security_result.detection_fields |
alertTime |
security_result.first_discovered_time |
alertTs |
security_result.first_discovered_time |
App |
principal.application |
audits._id |
additional.fields |
audits.accountID |
about.resource.attribute.labels |
audits.attackTechniques |
additional.fields |
audits.attackType |
security_result.threat_name,security_result.detection_fields |
audits.cluster |
about.resource.attribute.labels |
audits.command |
about.process.command_line |
audits.container |
additional.fields |
audits.containerId |
about.resource.attribute.labels |
audits.containerName |
about.resource.attribute.labels |
audits.count |
additional.fields |
audits.effect |
security_result.action_details,security_result.detection_fields |
audits.hostname |
about.hostname |
audits.imageId |
about.resource.attribute.labels |
audits.imageName |
about.resource.attribute.labels |
audits.msg |
metadata.description,about.resource.attribute.labels |
audits.namespace |
about.namespace |
audits.os |
about.platform_version |
audits.pid |
about.process.pid |
audits.processPath |
about.process.file.full_path |
audits.profileId |
about.resource.attribute.labels |
audits.provider |
about.resource.attribute.cloud.environment |
audits.region |
about.location.country_or_region |
audits.ruleName |
security_result.rule_name,security_result.detection_fields |
audits.severity |
security_result.severity,security_result.severity_details,security_result.detection_fields |
audits.time |
about.resource.attribute.labels |
audits.type |
metadata.product_event_type,about.resource.attribute.labels |
audits.user |
about.user.userid |
body |
additional.fields |
callbackUrl |
metadata.url_back_to_product |
category |
security_result.category_details |
cluster |
principal.resource.attribute.labels |
clusters |
additional.fields |
cloudAccountGroups |
target.user.group_identifiers |
cloudAccountOwners |
target.user.email_addresses,target.user.attribute.labels |
cloudServiceName |
target.resource.attribute.labels |
cloudType |
principal.resource.attribute.cloud.environment |
collections |
additional.fields |
command |
principal.process.command_line |
complianceIssues.* |
security_result.detection_fields |
complianceIssues.category |
security_result.category_details,security_result.detection_fields |
complianceIssues.description |
security_result.description,security_result.detection_fields |
complianceIssues.id |
security_result.detection_fields |
complianceIssues.severity |
security_result.severity,security_result.severity_details,security_result.detection_fields |
complianceIssues.title |
security_result.action_details,security_result.detection_fields |
complianceIssues.type |
security_result.detection_fields |
complianceMetadata.* |
security_result.detection_fields |
container |
target.resource.name |
containerID |
principal.asset.asset_id,target.resource.product_object_id |
containerName |
principal.resource.name |
data.allocationId |
principal.resource.product_object_id |
data.attachments.* |
additional.fields |
data.createTime |
target.resource.attribute.creation_time |
data.publicIp |
principal.ip,principal.asset.ip |
data.* |
additional.fields |
deleted |
additional.fields |
description |
metadata.description |
dropped |
security_result.detection_fields |
email_add |
principal.user.email_addresses |
errorMessage |
metadata.description |
firstSeen |
principal.asset.first_seen_time |
forensics |
security_result.url_back_to_product |
fqdn |
principal.domain.name |
hasFinding |
security_result.detection_fields |
host |
principal.hostname,principal.asset.hostname |
hostname |
principal.hostname,principal.asset.hostname |
id |
metadata.product_log_id |
image |
target.process.file.full_path |
imageID |
principal.process.file.sha256,target.process.file.sha256 |
imageName |
principal.process.file.full_path |
incidentTime |
security_result.first_discovered_time |
investigateOptions.* |
security_result.detection_fields |
labels |
additional.fields |
labels.aadpodidbinding |
target.resource.attribute.labels |
labels.app |
target.application |
labels.app_kubernetes.io_component |
target.resource.attribute.labels |
labels.app_kubernetes.io_part_of |
target.resource.attribute.labels |
labels.io.kubernetes.container.name |
target.resource.attribute.labels |
labels.io.kubernetes.pod.name |
target.hostname,target.asset.hostname |
labels.io.kubernetes.pod.namespace |
target.resource.attribute.labels |
labels.io.kubernetes.pod.uid |
target.resource.attribute.labels |
labels.networking/gateway-ingress |
target.resource.attribute.labels |
labels.owner |
target.user.userid |
labels.pod-template-hash |
target.resource.attribute.labels |
labels.product |
target.resource.attribute.labels |
labels.role |
target.resource.attribute.labels |
lastModifiedBy |
principal.user.email_addresses |
lastModifiedOn |
security_result.detection_fields |
lastSeen |
principal.asset.first_discover_time |
lastUpdated |
security_result.detection_fields |
message |
security_result.description |
msg_metadata.remediable |
security_result.detection_fields |
msg_metadata.saveSearchId |
security_result.detection_fields |
name |
security_result.summary |
namespace |
principal.namespace |
namespaces |
additional.fields |
notificationRuleName |
security_result.rule_name |
policy.complianceMetadata.* |
security_result.detection_fields |
policy.description |
security_result.detection_fields |
policy.deleted |
additional.fields |
policy.hasSearchExecutionSupport |
security_result.detection_fields |
policy.id |
security_result.detection_fields |
policy.lastModifiedBy |
principal.user.email_addresses |
policy.lastModifiedOn |
security_result.detection_fields |
policy.name |
security_result.description |
policy.policyId |
security_result.detection_fields |
policy.policyType |
security_result.detection_fields |
policy.policyTs |
security_result.detection_fields |
policy.recommendation |
security_result.detection_fields |
policy.remediable |
security_result.detection_fields |
policy.severity |
security_result.severity,security_result.severity_details |
policy.systemDefault |
security_result.detection_fields |
policyDescription |
security_result.detection_fields |
policyId |
security_result.detection_fields |
policyLabels |
additional.fields |
policyName |
security_result.description |
policyRecommendation |
security_result.detection_fields |
policyType |
security_result.detection_fields |
profileID |
additional.fields |
provider |
target.resource.attribute.cloud.environment |
reason |
security_result.summary |
recommendation |
security_result.detection_fields |
remediable |
security_result.detection_fields |
region |
principal.location.country_or_region,principal.location.state,target.resource.attribute.cloud.availability_zone |
resource.account |
additional.fields |
resource.accountId |
target.resource.product_object_id,additional.fields |
resource.additionalInfo.* |
security_result.detection_fields |
resource.cloudAccountGroups |
target.user.group_identifiers |
resource.cloudAccountOwners |
target.user.email_addresses,target.user.attribute.labels |
resource.cloudServiceName |
target.resource.attribute.labels |
resource.cloudType |
principal.resource.attribute.cloud.environment,principal.resource.attribute.labels |
resource.data.* |
additional.fields |
resource.data.addonsConfig.dnsCacheConfig.enabled |
additional.fields |
resource.data.addonsConfig.gcePersistentDiskCsiDriverConfig.enabled |
additional.fields |
resource.data.addonsConfig.gcpFilestoreCsiDriverConfig.enabled |
additional.fields |
resource.data.addonsConfig.gcsFuseCsiDriverConfig.enabled |
additional.fields |
resource.data.addonsConfig.kubernetesDashboard.disabled |
additional.fields |
resource.data.addonsConfig.networkPolicyConfig.disabled |
additional.fields |
resource.data.allowed.IPProtocol |
additional.fields |
resource.data.allowed.ports |
additional.fields |
resource.data.arn |
principal.resource.attribute.labels |
resource.data.attributes.access_logs.s3.enabled |
additional.fields |
resource.data.attributes.deletion_protection.enabled |
additional.fields |
resource.data.attributes.dns_record.client_routing_policy |
additional.fields |
resource.data.attributes.load_balancing.cross_zone.enabled |
additional.fields |
resource.data.attributes.secondary_ips.auto_assigned.per_subnet |
additional.fields |
resource.data.attributes.zonal_shift.config.enabled |
additional.fields |
resource.data.authenticatorGroupsConfig.enabled |
target.group.attribute.labels |
resource.data.authenticatorGroupsConfig.securityGroup |
target.group.email_addresses |
resource.data.authorizationRules.* |
additional.fields |
resource.data.authorizationRules.properties.rights |
additional.fields |
resource.data.autoscaling.autoscalingProfile |
additional.fields |
resource.data.availabilityZones.* |
additional.fields |
resource.data.blockDeviceMappings.deviceName |
additional.fields |
resource.data.blockDeviceMappings.ebs.* |
additional.fields |
resource.data.capacityReservationSpecification.capacityReservationPreference |
additional.fields |
resource.data.Command.* |
additional.fields |
resource.data.Command.ScriptLocation |
target.process.file.full_path |
resource.data.conditions.* |
additional.fields |
resource.data.controlPlaneEndpointsConfig.dnsEndpointConfig.* |
additional.fields |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.* |
additional.fields |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.authorizedNetworksConfig.privateEndpointEnforcementEnabled |
additional.fields |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.privateEndpoint |
target.ip,target.asset.ip |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.publicEndpoint |
target.ip,target.asset.ip |
resource.data.cpuOptions.coreCount |
additional.fields |
resource.data.cpuOptions.threadsPerCore |
additional.fields |
resource.data.createDate |
principal.resource.attribute.labels |
resource.data.createdDate |
principal.resource.attribute.labels |
resource.data.createdTime |
target.resource.attribute.creation_time |
resource.data.CreatedOn |
target.resource.attribute.creation_time |
resource.data.createTime |
target.resource.attribute.creation_time |
resource.data.creationTimestamp |
principal.resource.attribute.labels |
resource.data.databaseEncryption.* |
additional.fields |
resource.data.DefaultArguments.* |
additional.fields |
resource.data.defaultMaxPodsConstraint.maxPodsPerNode |
additional.fields |
resource.data.deleteRetentionPolicy.blob.* |
additional.fields |
resource.data.description |
principal.resource.attribute.labels |
resource.data.diagnosticSettings.* |
additional.fields |
resource.data.diagnosticSettings.properties.* |
additional.fields |
resource.data.diagnosticSettings.properties.logs.* |
additional.fields |
resource.data.diagnosticSettings.properties.metrics.* |
additional.fields |
resource.data.direction |
principal.resource.attribute.labels,network.direction |
resource.data.disks.* |
additional.fields |
resource.data.displayName |
target.user.user_display_name |
resource.data.document.Statement.* |
additional.fields |
resource.data.document.Statement.Action.* |
additional.fields |
resource.data.document.Statement.Resource.* |
additional.fields |
resource.data.document.Version |
additional.fields |
resource.data.enclaveOptions.enabled |
additional.fields |
resource.data.encryptionStatuses.* |
additional.fields |
resource.data.endpoint |
target.ip,target.asset.ip |
resource.data.enterpriseConfig.clusterTier |
additional.fields |
resource.data.entities.policyRoles.* |
additional.fields |
resource.data.ExecutionProperty.MaxConcurrentRuns |
additional.fields |
resource.data.hibernationOptions.configured |
additional.fields |
resource.data.id |
principal.resource.attribute.labels |
resource.data.identity.type |
additional.fields |
resource.data.instanceGroupUrls |
additional.fields |
resource.data.ipAllocationPolicy.* |
target.resource.attribute.labels |
resource.data.ipAllocationPolicy.networkTierConfig.networkTier |
target.resource.attribute.labels |
resource.data.kind |
principal.resource.attribute.labels |
resource.data.lastAccessedDate |
principal.resource.attribute.labels |
resource.data.lastChangedDate |
principal.resource.attribute.labels |
resource.data.listeners.* |
additional.fields |
resource.data.listeners.rules.* |
additional.fields |
resource.data.listeners.rules.actions.* |
additional.fields |
resource.data.listeners.rules.actions.forwardConfig.targetGroups.* |
additional.fields |
resource.data.loadBalancerName |
target.resource.name |
resource.data.location |
principal.resource.attribute.labels |
resource.data.locations |
additional.fields |
resource.data.logConfig.enable |
additional.fields |
resource.data.loggingConfig.componentConfig.enableComponents |
additional.fields |
resource.data.loggingProperties.blob.* |
additional.fields |
resource.data.loggingProperties.queue.* |
additional.fields |
resource.data.loggingProperties.table.* |
additional.fields |
resource.data.mail |
target.user.email_addresses |
resource.data.maintenancePolicy.resourceVersion |
additional.fields |
resource.data.maintenancePolicy.window.recurringWindow.recurrence |
additional.fields |
resource.data.maintenancePolicy.window.recurringWindow.window.endTime |
additional.fields |
resource.data.maintenancePolicy.window.recurringWindow.window.startTime |
additional.fields |
resource.data.masterAuth.clusterCaCertificate |
additional.fields |
resource.data.masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled |
additional.fields |
resource.data.metadata.items |
additional.fields |
resource.data.metadataOptions.* |
additional.fields |
resource.data.monitoring.state |
additional.fields |
resource.data.monitoringConfig.componentConfig.enableComponents |
additional.fields |
resource.data.monitoringConfig.managedPrometheusConfig.enabled |
additional.fields |
resource.data.msg_metadata.fingerprint |
additional.fields |
resource.data.msg_metadata.kind |
additional.fields |
resource.data.Name |
target.resource.name |
resource.data.name |
principal.resource.attribute.labels |
resource.data.network |
principal.resource.attribute.labels |
resource.data.networkConfig.* |
additional.fields |
resource.data.networkConfig.dnsConfig.clusterDns |
additional.fields |
resource.data.networkConfig.dnsConfig.clusterDnsScope |
additional.fields |
resource.data.networkConfig.gatewayApiConfig.channel |
additional.fields |
resource.data.networkInterfaces.* |
additional.fields |
resource.data.networkInterfaces.aliasIpRanges.* |
additional.fields |
resource.data.networkInterfaces.attachment.* |
additional.fields |
resource.data.networkInterfaces.groups.* |
additional.fields |
resource.data.networkInterfaces.macAddress |
target.mac,target.asset.mac |
resource.data.networkInterfaces.networkIP |
target.ip,target.asset.ip |
resource.data.networkInterfaces.operator.managed |
additional.fields |
resource.data.networkInterfaces.privateIpAddress |
target.ip,target.asset.ip |
resource.data.networkPerformanceOptions.bandwidthWeighting |
additional.fields |
resource.data.networkRuleSet.* |
additional.fields |
resource.data.networkRuleSet.properties.* |
additional.fields |
resource.data.nodeConfig.* |
target.resource.attribute.labels |
resource.data.nodeConfig.bootDisk.diskType |
target.resource.attribute.labels |
resource.data.nodeConfig.bootDisk.sizeGb |
target.resource.attribute.labels |
resource.data.nodeConfig.kubeletConfig.insecureKubeletReadonlyPortEnabled |
target.resource.attribute.labels |
resource.data.nodeConfig.kubeletConfig.maxParallelImagePulls |
target.resource.attribute.labels |
resource.data.nodeConfig.msg_metadata.disable-legacy-endpoints |
target.resource.attribute.labels |
resource.data.nodeConfig.nodeImageConfig.image |
target.resource.attribute.labels |
resource.data.nodeConfig.nodeImageConfig.imageProject |
target.resource.attribute.labels |
resource.data.nodeConfig.oauthScopes |
target.resource.attribute.labels |
resource.data.nodeConfig.resourceLabels.goog-gke-node-pool-provisioning-model |
target.resource.attribute.labels |
resource.data.nodeConfig.serviceAccount |
target.user.email_addresses,target.user.userid |
resource.data.nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring |
target.resource.attribute.labels |
resource.data.nodeConfig.tags |
target.resource.attribute.labels |
resource.data.nodeConfig.workloadMetadataConfig.mode |
target.resource.attribute.labels |
resource.data.nodePoolAutoConfig.networkTags.tags |
additional.fields |
resource.data.nodePoolAutoConfig.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled |
additional.fields |
resource.data.nodePoolDefaults.nodeConfigDefaults.loggingConfig.variantConfig.variant |
additional.fields |
resource.data.nodePoolDefaults.nodeConfigDefaults.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled |
additional.fields |
resource.data.nodePools.* |
additional.fields |
resource.data.nodePools.autoscaling.* |
additional.fields |
resource.data.nodePools.config.* |
additional.fields |
resource.data.nodePools.instanceGroupUrls |
additional.fields |
resource.data.nodePools.locations |
additional.fields |
resource.data.nodePools.management.* |
additional.fields |
resource.data.nodePools.maxPodsConstraint.* |
additional.fields |
resource.data.nodePools.networkConfig.* |
additional.fields |
resource.data.nodePools.upgradeSettings.* |
additional.fields |
resource.data.operator.hiddenByDefault |
additional.fields |
resource.data.operator.managed |
additional.fields |
resource.data.placement.* |
additional.fields |
resource.data.podAutoscaling.hpaProfile |
additional.fields |
resource.data.policyArn |
principal.resource.attribute.labels |
resource.data.policyName |
principal.resource.attribute.labels |
resource.data.privateClusterConfig.* |
additional.fields |
resource.data.privateDnsName |
target.hostname,target.asset.hostname |
resource.data.privateIpAddress |
target.ip,target.asset.ip |
resource.data.properties.* |
additional.fields |
resource.data.properties.aadProfile.enableAzureRBAC |
additional.fields |
resource.data.properties.aadProfile.managed |
additional.fields |
resource.data.properties.aadProfile.tenantID |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.enableSecretRotation |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.rotationPollInterval |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.enabled |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.clientId |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.objectId |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.resourceId |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.config.version |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.enabled |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.identity.clientId |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.identity.objectId |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.identity.resourceId |
additional.fields |
resource.data.properties.addonProfiles.omsagent.config.logAnalyticsWorkspaceResourceID |
additional.fields |
resource.data.properties.addonProfiles.omsagent.config.useAADAuth |
additional.fields |
resource.data.properties.addonProfiles.omsagent.enabled |
additional.fields |
resource.data.properties.addonProfiles.omsagent.identity.clientId |
additional.fields |
resource.data.properties.addonProfiles.omsagent.identity.objectId |
additional.fields |
resource.data.properties.addonProfiles.omsagent.identity.resourceId |
additional.fields |
resource.data.properties.agentPoolProfiles.* |
additional.fields |
resource.data.properties.agentPoolProfiles.availabilityZones |
additional.fields |
resource.data.properties.agentPoolProfiles.nodeLabels.nodepool |
additional.fields |
resource.data.properties.agentPoolProfiles.powerState.code |
additional.fields |
resource.data.properties.agentPoolProfiles.tags.* |
additional.fields |
resource.data.properties.apiServerAccessProfile.disableRunCommand |
additional.fields |
resource.data.properties.apiServerAccessProfile.enablePrivateCluster |
additional.fields |
resource.data.properties.apiServerAccessProfile.enablePrivateClusterPublicFQDN |
additional.fields |
resource.data.properties.apiServerAccessProfile.privateDNSZone |
additional.fields |
resource.data.properties.autoScalerProfile.* |
additional.fields |
resource.data.properties.autoUpgradeProfile.upgradeChannel |
additional.fields |
resource.data.properties.httpProxyConfig.effectiveNoProxy |
additional.fields |
resource.data.properties.httpProxyConfig.httpProxy |
additional.fields |
resource.data.properties.httpProxyConfig.httpsProxy |
additional.fields |
resource.data.properties.httpProxyConfig.noProxy |
additional.fields |
resource.data.properties.httpProxyConfig.trustedCa |
additional.fields |
resource.data.properties.identityProfile.kubeletidentity.* |
additional.fields |
resource.data.properties.linuxProfile.adminUsername |
additional.fields |
resource.data.properties.linuxProfile.ssh.publicKeys.* |
additional.fields |
resource.data.properties.networkProfile.* |
target.resource.attribute.labels |
resource.data.properties.networkProfile.dnsServiceIP |
target.ip,target.asset.ip |
resource.data.properties.networkProfile.ipFamilies |
target.resource.attribute.labels |
resource.data.properties.networkProfile.serviceCidrs |
target.resource.attribute.labels |
resource.data.properties.powerState.code |
additional.fields |
resource.data.properties.principalId |
target.user.product_object_id |
resource.data.properties.privateFQDN |
target.hostname,target.asset.hostname |
resource.data.properties.privateLinkResources.* |
additional.fields |
resource.data.properties.privateLinkResources.requiredMembers |
additional.fields |
resource.data.properties.roleDefinition.* |
additional.fields |
resource.data.properties.roleDefinition.properties.* |
additional.fields |
resource.data.properties.roleDefinition.properties.assignableScopes |
additional.fields |
resource.data.properties.roleDefinition.properties.permissions.actions |
additional.fields |
resource.data.properties.roleDefinition.properties.permissions.notActions |
additional.fields |
resource.data.properties.servicePrincipalProfile.clientId |
additional.fields |
resource.data.properties.storageProfile.diskCSIDriver.enabled |
additional.fields |
resource.data.properties.storageProfile.fileCSIDriver.enabled |
additional.fields |
resource.data.properties.storageProfile.snapshotController.enabled |
additional.fields |
resource.data.properties.windowsProfile.adminUsername |
additional.fields |
resource.data.properties.windowsProfile.enableCSIProxy |
additional.fields |
resource.data.rbacBindingConfig.enableInsecureBindingSystemAuthenticated |
additional.fields |
resource.data.rbacBindingConfig.enableInsecureBindingSystemUnauthenticated |
additional.fields |
resource.data.releaseChannel.channel |
additional.fields |
resource.data.resourceGroup |
principal.resource.attribute.labels |
resource.data.resourceLabels.gke-cluster |
additional.fields |
resource.data.resourceLabels.goog-terraform-provisioned |
additional.fields |
resource.data.roles |
target.user.attribute.roles.name |
resource.data.scheduling.automaticRestart |
additional.fields |
resource.data.scheduling.onHostMaintenance |
additional.fields |
resource.data.scheduling.preemptible |
additional.fields |
resource.data.secretVersionsToStages.terraform-20260122172341570100000002 |
principal.resource.attribute.labels |
resource.data.securityPostureConfig.mode |
security_result.detection_fields |
resource.data.securityPostureConfig.vulnerabilityMode |
security_result.detection_fields |
resource.data.selfLink |
principal.resource.attribute.labels |
resource.data.shareDeleteRetentionPolicy.file.* |
additional.fields |
resource.data.shieldedInstanceConfig.enableIntegrityMonitoring |
additional.fields |
resource.data.shieldedInstanceConfig.enableSecureBoot |
additional.fields |
resource.data.shieldedInstanceConfig.enableVtpm |
additional.fields |
resource.data.shieldedInstanceIntegrityPolicy.updateAutoLearnPolicy |
additional.fields |
resource.data.sku.* |
additional.fields |
resource.data.sourceRanges |
security_result.about.ip |
resource.data.state.code |
additional.fields |
resource.data.state.name |
additional.fields |
resource.data.tags |
additional.fields |
resource.data.tags.* |
additional.fields |
resource.data.tags.Creator |
target.user.email_addresses,target.user.userid |
resource.data.tags.Email |
target.user.email_addresses,target.user.userid |
resource.data.tags.items |
additional.fields |
resource.data.targetGroups.* |
target.resource.attribute.labels |
resource.data.targetGroups.loadBalancerArns |
target.resource.attribute.labels |
resource.data.targetTags |
additional.fields |
resource.data.type |
principal.resource.attribute.labels |
resource.data.user |
target.user.email_addresses,target.user.userid |
resource.data.userPrincipalName |
target.user.userid |
resource.data.versionId |
principal.resource.attribute.labels |
resource.data.workloadIdentityConfig.workloadPool |
additional.fields |
resource.data.dnsname |
target.hostname,target.asset.hostname |
resource.id |
principal.resource.product_object_id,additional.fields |
resource.name |
principal.resource.name,additional.fields |
resource.region |
principal.location.country_or_region,principal.location.state,additional.fields |
resource.regionId |
principal.resource.attribute.cloud.availability_zone,principal.location.country_or_region,additional.fields |
resource.resourceApiName |
target.resource.attribute.labels |
resource.resourceConfigJsonAvailable |
additional.fields |
resource.resourceDetailsAvailable |
additional.fields |
resource.resourceId |
principal.resource.product_object_id |
resource.resourceName |
principal.resource.name |
resource.resourceTags.* |
principal.resource.attribute.labels |
resource.resourceTs |
metadata.event_timestamp |
resource.resourceType |
target.resource.resource_subtype,additional.fields |
resource.rrn |
target.resource.attribute.labels |
resource.unifiedAssetId |
principal.asset.asset_id |
resource.url |
principal.url |
resourceCloudService |
principal.resource.attribute.labels |
resourceConfigJsonAvailable |
additional.fields |
resourceDetailsAvailable |
additional.fields |
resourceId |
principal.resource.product_object_id |
resourceName |
principal.resource.name |
resourceRegion |
principal.location.country_or_region |
resourceRegionId |
principal.resource.attribute.cloud.availability_zone |
resourceType |
target.resource.resource_subtype |
rrn |
target.resource.name |
saveSearchId |
security_result.detection_fields |
sender |
metadata.description |
sentTs |
metadata.event_timestamp |
serialNum |
additional.fields |
service |
observer.application |
severity |
security_result.severity,security_result.severity_details |
shouldCollect |
additional.fields |
source |
principal.application |
source_type |
metadata.product_event_type |
startupProcess |
principal.process.parent_process.command_line |
status |
security_result.detection_fields |
systemDefault |
additional.fields |
tags |
principal.resource.attribute.labels |
time |
metadata.event_timestamp |
title |
additional.fields |
type |
principal.resource.resource_subtype,security_result.category_details |
unifiedAssetId |
principal.asset.asset_id |
url |
security_result.url_back_to_product |
user |
principal.user.userid |
vulnerabilities.accountIDs |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.clusters |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.collections |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.distribution |
extensions.vulns.vulnerabilities.name |
vulnerabilities.imageID |
extensions.vulns.vulnerabilities.about.file.sha256 |
vulnerabilities.imageName |
extensions.vulns.vulnerabilities.about.file.full_path |
vulnerabilities.namespaces |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.cve |
extensions.vulns.vulnerabilities.cve_id |
vulnerabilities.newVulnerabilities.vulnerabilities.link |
extensions.vulns.vulnerabilities.about.url |
vulnerabilities.newVulnerabilities.vulnerabilities.packages |
target.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion |
target.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.severity |
extensions.vulns.vulnerabilities.severity,extensions.vulns.vulnerabilities.severity_details |
vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage |
target.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.status |
extensions.vulns.vulnerabilities.description |
Referencia delta de asignación de UDM
El 15 de septiembre de 2026, Google SecOps lanzó una nueva versión del analizador de cargas útiles de alertas de Palo Alto Prisma Cloud, que incluye cambios significativos en la asignación de los campos de registro de cargas útiles de alertas de Palo Alto Prisma Cloud a los campos de UDM.
Diferencia de asignación de campos de registro
En la siguiente tabla, se muestra la diferencia de asignación de los campos de registro a UDM de la carga útil de alertas de Palo Alto Prisma Cloud expuestos antes del 15 de septiembre de 2026 y, posteriormente, (se indican en las columnas Asignación anterior y Asignación actual, respectivamente):
| Campo de registro | Asignación anterior | Asignación actual | Motivo del cambio |
|---|---|---|---|
_id |
additional.fields |
metadata.product_log_id |
Se asigna al ID de registro del producto para identificar eventos distintos. |
account.cloudType |
principal.cloud.environment |
principal.resource.attribute.cloud.environment |
Se realineó el contexto del entorno de nube con los atributos de los recursos. |
accountId |
target.resource.id,target.resource.product_object_id |
target.resource.product_object_id |
Son los destinos de identificadores de cuentas de nube estandarizados. |
accountId |
target1.cloud.project.id |
target.resource.product_object_id |
Se quitó la asignación de entidad target1 obsoleta. |
aggregatedAlerts.category |
security_result.category_details |
about.resource.attribute.labels |
Se movieron los atributos de categoría genéricos a las etiquetas de recursos de about. |
aggregatedAlerts.command |
principal.process.command_line,security_result.detection_fields |
about.process.command_line |
Se consolidaron los detalles de la ejecución del proceso en about.process. |
aggregatedAlerts.complianceIssues.category |
security_result.category_details |
security_result.detection_fields |
Se conservaron los metadatos de cumplimiento en los campos de detección. |
aggregatedAlerts.complianceIssues.description |
security_result.description,security_result.detection_fields |
security_result.detection_fields |
Se optimizó la asignación de descripciones para evitar campos redundantes. |
aggregatedAlerts.complianceIssues.severity |
security_result.severity,severity_details,security_result.detection_fields |
security_result.detection_fields |
Se estandarizó el seguimiento de la gravedad del cumplimiento en los campos de detección. |
aggregatedAlerts.complianceIssues.title |
security_result.action_details,security_result.detection_fields |
security_result.detection_fields |
Se consolidaron los metadatos de los títulos en los campos de detección. |
aggregatedAlerts.container |
target.resource.name |
about.resource.name |
Se cambiaron los detalles del contenedor del contexto de destino al de about. |
aggregatedAlerts.containerID |
target.resource.product_object_id |
about.resource.product_object_id |
Se realineó la asignación de ID de contenedor a los atributos de recursos de about. |
aggregatedAlerts.forensics |
principal.url |
about.url |
Se actualizó el destino del vínculo de análisis forense a about.url. |
aggregatedAlerts.fqdn |
principal.domain.name |
about.domain.name |
Se corrigió la asignación de contexto del dominio. |
aggregatedAlerts.host |
principal.hostname |
about.hostname |
Se cambió el contexto de la entidad de host a about.hostname. |
aggregatedAlerts.message |
security_result.description |
about.resource.attribute.labels |
Se movieron las cadenas de mensajes sin procesar a pares clave-valor de etiquetas. |
aggregatedAlerts.region |
target.cloud.availability_zone |
about.resource.attribute.cloud.availability_zone |
Se actualizó la asignación de atributos de la región de Cloud. |
aggregatedAlerts.rule |
security_result.rule_name |
about.resource.attribute.labels |
Se movieron las referencias de reglas agregadas a las etiquetas de recursos. |
aggregatedAlerts.startupProcess |
principal.process.parent_process.command_line |
about.resource.attribute.labels |
Se reclasificaron los detalles del proceso de inicio en etiquetas de recursos. |
aggregatedAlerts.time |
metadata.event_timestamp |
about.resource.attribute.labels |
Se conservó la marca de tiempo de la alerta sin procesar en las etiquetas de recursos. |
aggregatedAlerts.type |
security_result.category_details |
about.resource.attribute.labels |
Se reclasificó el tipo de alerta en etiquetas de recursos. |
aggregatedAlerts.user |
principal.user.userid |
about.user.userid |
Se realineó la referencia de la entidad del usuario a about.user. |
alertTs |
security_result.detection_fields |
security_result.first_discovered_time |
Se corrigió el campo objetivo de la marca de tiempo de detección. |
audits.attackType |
security_result.threat_name |
security_result.threat_name,security_result.detection_fields |
Se agregó una asignación secundaria a los campos de detección. |
audits.command |
principal.process.command_line |
about.process.command_line |
Se cambió el objetivo de la línea de comandos del proceso a about. |
audits.effect |
security_result.action_details |
security_result.action_details,security_result.detection_fields |
Se agregó una asignación secundaria a los campos de detección. |
audits.msg |
metadata.description |
metadata.description,about.resource.attribute.labels |
Se expandió el seguimiento de mensajes de auditoría a las etiquetas de recursos. |
audits.os |
principal.platform_version |
about.platform_version |
Se corrigió el objetivo de la plataforma del sistema operativo. |
audits.pid |
principal.process.pid |
about.process.pid |
Se realineó la asignación de ID de proceso a about.process. |
audits.processPath |
principal.process.file.full_path |
about.process.file.full_path |
Se realineó la ruta de acceso del ejecutable del proceso a about.process. |
audits.ruleName |
security_result.rule_name |
security_result.rule_name,security_result.detection_fields |
Se conservó el nombre de la regla en los campos de resultados de seguridad y detección. |
audits.severity |
security_result.severity |
security_result.severity,security_result.detection_fields |
Se conservó la gravedad de la auditoría en los campos de detección y resultado de seguridad. |
audits.type |
metadata.product_event_type |
metadata.product_event_type,about.resource.attribute.labels |
Se agregó el tipo de evento a las etiquetas de recursos para mejorar el filtrado. |
audits.user |
principal.user.userid |
about.user.userid |
Se realineó el identificador de usuario de auditoría a about.user. |
cloudType |
principal.cloud.environment |
principal.resource.attribute.cloud.environment |
Se actualizó el destino del entorno de nube raíz. |
complianceMetadata.requirementId |
security_result.rule_id |
security_result.detection_fields |
Se movió el ID del requisito de cumplimiento a los campos de detección. |
complianceMetadata.requirementName |
security_result.summary |
security_result.detection_fields |
Se movió el nombre del requisito de cumplimiento a los campos de detección. |
complianceMetadata.standardName |
security_result.rule_name |
security_result.detection_fields |
Se movió el nombre del estándar de cumplimiento a los campos de detección. |
containerName |
principal.application,principal.resource.name |
principal.resource.name |
Se quitó la asignación ambigua de entidades de aplicación. |
imageID |
principal.resource.attribute.labels |
principal.process.file.sha256 |
Se asignó el hash de la imagen de contenedor directamente al SHA256 del proceso. |
imageName |
principal.resource.attribute.labels |
principal.process.file.full_path |
Se asignó el nombre de la imagen de contenedor a la ruta de acceso del archivo de proceso. |
policy.complianceMetadata.requirementId |
security_result.rule_id |
security_result.detection_fields |
Se movió el ID del requisito de cumplimiento de la política a los campos de detección. |
policy.complianceMetadata.requirementName |
security_result.summary |
security_result.detection_fields |
Se movió el nombre del requisito de cumplimiento de la política a los campos de detección. |
policy.complianceMetadata.standardName |
security_result.rule_name |
security_result.detection_fields |
Se movió el nombre del estándar de cumplimiento de políticas a los campos de detección. |
provider |
target.resource.attribute.labels |
target.resource.attribute.cloud.environment |
Contexto estandarizado del entorno del proveedor de servicios en la nube. |
resource.account |
target.resource.product_object_id |
additional.fields |
Se movió la cadena de cuenta genérica a los campos adicionales. |
resource.accountId |
target.resource.id,target.resource.product_object_id |
target.resource.product_object_id |
Asignación estandarizada de IDs de cuentas de recursos. |
resource.accountId |
target1.cloud.project.id |
target.resource.product_object_id |
Se quitó la referencia heredada a la entidad target1. |
resource.cloudAccountGroups |
principal.resource.attribute.labels |
target.user.group_identifiers |
Se corrigió la asignación de grupos de cuentas a identificadores de grupos de usuarios. |
resource.cloudType |
principal.cloud.environment |
principal.resource.attribute.cloud.environment |
Atributos estandarizados del entorno de nube de recursos. |
resource.data.isAttached |
security_result.detection_fields |
additional.fields |
Se cambiaron las marcas de estado de los recursos a campos adicionales. |
resource.data.isDefaultVersion |
security_result.detection_fields |
additional.fields |
Se cambiaron las marcas de versión a campos adicionales. |
resource.data.isPermissionBoundarySet |
security_result.detection_fields |
additional.fields |
Se cambiaron los indicadores de permisos a campos adicionales. |
resource.resourceApiName |
principal.resource.attribute.labels |
target.resource.attribute.labels |
Se realinearon las etiquetas de la API de recursos para que coincidan con el recurso objetivo. |
resource.resourceId |
principal.resource.attribute.labels |
principal.resource.product_object_id |
Es el ID del recurso promocionado al ID del objeto del producto. |
resource.resourceName |
principal.resource.attribute.labels |
principal.resource.name |
Se ascendió el nombre del recurso al nombre del recurso de UDM nativo. |
resource.resourceTs |
principal.resource.attribute.labels |
metadata.event_timestamp |
Se corrigió el campo de extracción de la fuente de la marca de tiempo del evento. |
resource.rrn |
principal.resource.attribute.labels |
target.resource.attribute.labels |
Se realineó el RRN del recurso para orientarlo a las etiquetas. |
resourceRegionId |
principal.cloud.availability_zone |
principal.resource.attribute.cloud.availability_zone |
Se realineó el ID de la región de la nube con los atributos del recurso. |
resourceType |
principal.resource.resource_subtype |
target.resource.resource_subtype |
Es el subtipo de recurso objetivo estandarizado. |
type |
principal.resource.type |
principal.resource.resource_subtype |
Es la cadena de tipo asignada al subtipo de recurso. |
Registro de cambios
Consulta el registro de cambios de este analizador
¿Necesitas más ayuda? Obtén respuestas de miembros de la comunidad y profesionales de Google SecOps.