Coletar registros de alerta do Palo Alto Prisma Cloud
Compatível com:
Google SecOps
SIEM
Esse analisador extrai registros de alerta do Palo Alto Prisma Cloud no formato JSON, transformando-os no UDM. O analisador realiza a normalização de dados, conversões de tipo e lógica condicional para preencher os campos apropriados do UDM. Ele também processa estruturas JSON aninhadas e matrizes nos dados de registro para extrair informações relevantes. As informações neste documento se aplicam ao analisador com o rótulo de ingestão PAN_PRISMA_CA.
Antes de começar
Verifique se você atende os seguintes pré-requisitos:
- Instância do Google SecOps.
- Acesso privilegiado ao Palo Alto Prisma Cloud.
Configurar feeds
Para configurar um feed, siga estas etapas:
- Acesse Configurações > Gerenciamento de dados > Feeds. Se você estiver em uma plataforma somente SIEM, acesse Configurações > Feeds.
- Clique em Adicionar novo feed.
- Na página seguinte, clique em Configurar um único feed.
- No campo Nome do feed, insira um nome para o feed, por exemplo, Alertas do PAN Prisma Cloud.
- Selecione Webhook como o Tipo de origem.
- Selecione Payload de alertas do Palo Alto Prisma Cloud como o Tipo de registro.
- Clique em Próxima.
- Opcional: especifique valores para os seguintes parâmetros de entrada:
- Delimitador de divisão: o delimitador usado para separar linhas de registro, como
\n.
- Delimitador de divisão: o delimitador usado para separar linhas de registro, como
- Clique em Próxima.
- Revise a configuração do feed na tela Finalizar e clique em Enviar.
- Clique em Gerar chave secreta para gerar uma chave secreta e autenticar esse feed.
- Copie e armazene a chave secreta. Não será possível ver essa chave secreta novamente. Se necessário, é possível gerar uma nova chave secreta, mas essa ação torna a chave secreta anterior obsoleta.
- Na guia Detalhes, copie o URL do endpoint do feed no campo Informações do endpoint. É necessário especificar esse URL de endpoint no aplicativo cliente.
- Clique em Concluído.
Criar uma chave de API para o feed de webhook
Acesse o console doGoogle Cloud > Credenciais.
Clique em Criar credenciais e, em seguida, selecione Chave de API.
Restrinja o acesso da chave de API à API Google Security Operations.
Especificar o URL do endpoint
- No aplicativo cliente, especifique o URL do endpoint HTTPS fornecido no feed do webhook.
Ative a autenticação especificando a chave de API e a chave secreta como parte do cabeçalho personalizado no seguinte formato:
X-goog-api-key = API_KEY X-Webhook-Access-Key = SECRETRecomendação: especifique a chave de API como um cabeçalho em vez de especificá-la no URL.
Se o cliente do webhook não for compatível com cabeçalhos personalizados, especifique a chave de API e a chave secreta usando parâmetros de consulta no seguinte formato:
ENDPOINT_URL?key=API_KEY&secret=SECRETSubstitua:
ENDPOINT_URL: o URL do endpoint do feed.API_KEY: a chave de API para autenticação no Google Security Operations.SECRET: a chave secreta que você gerou para autenticar o feed.
Configurar o webhook do Palo Alto Prisma Cloud para o Google SecOps
- Faça login no Palo Alto Prisma Cloud.
- Selecione Configurações > Integrações e notificações ((and_then)) Integrações.
- Clique em Adicionar integração.
- Selecione Webhook.
- Especifique valores para os seguintes parâmetros de entrada:
- Nome da integração: forneça um nome exclusivo e descritivo (por exemplo, Google SecOps).
- URL do webhook: insira o ENDPOINT_URL.
- Opcional: forneça uma Descrição da integração.
- Opcional: ative Payload personalizado > clique em Próxima para revisar ou modificar o payload personalizado.
- Clique em Próxima.
- Teste e salve a integração.
Configurar alertas do Palo Alto Prisma Cloud
- No console do Palo Alto Prisma Cloud, acesse Alertas > Ver regras de alerta.
- Selecione uma regra de alerta para editar.
- Opcional: Criar um novo alerta para a infraestrutura em nuvem.
- Opcional: Criar um novo alerta para carga de trabalho do Cloud.
- Acesse Configurar notificações.
- Selecione Webhook.
- Opcional: selecione os canais para os quais você quer enviar notificações de alertas acionados pela regra de alerta.
- Clique em Próxima.
- Clique em Salvar.
Tabela de mapeamento de UDM
A tabela a seguir lista os campos de UDM mapeados dos campos de registro de payload do Palo Alto Prisma Cloud Alert:
| Campo de registro | mapeamento de UDM |
|---|---|
_id |
metadata.product_log_id |
account.cloudType |
principal.resource.attribute.cloud.environment |
account.id |
additional.fields |
account.name |
additional.fields |
account_id_body |
target.user.userid |
accountId |
target.resource.product_object_id |
accountIDs |
additional.fields |
accountName |
target.resource.attribute.labels |
accountOwners |
principal.user.email_addresses,principal.user.attribute.labels |
acknowledged |
security_result.detection_fields |
additionalInfo.* |
security_result.detection_fields |
aggregatedAlerts.* |
about.resource.attribute.labels,target.resource.attribute.labels |
aggregatedAlerts.accountIDs |
target.resource.attribute.labels |
aggregatedAlerts.clusters |
target.resource.attribute.labels |
aggregatedAlerts.collections |
target.resource.attribute.labels |
aggregatedAlerts.command |
about.process.command_line |
aggregatedAlerts.complianceIssues.* |
security_result.detection_fields |
aggregatedAlerts.container |
about.resource.name |
aggregatedAlerts.containerID |
about.resource.product_object_id |
aggregatedAlerts.forensics |
about.url |
aggregatedAlerts.fqdn |
about.domain.name |
aggregatedAlerts.host |
about.hostname |
aggregatedAlerts.labels.aadpodidbinding |
about.resource.attribute.labels |
aggregatedAlerts.labels.app_kubernetes.io_component |
about.resource.attribute.labels |
aggregatedAlerts.labels.app_kubernetes.io_part_of |
about.resource.attribute.labels |
aggregatedAlerts.labels.io.kubernetes.container.name |
about.resource.attribute.labels |
aggregatedAlerts.labels.io.kubernetes.pod.namespace |
about.resource.attribute.labels |
aggregatedAlerts.labels.io.kubernetes.pod.uid |
about.resource.attribute.labels |
aggregatedAlerts.labels.networking/gateway-ingress |
about.resource.attribute.labels |
aggregatedAlerts.labels.pod-template-hash |
about.resource.attribute.labels |
aggregatedAlerts.labels.product |
about.resource.attribute.labels |
aggregatedAlerts.labels.role |
about.resource.attribute.labels |
aggregatedAlerts.namespaces |
target.resource.attribute.labels |
aggregatedAlerts.region |
about.resource.attribute.cloud.availability_zone |
aggregatedAlerts.user |
about.user.userid |
aggregatedAlerts.vulnerabilities.accountIDs |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.clusters |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.collections |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.distribution |
extensions.vulns.vulnerabilities.name |
aggregatedAlerts.vulnerabilities.imageID |
extensions.vulns.vulnerabilities.about.file.sha256 |
aggregatedAlerts.vulnerabilities.imageName |
extensions.vulns.vulnerabilities.about.file.full_path |
aggregatedAlerts.vulnerabilities.namespaces |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.cve |
extensions.vulns.vulnerabilities.cve_id |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.link |
extensions.vulns.vulnerabilities.about.url |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packages |
target.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion |
target.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.severity |
extensions.vulns.vulnerabilities.severity,extensions.vulns.vulnerabilities.severity_details |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage |
target.resource.attribute.labels |
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.status |
extensions.vulns.vulnerabilities.description |
alarmType |
principal.asset.attribute.cloud.environment,security_result.detection_fields |
alertId |
security_result.detection_fields |
alertRemediationCli |
security_result.detection_fields |
alertRemediationCliDescription |
security_result.detection_fields |
alertRemediationImpact |
security_result.detection_fields |
alertRuleId |
security_result.rule_id |
alertRuleName |
security_result.rule_name |
alertStatus |
security_result.detection_fields |
alertTime |
security_result.first_discovered_time |
alertTs |
security_result.first_discovered_time |
App |
principal.application |
audits._id |
additional.fields |
audits.accountID |
about.resource.attribute.labels |
audits.attackTechniques |
additional.fields |
audits.attackType |
security_result.threat_name,security_result.detection_fields |
audits.cluster |
about.resource.attribute.labels |
audits.command |
about.process.command_line |
audits.container |
additional.fields |
audits.containerId |
about.resource.attribute.labels |
audits.containerName |
about.resource.attribute.labels |
audits.count |
additional.fields |
audits.effect |
security_result.action_details,security_result.detection_fields |
audits.hostname |
about.hostname |
audits.imageId |
about.resource.attribute.labels |
audits.imageName |
about.resource.attribute.labels |
audits.msg |
metadata.description,about.resource.attribute.labels |
audits.namespace |
about.namespace |
audits.os |
about.platform_version |
audits.pid |
about.process.pid |
audits.processPath |
about.process.file.full_path |
audits.profileId |
about.resource.attribute.labels |
audits.provider |
about.resource.attribute.cloud.environment |
audits.region |
about.location.country_or_region |
audits.ruleName |
security_result.rule_name,security_result.detection_fields |
audits.severity |
security_result.severity,security_result.severity_details,security_result.detection_fields |
audits.time |
about.resource.attribute.labels |
audits.type |
metadata.product_event_type,about.resource.attribute.labels |
audits.user |
about.user.userid |
body |
additional.fields |
callbackUrl |
metadata.url_back_to_product |
category |
security_result.category_details |
cluster |
principal.resource.attribute.labels |
clusters |
additional.fields |
cloudAccountGroups |
target.user.group_identifiers |
cloudAccountOwners |
target.user.email_addresses,target.user.attribute.labels |
cloudServiceName |
target.resource.attribute.labels |
cloudType |
principal.resource.attribute.cloud.environment |
collections |
additional.fields |
command |
principal.process.command_line |
complianceIssues.* |
security_result.detection_fields |
complianceIssues.category |
security_result.category_details,security_result.detection_fields |
complianceIssues.description |
security_result.description,security_result.detection_fields |
complianceIssues.id |
security_result.detection_fields |
complianceIssues.severity |
security_result.severity,security_result.severity_details,security_result.detection_fields |
complianceIssues.title |
security_result.action_details,security_result.detection_fields |
complianceIssues.type |
security_result.detection_fields |
complianceMetadata.* |
security_result.detection_fields |
container |
target.resource.name |
containerID |
principal.asset.asset_id,target.resource.product_object_id |
containerName |
principal.resource.name |
data.allocationId |
principal.resource.product_object_id |
data.attachments.* |
additional.fields |
data.createTime |
target.resource.attribute.creation_time |
data.publicIp |
principal.ip,principal.asset.ip |
data.* |
additional.fields |
deleted |
additional.fields |
description |
metadata.description |
dropped |
security_result.detection_fields |
email_add |
principal.user.email_addresses |
errorMessage |
metadata.description |
firstSeen |
principal.asset.first_seen_time |
forensics |
security_result.url_back_to_product |
fqdn |
principal.domain.name |
hasFinding |
security_result.detection_fields |
host |
principal.hostname,principal.asset.hostname |
hostname |
principal.hostname,principal.asset.hostname |
id |
metadata.product_log_id |
image |
target.process.file.full_path |
imageID |
principal.process.file.sha256,target.process.file.sha256 |
imageName |
principal.process.file.full_path |
incidentTime |
security_result.first_discovered_time |
investigateOptions.* |
security_result.detection_fields |
labels |
additional.fields |
labels.aadpodidbinding |
target.resource.attribute.labels |
labels.app |
target.application |
labels.app_kubernetes.io_component |
target.resource.attribute.labels |
labels.app_kubernetes.io_part_of |
target.resource.attribute.labels |
labels.io.kubernetes.container.name |
target.resource.attribute.labels |
labels.io.kubernetes.pod.name |
target.hostname,target.asset.hostname |
labels.io.kubernetes.pod.namespace |
target.resource.attribute.labels |
labels.io.kubernetes.pod.uid |
target.resource.attribute.labels |
labels.networking/gateway-ingress |
target.resource.attribute.labels |
labels.owner |
target.user.userid |
labels.pod-template-hash |
target.resource.attribute.labels |
labels.product |
target.resource.attribute.labels |
labels.role |
target.resource.attribute.labels |
lastModifiedBy |
principal.user.email_addresses |
lastModifiedOn |
security_result.detection_fields |
lastSeen |
principal.asset.first_discover_time |
lastUpdated |
security_result.detection_fields |
message |
security_result.description |
msg_metadata.remediable |
security_result.detection_fields |
msg_metadata.saveSearchId |
security_result.detection_fields |
name |
security_result.summary |
namespace |
principal.namespace |
namespaces |
additional.fields |
notificationRuleName |
security_result.rule_name |
policy.complianceMetadata.* |
security_result.detection_fields |
policy.description |
security_result.detection_fields |
policy.deleted |
additional.fields |
policy.hasSearchExecutionSupport |
security_result.detection_fields |
policy.id |
security_result.detection_fields |
policy.lastModifiedBy |
principal.user.email_addresses |
policy.lastModifiedOn |
security_result.detection_fields |
policy.name |
security_result.description |
policy.policyId |
security_result.detection_fields |
policy.policyType |
security_result.detection_fields |
policy.policyTs |
security_result.detection_fields |
policy.recommendation |
security_result.detection_fields |
policy.remediable |
security_result.detection_fields |
policy.severity |
security_result.severity,security_result.severity_details |
policy.systemDefault |
security_result.detection_fields |
policyDescription |
security_result.detection_fields |
policyId |
security_result.detection_fields |
policyLabels |
additional.fields |
policyName |
security_result.description |
policyRecommendation |
security_result.detection_fields |
policyType |
security_result.detection_fields |
profileID |
additional.fields |
provider |
target.resource.attribute.cloud.environment |
reason |
security_result.summary |
recommendation |
security_result.detection_fields |
remediable |
security_result.detection_fields |
region |
principal.location.country_or_region,principal.location.state,target.resource.attribute.cloud.availability_zone |
resource.account |
additional.fields |
resource.accountId |
target.resource.product_object_id,additional.fields |
resource.additionalInfo.* |
security_result.detection_fields |
resource.cloudAccountGroups |
target.user.group_identifiers |
resource.cloudAccountOwners |
target.user.email_addresses,target.user.attribute.labels |
resource.cloudServiceName |
target.resource.attribute.labels |
resource.cloudType |
principal.resource.attribute.cloud.environment,principal.resource.attribute.labels |
resource.data.* |
additional.fields |
resource.data.addonsConfig.dnsCacheConfig.enabled |
additional.fields |
resource.data.addonsConfig.gcePersistentDiskCsiDriverConfig.enabled |
additional.fields |
resource.data.addonsConfig.gcpFilestoreCsiDriverConfig.enabled |
additional.fields |
resource.data.addonsConfig.gcsFuseCsiDriverConfig.enabled |
additional.fields |
resource.data.addonsConfig.kubernetesDashboard.disabled |
additional.fields |
resource.data.addonsConfig.networkPolicyConfig.disabled |
additional.fields |
resource.data.allowed.IPProtocol |
additional.fields |
resource.data.allowed.ports |
additional.fields |
resource.data.arn |
principal.resource.attribute.labels |
resource.data.attributes.access_logs.s3.enabled |
additional.fields |
resource.data.attributes.deletion_protection.enabled |
additional.fields |
resource.data.attributes.dns_record.client_routing_policy |
additional.fields |
resource.data.attributes.load_balancing.cross_zone.enabled |
additional.fields |
resource.data.attributes.secondary_ips.auto_assigned.per_subnet |
additional.fields |
resource.data.attributes.zonal_shift.config.enabled |
additional.fields |
resource.data.authenticatorGroupsConfig.enabled |
target.group.attribute.labels |
resource.data.authenticatorGroupsConfig.securityGroup |
target.group.email_addresses |
resource.data.authorizationRules.* |
additional.fields |
resource.data.authorizationRules.properties.rights |
additional.fields |
resource.data.autoscaling.autoscalingProfile |
additional.fields |
resource.data.availabilityZones.* |
additional.fields |
resource.data.blockDeviceMappings.deviceName |
additional.fields |
resource.data.blockDeviceMappings.ebs.* |
additional.fields |
resource.data.capacityReservationSpecification.capacityReservationPreference |
additional.fields |
resource.data.Command.* |
additional.fields |
resource.data.Command.ScriptLocation |
target.process.file.full_path |
resource.data.conditions.* |
additional.fields |
resource.data.controlPlaneEndpointsConfig.dnsEndpointConfig.* |
additional.fields |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.* |
additional.fields |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.authorizedNetworksConfig.privateEndpointEnforcementEnabled |
additional.fields |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.privateEndpoint |
target.ip,target.asset.ip |
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.publicEndpoint |
target.ip,target.asset.ip |
resource.data.cpuOptions.coreCount |
additional.fields |
resource.data.cpuOptions.threadsPerCore |
additional.fields |
resource.data.createDate |
principal.resource.attribute.labels |
resource.data.createdDate |
principal.resource.attribute.labels |
resource.data.createdTime |
target.resource.attribute.creation_time |
resource.data.CreatedOn |
target.resource.attribute.creation_time |
resource.data.createTime |
target.resource.attribute.creation_time |
resource.data.creationTimestamp |
principal.resource.attribute.labels |
resource.data.databaseEncryption.* |
additional.fields |
resource.data.DefaultArguments.* |
additional.fields |
resource.data.defaultMaxPodsConstraint.maxPodsPerNode |
additional.fields |
resource.data.deleteRetentionPolicy.blob.* |
additional.fields |
resource.data.description |
principal.resource.attribute.labels |
resource.data.diagnosticSettings.* |
additional.fields |
resource.data.diagnosticSettings.properties.* |
additional.fields |
resource.data.diagnosticSettings.properties.logs.* |
additional.fields |
resource.data.diagnosticSettings.properties.metrics.* |
additional.fields |
resource.data.direction |
principal.resource.attribute.labels,network.direction |
resource.data.disks.* |
additional.fields |
resource.data.displayName |
target.user.user_display_name |
resource.data.document.Statement.* |
additional.fields |
resource.data.document.Statement.Action.* |
additional.fields |
resource.data.document.Statement.Resource.* |
additional.fields |
resource.data.document.Version |
additional.fields |
resource.data.enclaveOptions.enabled |
additional.fields |
resource.data.encryptionStatuses.* |
additional.fields |
resource.data.endpoint |
target.ip,target.asset.ip |
resource.data.enterpriseConfig.clusterTier |
additional.fields |
resource.data.entities.policyRoles.* |
additional.fields |
resource.data.ExecutionProperty.MaxConcurrentRuns |
additional.fields |
resource.data.hibernationOptions.configured |
additional.fields |
resource.data.id |
principal.resource.attribute.labels |
resource.data.identity.type |
additional.fields |
resource.data.instanceGroupUrls |
additional.fields |
resource.data.ipAllocationPolicy.* |
target.resource.attribute.labels |
resource.data.ipAllocationPolicy.networkTierConfig.networkTier |
target.resource.attribute.labels |
resource.data.kind |
principal.resource.attribute.labels |
resource.data.lastAccessedDate |
principal.resource.attribute.labels |
resource.data.lastChangedDate |
principal.resource.attribute.labels |
resource.data.listeners.* |
additional.fields |
resource.data.listeners.rules.* |
additional.fields |
resource.data.listeners.rules.actions.* |
additional.fields |
resource.data.listeners.rules.actions.forwardConfig.targetGroups.* |
additional.fields |
resource.data.loadBalancerName |
target.resource.name |
resource.data.location |
principal.resource.attribute.labels |
resource.data.locations |
additional.fields |
resource.data.logConfig.enable |
additional.fields |
resource.data.loggingConfig.componentConfig.enableComponents |
additional.fields |
resource.data.loggingProperties.blob.* |
additional.fields |
resource.data.loggingProperties.queue.* |
additional.fields |
resource.data.loggingProperties.table.* |
additional.fields |
resource.data.mail |
target.user.email_addresses |
resource.data.maintenancePolicy.resourceVersion |
additional.fields |
resource.data.maintenancePolicy.window.recurringWindow.recurrence |
additional.fields |
resource.data.maintenancePolicy.window.recurringWindow.window.endTime |
additional.fields |
resource.data.maintenancePolicy.window.recurringWindow.window.startTime |
additional.fields |
resource.data.masterAuth.clusterCaCertificate |
additional.fields |
resource.data.masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled |
additional.fields |
resource.data.metadata.items |
additional.fields |
resource.data.metadataOptions.* |
additional.fields |
resource.data.monitoring.state |
additional.fields |
resource.data.monitoringConfig.componentConfig.enableComponents |
additional.fields |
resource.data.monitoringConfig.managedPrometheusConfig.enabled |
additional.fields |
resource.data.msg_metadata.fingerprint |
additional.fields |
resource.data.msg_metadata.kind |
additional.fields |
resource.data.Name |
target.resource.name |
resource.data.name |
principal.resource.attribute.labels |
resource.data.network |
principal.resource.attribute.labels |
resource.data.networkConfig.* |
additional.fields |
resource.data.networkConfig.dnsConfig.clusterDns |
additional.fields |
resource.data.networkConfig.dnsConfig.clusterDnsScope |
additional.fields |
resource.data.networkConfig.gatewayApiConfig.channel |
additional.fields |
resource.data.networkInterfaces.* |
additional.fields |
resource.data.networkInterfaces.aliasIpRanges.* |
additional.fields |
resource.data.networkInterfaces.attachment.* |
additional.fields |
resource.data.networkInterfaces.groups.* |
additional.fields |
resource.data.networkInterfaces.macAddress |
target.mac,target.asset.mac |
resource.data.networkInterfaces.networkIP |
target.ip,target.asset.ip |
resource.data.networkInterfaces.operator.managed |
additional.fields |
resource.data.networkInterfaces.privateIpAddress |
target.ip,target.asset.ip |
resource.data.networkPerformanceOptions.bandwidthWeighting |
additional.fields |
resource.data.networkRuleSet.* |
additional.fields |
resource.data.networkRuleSet.properties.* |
additional.fields |
resource.data.nodeConfig.* |
target.resource.attribute.labels |
resource.data.nodeConfig.bootDisk.diskType |
target.resource.attribute.labels |
resource.data.nodeConfig.bootDisk.sizeGb |
target.resource.attribute.labels |
resource.data.nodeConfig.kubeletConfig.insecureKubeletReadonlyPortEnabled |
target.resource.attribute.labels |
resource.data.nodeConfig.kubeletConfig.maxParallelImagePulls |
target.resource.attribute.labels |
resource.data.nodeConfig.msg_metadata.disable-legacy-endpoints |
target.resource.attribute.labels |
resource.data.nodeConfig.nodeImageConfig.image |
target.resource.attribute.labels |
resource.data.nodeConfig.nodeImageConfig.imageProject |
target.resource.attribute.labels |
resource.data.nodeConfig.oauthScopes |
target.resource.attribute.labels |
resource.data.nodeConfig.resourceLabels.goog-gke-node-pool-provisioning-model |
target.resource.attribute.labels |
resource.data.nodeConfig.serviceAccount |
target.user.email_addresses,target.user.userid |
resource.data.nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring |
target.resource.attribute.labels |
resource.data.nodeConfig.tags |
target.resource.attribute.labels |
resource.data.nodeConfig.workloadMetadataConfig.mode |
target.resource.attribute.labels |
resource.data.nodePoolAutoConfig.networkTags.tags |
additional.fields |
resource.data.nodePoolAutoConfig.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled |
additional.fields |
resource.data.nodePoolDefaults.nodeConfigDefaults.loggingConfig.variantConfig.variant |
additional.fields |
resource.data.nodePoolDefaults.nodeConfigDefaults.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled |
additional.fields |
resource.data.nodePools.* |
additional.fields |
resource.data.nodePools.autoscaling.* |
additional.fields |
resource.data.nodePools.config.* |
additional.fields |
resource.data.nodePools.instanceGroupUrls |
additional.fields |
resource.data.nodePools.locations |
additional.fields |
resource.data.nodePools.management.* |
additional.fields |
resource.data.nodePools.maxPodsConstraint.* |
additional.fields |
resource.data.nodePools.networkConfig.* |
additional.fields |
resource.data.nodePools.upgradeSettings.* |
additional.fields |
resource.data.operator.hiddenByDefault |
additional.fields |
resource.data.operator.managed |
additional.fields |
resource.data.placement.* |
additional.fields |
resource.data.podAutoscaling.hpaProfile |
additional.fields |
resource.data.policyArn |
principal.resource.attribute.labels |
resource.data.policyName |
principal.resource.attribute.labels |
resource.data.privateClusterConfig.* |
additional.fields |
resource.data.privateDnsName |
target.hostname,target.asset.hostname |
resource.data.privateIpAddress |
target.ip,target.asset.ip |
resource.data.properties.* |
additional.fields |
resource.data.properties.aadProfile.enableAzureRBAC |
additional.fields |
resource.data.properties.aadProfile.managed |
additional.fields |
resource.data.properties.aadProfile.tenantID |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.enableSecretRotation |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.rotationPollInterval |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.enabled |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.clientId |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.objectId |
additional.fields |
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.resourceId |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.config.version |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.enabled |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.identity.clientId |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.identity.objectId |
additional.fields |
resource.data.properties.addonProfiles.azurepolicy.identity.resourceId |
additional.fields |
resource.data.properties.addonProfiles.omsagent.config.logAnalyticsWorkspaceResourceID |
additional.fields |
resource.data.properties.addonProfiles.omsagent.config.useAADAuth |
additional.fields |
resource.data.properties.addonProfiles.omsagent.enabled |
additional.fields |
resource.data.properties.addonProfiles.omsagent.identity.clientId |
additional.fields |
resource.data.properties.addonProfiles.omsagent.identity.objectId |
additional.fields |
resource.data.properties.addonProfiles.omsagent.identity.resourceId |
additional.fields |
resource.data.properties.agentPoolProfiles.* |
additional.fields |
resource.data.properties.agentPoolProfiles.availabilityZones |
additional.fields |
resource.data.properties.agentPoolProfiles.nodeLabels.nodepool |
additional.fields |
resource.data.properties.agentPoolProfiles.powerState.code |
additional.fields |
resource.data.properties.agentPoolProfiles.tags.* |
additional.fields |
resource.data.properties.apiServerAccessProfile.disableRunCommand |
additional.fields |
resource.data.properties.apiServerAccessProfile.enablePrivateCluster |
additional.fields |
resource.data.properties.apiServerAccessProfile.enablePrivateClusterPublicFQDN |
additional.fields |
resource.data.properties.apiServerAccessProfile.privateDNSZone |
additional.fields |
resource.data.properties.autoScalerProfile.* |
additional.fields |
resource.data.properties.autoUpgradeProfile.upgradeChannel |
additional.fields |
resource.data.properties.httpProxyConfig.effectiveNoProxy |
additional.fields |
resource.data.properties.httpProxyConfig.httpProxy |
additional.fields |
resource.data.properties.httpProxyConfig.httpsProxy |
additional.fields |
resource.data.properties.httpProxyConfig.noProxy |
additional.fields |
resource.data.properties.httpProxyConfig.trustedCa |
additional.fields |
resource.data.properties.identityProfile.kubeletidentity.* |
additional.fields |
resource.data.properties.linuxProfile.adminUsername |
additional.fields |
resource.data.properties.linuxProfile.ssh.publicKeys.* |
additional.fields |
resource.data.properties.networkProfile.* |
target.resource.attribute.labels |
resource.data.properties.networkProfile.dnsServiceIP |
target.ip,target.asset.ip |
resource.data.properties.networkProfile.ipFamilies |
target.resource.attribute.labels |
resource.data.properties.networkProfile.serviceCidrs |
target.resource.attribute.labels |
resource.data.properties.powerState.code |
additional.fields |
resource.data.properties.principalId |
target.user.product_object_id |
resource.data.properties.privateFQDN |
target.hostname,target.asset.hostname |
resource.data.properties.privateLinkResources.* |
additional.fields |
resource.data.properties.privateLinkResources.requiredMembers |
additional.fields |
resource.data.properties.roleDefinition.* |
additional.fields |
resource.data.properties.roleDefinition.properties.* |
additional.fields |
resource.data.properties.roleDefinition.properties.assignableScopes |
additional.fields |
resource.data.properties.roleDefinition.properties.permissions.actions |
additional.fields |
resource.data.properties.roleDefinition.properties.permissions.notActions |
additional.fields |
resource.data.properties.servicePrincipalProfile.clientId |
additional.fields |
resource.data.properties.storageProfile.diskCSIDriver.enabled |
additional.fields |
resource.data.properties.storageProfile.fileCSIDriver.enabled |
additional.fields |
resource.data.properties.storageProfile.snapshotController.enabled |
additional.fields |
resource.data.properties.windowsProfile.adminUsername |
additional.fields |
resource.data.properties.windowsProfile.enableCSIProxy |
additional.fields |
resource.data.rbacBindingConfig.enableInsecureBindingSystemAuthenticated |
additional.fields |
resource.data.rbacBindingConfig.enableInsecureBindingSystemUnauthenticated |
additional.fields |
resource.data.releaseChannel.channel |
additional.fields |
resource.data.resourceGroup |
principal.resource.attribute.labels |
resource.data.resourceLabels.gke-cluster |
additional.fields |
resource.data.resourceLabels.goog-terraform-provisioned |
additional.fields |
resource.data.roles |
target.user.attribute.roles.name |
resource.data.scheduling.automaticRestart |
additional.fields |
resource.data.scheduling.onHostMaintenance |
additional.fields |
resource.data.scheduling.preemptible |
additional.fields |
resource.data.secretVersionsToStages.terraform-20260122172341570100000002 |
principal.resource.attribute.labels |
resource.data.securityPostureConfig.mode |
security_result.detection_fields |
resource.data.securityPostureConfig.vulnerabilityMode |
security_result.detection_fields |
resource.data.selfLink |
principal.resource.attribute.labels |
resource.data.shareDeleteRetentionPolicy.file.* |
additional.fields |
resource.data.shieldedInstanceConfig.enableIntegrityMonitoring |
additional.fields |
resource.data.shieldedInstanceConfig.enableSecureBoot |
additional.fields |
resource.data.shieldedInstanceConfig.enableVtpm |
additional.fields |
resource.data.shieldedInstanceIntegrityPolicy.updateAutoLearnPolicy |
additional.fields |
resource.data.sku.* |
additional.fields |
resource.data.sourceRanges |
security_result.about.ip |
resource.data.state.code |
additional.fields |
resource.data.state.name |
additional.fields |
resource.data.tags |
additional.fields |
resource.data.tags.* |
additional.fields |
resource.data.tags.Creator |
target.user.email_addresses,target.user.userid |
resource.data.tags.Email |
target.user.email_addresses,target.user.userid |
resource.data.tags.items |
additional.fields |
resource.data.targetGroups.* |
target.resource.attribute.labels |
resource.data.targetGroups.loadBalancerArns |
target.resource.attribute.labels |
resource.data.targetTags |
additional.fields |
resource.data.type |
principal.resource.attribute.labels |
resource.data.user |
target.user.email_addresses,target.user.userid |
resource.data.userPrincipalName |
target.user.userid |
resource.data.versionId |
principal.resource.attribute.labels |
resource.data.workloadIdentityConfig.workloadPool |
additional.fields |
resource.data.dnsname |
target.hostname,target.asset.hostname |
resource.id |
principal.resource.product_object_id,additional.fields |
resource.name |
principal.resource.name,additional.fields |
resource.region |
principal.location.country_or_region,principal.location.state,additional.fields |
resource.regionId |
principal.resource.attribute.cloud.availability_zone,principal.location.country_or_region,additional.fields |
resource.resourceApiName |
target.resource.attribute.labels |
resource.resourceConfigJsonAvailable |
additional.fields |
resource.resourceDetailsAvailable |
additional.fields |
resource.resourceId |
principal.resource.product_object_id |
resource.resourceName |
principal.resource.name |
resource.resourceTags.* |
principal.resource.attribute.labels |
resource.resourceTs |
metadata.event_timestamp |
resource.resourceType |
target.resource.resource_subtype,additional.fields |
resource.rrn |
target.resource.attribute.labels |
resource.unifiedAssetId |
principal.asset.asset_id |
resource.url |
principal.url |
resourceCloudService |
principal.resource.attribute.labels |
resourceConfigJsonAvailable |
additional.fields |
resourceDetailsAvailable |
additional.fields |
resourceId |
principal.resource.product_object_id |
resourceName |
principal.resource.name |
resourceRegion |
principal.location.country_or_region |
resourceRegionId |
principal.resource.attribute.cloud.availability_zone |
resourceType |
target.resource.resource_subtype |
rrn |
target.resource.name |
saveSearchId |
security_result.detection_fields |
sender |
metadata.description |
sentTs |
metadata.event_timestamp |
serialNum |
additional.fields |
service |
observer.application |
severity |
security_result.severity,security_result.severity_details |
shouldCollect |
additional.fields |
source |
principal.application |
source_type |
metadata.product_event_type |
startupProcess |
principal.process.parent_process.command_line |
status |
security_result.detection_fields |
systemDefault |
additional.fields |
tags |
principal.resource.attribute.labels |
time |
metadata.event_timestamp |
title |
additional.fields |
type |
principal.resource.resource_subtype,security_result.category_details |
unifiedAssetId |
principal.asset.asset_id |
url |
security_result.url_back_to_product |
user |
principal.user.userid |
vulnerabilities.accountIDs |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.clusters |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.collections |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.distribution |
extensions.vulns.vulnerabilities.name |
vulnerabilities.imageID |
extensions.vulns.vulnerabilities.about.file.sha256 |
vulnerabilities.imageName |
extensions.vulns.vulnerabilities.about.file.full_path |
vulnerabilities.namespaces |
extensions.vulns.vulnerabilities.about.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.cve |
extensions.vulns.vulnerabilities.cve_id |
vulnerabilities.newVulnerabilities.vulnerabilities.link |
extensions.vulns.vulnerabilities.about.url |
vulnerabilities.newVulnerabilities.vulnerabilities.packages |
target.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion |
target.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.severity |
extensions.vulns.vulnerabilities.severity,extensions.vulns.vulnerabilities.severity_details |
vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage |
target.resource.attribute.labels |
vulnerabilities.newVulnerabilities.vulnerabilities.status |
extensions.vulns.vulnerabilities.description |
Referência de delta de mapeamento de UDM
Em 15 de setembro de 2026, o Google SecOps lançou uma nova versão do analisador de payload do Palo Alto Prisma Cloud Alert, que inclui mudanças significativas no mapeamento dos campos de registro de payload do Palo Alto Prisma Cloud Alert para os campos do UDM.
Delta de mapeamento de campo de registro
A tabela a seguir lista o delta de mapeamento para os campos de registro para UDM do payload do alerta do Palo Alto Prisma Cloud expostos antes de 15 de setembro de 2026 e posteriormente (listados nas colunas Mapeamento antigo e Mapeamento atual, respectivamente):
| Campo de registro | Mapeamento antigo | Mapeamento atual | Motivo para a alteração |
|---|---|---|---|
_id |
additional.fields |
metadata.product_log_id |
Mapeado para o ID do registro do produto para identificação de eventos distintos. |
account.cloudType |
principal.cloud.environment |
principal.resource.attribute.cloud.environment |
O contexto do ambiente de nuvem foi realinhado aos atributos de recursos. |
accountId |
target.resource.id,target.resource.product_object_id |
target.resource.product_object_id |
Destinos de identificador de conta de nuvem padronizados. |
accountId |
target1.cloud.project.id |
target.resource.product_object_id |
O mapeamento de entidade target1 descontinuado foi removido. |
aggregatedAlerts.category |
security_result.category_details |
about.resource.attribute.labels |
Os atributos de categoria genéricos foram movidos para os rótulos de recursos about. |
aggregatedAlerts.command |
principal.process.command_line,security_result.detection_fields |
about.process.command_line |
Detalhes consolidados da execução do processo em about.process. |
aggregatedAlerts.complianceIssues.category |
security_result.category_details |
security_result.detection_fields |
Metadados de compliance preservados nos campos de detecção. |
aggregatedAlerts.complianceIssues.description |
security_result.description,security_result.detection_fields |
security_result.detection_fields |
Mapeamento de descrição simplificado para evitar campos redundantes. |
aggregatedAlerts.complianceIssues.severity |
security_result.severity,severity_details,security_result.detection_fields |
security_result.detection_fields |
Rastreamento padronizado da gravidade da conformidade nos campos de detecção. |
aggregatedAlerts.complianceIssues.title |
security_result.action_details,security_result.detection_fields |
security_result.detection_fields |
Metadados de título consolidados em campos de detecção. |
aggregatedAlerts.container |
target.resource.name |
about.resource.name |
Os detalhes do contêiner foram transferidos do destino para o contexto about. |
aggregatedAlerts.containerID |
target.resource.product_object_id |
about.resource.product_object_id |
O mapeamento do ID do contêiner foi realinhado aos atributos de recurso about. |
aggregatedAlerts.forensics |
principal.url |
about.url |
O destino do link de análise forense foi atualizado para about.url. |
aggregatedAlerts.fqdn |
principal.domain.name |
about.domain.name |
Correção do mapeamento de contexto do domínio. |
aggregatedAlerts.host |
principal.hostname |
about.hostname |
O contexto da entidade host foi alterado para about.hostname. |
aggregatedAlerts.message |
security_result.description |
about.resource.attribute.labels |
As strings de mensagens brutas foram movidas para pares de chave-valor de rótulo. |
aggregatedAlerts.region |
target.cloud.availability_zone |
about.resource.attribute.cloud.availability_zone |
Atualizamos o mapeamento de atributos da região de nuvem. |
aggregatedAlerts.rule |
security_result.rule_name |
about.resource.attribute.labels |
As referências de regras agregadas foram movidas para rótulos de recursos. |
aggregatedAlerts.startupProcess |
principal.process.parent_process.command_line |
about.resource.attribute.labels |
Os detalhes do processo de inicialização foram reclassificados como rótulos de recursos. |
aggregatedAlerts.time |
metadata.event_timestamp |
about.resource.attribute.labels |
Carimbo de data/hora do alerta bruto retido nos rótulos de recursos. |
aggregatedAlerts.type |
security_result.category_details |
about.resource.attribute.labels |
Reclassificação do tipo de alerta em rótulos de recursos. |
aggregatedAlerts.user |
principal.user.userid |
about.user.userid |
A referência da entidade do usuário foi realinhada para about.user. |
alertTs |
security_result.detection_fields |
security_result.first_discovered_time |
O campo de destino do carimbo de data/hora de detecção foi corrigido. |
audits.attackType |
security_result.threat_name |
security_result.threat_name,security_result.detection_fields |
Adicionamos o mapeamento secundário aos campos de detecção. |
audits.command |
principal.process.command_line |
about.process.command_line |
A meta da linha de comando do processo foi alterada para about. |
audits.effect |
security_result.action_details |
security_result.action_details,security_result.detection_fields |
Adicionamos o mapeamento secundário aos campos de detecção. |
audits.msg |
metadata.description |
metadata.description,about.resource.attribute.labels |
Rastreamento de mensagens de auditoria expandido para rótulos de recursos. |
audits.os |
principal.platform_version |
about.platform_version |
Corrigimos a plataforma de destino do sistema operacional. |
audits.pid |
principal.process.pid |
about.process.pid |
O mapeamento do ID de processo foi realinhado para about.process. |
audits.processPath |
principal.process.file.full_path |
about.process.file.full_path |
O caminho executável do processo foi realinhado para about.process. |
audits.ruleName |
security_result.rule_name |
security_result.rule_name,security_result.detection_fields |
Nome da regra preservado nos campos de resultado de segurança e detecção. |
audits.severity |
security_result.severity |
security_result.severity,security_result.detection_fields |
Gravidade da auditoria preservada nos campos de resultado e detecção de segurança. |
audits.type |
metadata.product_event_type |
metadata.product_event_type,about.resource.attribute.labels |
Adicionamos o tipo de evento aos rótulos de recursos para melhorar a filtragem. |
audits.user |
principal.user.userid |
about.user.userid |
O identificador de usuário de auditoria foi realinhado para about.user. |
cloudType |
principal.cloud.environment |
principal.resource.attribute.cloud.environment |
Segmentação por ambiente de nuvem raiz atualizada. |
complianceMetadata.requirementId |
security_result.rule_id |
security_result.detection_fields |
O ID do requisito de compliance foi movido para os campos de detecção. |
complianceMetadata.requirementName |
security_result.summary |
security_result.detection_fields |
O nome do requisito de compliance foi movido para os campos de detecção. |
complianceMetadata.standardName |
security_result.rule_name |
security_result.detection_fields |
O nome do padrão de compliance foi movido para os campos de detecção. |
containerName |
principal.application,principal.resource.name |
principal.resource.name |
Remoção do mapeamento ambíguo de entidades de aplicativos. |
imageID |
principal.resource.attribute.labels |
principal.process.file.sha256 |
O hash da imagem do contêiner foi mapeado diretamente para o SHA256 do processo. |
imageName |
principal.resource.attribute.labels |
principal.process.file.full_path |
Nome da imagem do contêiner mapeado para o caminho do arquivo do processo. |
policy.complianceMetadata.requirementId |
security_result.rule_id |
security_result.detection_fields |
O ID do requisito de compliance com a política foi movido para os campos de detecção. |
policy.complianceMetadata.requirementName |
security_result.summary |
security_result.detection_fields |
O nome do requisito de conformidade com a política foi movido para os campos de detecção. |
policy.complianceMetadata.standardName |
security_result.rule_name |
security_result.detection_fields |
O nome do padrão de conformidade com políticas foi movido para os campos de detecção. |
provider |
target.resource.attribute.labels |
target.resource.attribute.cloud.environment |
Contexto padronizado do ambiente do provedor de nuvem. |
resource.account |
target.resource.product_object_id |
additional.fields |
A string de conta genérica foi movida para campos adicionais. |
resource.accountId |
target.resource.id,target.resource.product_object_id |
target.resource.product_object_id |
Mapeamento padronizado de ID de contas de recursos. |
resource.accountId |
target1.cloud.project.id |
target.resource.product_object_id |
A referência legada à entidade target1 foi removida. |
resource.cloudAccountGroups |
principal.resource.attribute.labels |
target.user.group_identifiers |
Mapeamento corrigido do grupo de contas para identificadores de grupos de usuários. |
resource.cloudType |
principal.cloud.environment |
principal.resource.attribute.cloud.environment |
Atributos padronizados do ambiente de nuvem de recursos. |
resource.data.isAttached |
security_result.detection_fields |
additional.fields |
As flags de estado do recurso foram transferidas para outros campos. |
resource.data.isDefaultVersion |
security_result.detection_fields |
additional.fields |
As flags de versão foram transferidas para campos adicionais. |
resource.data.isPermissionBoundarySet |
security_result.detection_fields |
additional.fields |
As flags de permissão foram transferidas para campos adicionais. |
resource.resourceApiName |
principal.resource.attribute.labels |
target.resource.attribute.labels |
Os rótulos da API de recursos foram realinhados para o recurso de destino. |
resource.resourceId |
principal.resource.attribute.labels |
principal.resource.product_object_id |
ID do recurso promovido para o ID do objeto do produto. |
resource.resourceName |
principal.resource.attribute.labels |
principal.resource.name |
O nome do recurso promovido para o nome do recurso nativo do UDM. |
resource.resourceTs |
principal.resource.attribute.labels |
metadata.event_timestamp |
O campo de extração da origem do carimbo de data/hora do evento foi corrigido. |
resource.rrn |
principal.resource.attribute.labels |
target.resource.attribute.labels |
Realinhamento do RRN do recurso para os rótulos de destino. |
resourceRegionId |
principal.cloud.availability_zone |
principal.resource.attribute.cloud.availability_zone |
O ID da região da nuvem foi realinhado aos atributos do recurso. |
resourceType |
principal.resource.resource_subtype |
target.resource.resource_subtype |
Subtipo de recurso de destino padronizado. |
type |
principal.resource.type |
principal.resource.resource_subtype |
String de tipo mapeada para o subtipo de recurso. |
Registro de alterações
Confira o registro de alterações deste analisador
Precisa de mais ajuda? Receba respostas de membros da comunidade e profissionais do Google SecOps.