Recopila registros de Proofpoint On-Demand
Compatible con:
Google SecOps
SIEM
En este documento, se explica cómo transferir registros de Proofpoint On-Demand a Google Security Operations con la integración de la API integrada. El analizador extrae campos de los registros JSON y los transforma en el formato de UDM de Chronicle. Controla dos formatos de registro principales: uno que contiene metadatos de correo electrónico y el otro que contiene detalles de la transacción de SMTP, con lógica condicional para analizar los campos de forma adecuada y propagar los campos del modelo de datos unificado (UDM) según los datos disponibles. El analizador también realiza la limpieza de datos, como quitar caracteres extraños y convertir marcas de tiempo.
Antes de comenzar
Asegúrate de cumplir con los siguientes requisitos previos:
- Instancia de Google SecOps
- Licencia de Proofpoint On-Demand Remote Syslog
- Acceso con privilegios a Proofpoint
Configura el acceso a la API de Proofpoint On-Demand
- Accede al portal de administrador de Proofpoint.
- Copia tu ID de clúster (se muestra en la esquina superior derecha de la interfaz de administración, junto al número de versión).
- Ve a Configuración > Administración de claves de API.
- Haz clic en Crear nueva para abrir el diálogo Crear nueva clave de API.
- Ingresa un Nombre único (por ejemplo,
Google SecOps Key). - Genera la clave de API.
- Selecciona Ver detalles en el menú de tres puntos de la nueva clave de API.
- Copia la clave de API.
Configura feeds
Para configurar un feed, sigue estos pasos:
- Ve a Configuración de SIEM > Feeds.
- Haz clic en Agregar feed nuevo.
- Haz clic en el paquete de feeds de Proofpoint.
- Selecciona el tipo de registro Proofpoint On-Demand.
- Haz clic en Siguiente.
- Especifica valores para los siguientes parámetros de entrada:
- Tipo de fuente: API de terceros
- Encabezados HTTP de autenticación: Ingresa la clave de API de Proofpoint en formato
Authorization: Bearer {API_KEY}y agrega una línea nueva con los siguientes datos de WebSocket-Key:Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==. - ID del clúster: Ingresa el ID del clúster de Proofpoint que copiaste antes.
Opciones avanzadas
- Nombre del feed: Es un valor prepropagado que identifica el feed.
- Espacio de nombres del recurso: Es el espacio de nombres asociado con el feed.
- Etiquetas de transferencia: Son las etiquetas que se aplican a todos los eventos de este feed.
- Haz clic en Crear feed.
Tabla de asignación de UDM
En las siguientes tablas, se enumeran las asignaciones de los campos de registro de Proofpoint On-Demand a los campos de UDM.
Asignaciones de tipos de eventos
En la siguiente tabla, se enumeran las asignaciones de tipos de eventos de Proofpoint On-Demand. Para obtener más información, consulta Metadata.EventType y Metadata.
| Tipo de evento | Asignación | Comentarios |
|---|---|---|
EMAIL_TRANSACTION |
metadata.event_type |
Si (([has_sender_email] == "true" or [has_recipient_email] == "true") and (([has_principal] == "true" or [has_principal_user] == "true"))). |
GENERIC_EVENT |
metadata.event_type |
Es el resguardo predeterminado para event_type. |
NETWORK_CONNECTION |
metadata.event_type |
Si [has_principal] == "true" and [has_target] == "true". |
STATUS_UPDATE |
metadata.event_type |
Si [has_principal] == "true". |
Campos de registro generales
| Campo de registro | Asignación de UDM | Comentarios |
|---|---|---|
aliasedRcptsvalue.alias |
additional.fields |
|
aliasedRcptsvalue.primary |
additional.fields |
|
alignment.fromDomain |
additional.fields |
|
alignmentresult.identity |
security_result.detection_fields |
|
alignmentresult.identityOrg |
security_result.detection_fields |
|
alignmentresult.result |
security_result.detection_fields |
|
ALLOW |
security_result.action |
Si es [tls][verify] == "OK" o [filter][disposition] in ["continue", "accept", "CLEAR", "OK", "redirect"]. |
app_protocol_output |
network.application_protocol |
Se extrae de un campo data. |
audit.action |
security_result.about.resource.attribute.labels |
|
audit.level |
security_result.severity_details |
Se extrae de un par clave-valor en un campo data. |
audit.resourceType |
target.resource.name |
Se extrae de un par clave-valor en un campo data. |
audit.tags.value |
security_result.detection_fields |
|
audit.user.email |
principal.user.email_addresses |
Si [audit][user][email] =~ "^.+@.+$". |
audit.user.id |
principal.user.userid |
Se extrae de un par clave-valor en un campo data. |
audit.user.ipAddress |
principal.asset.ip,principal.ip |
|
autheresults.method |
security_result.detection_fields |
|
autheresults.result |
additional.fields |
|
BLOCK |
security_result.action |
Si es [tls][verify] == "FAIL" o [filter][disposition] in ["discard", "reject"]. |
campaignID |
security_result.detection_fields |
|
cc |
network.email.cc |
Si [cc] =~ "^.+@.+$". |
CHALLENGE |
security_result.action |
Si [filter][disposition] in ["hold", "retry"]. |
charsets |
security_result.detection_fields |
|
classification |
security_result.detection_fields |
|
cluster |
security_result.detection_fields |
|
cmd |
principal.process.command_line |
Se extrae de un campo data. |
completelyRewritten |
security_result.detection_fields |
|
connection.country |
principal.location.country_or_region |
Se extrae de un par clave-valor en un campo data. |
connection.helo |
network.smtp.helo |
Se extrae de un par clave-valor en un campo data. |
connection.host |
principal.asset.hostname,principal.hostname |
Se extrae de un par clave-valor en un campo data. |
connection.ip |
principal.asset.ip,principal.ip |
|
connection.resolveStatus |
additional.fields |
|
connection.sid |
security_result.detection_fields |
|
connection.tls.inbound.cipher |
network.tls.cipher |
Se extrae de un par clave-valor en un campo data. Si [tls_cipher] not in ["", "null", "None", "none", "NONE"] AND [tls_version] not in ["", "null", "None", "none", "NONE"]. |
connection.tls.inbound.cipherBits |
additional.fields |
|
connection.tls.inbound.version |
network.tls.version |
Se extrae de un par clave-valor en un campo data. Si [tls_cipher] not in ["", "null", "None", "none", "NONE"] AND [tls_version] not in ["", "null", "None", "none", "NONE"]. |
data |
network.email.to,target.user.email_addresses |
Si [email] =~ "^.+@.+$". |
detectedExt |
additional.fields |
|
detectedName |
additional.fields |
|
disposition |
additional.fields |
|
duration |
security_result.detection_fields |
|
emailaddr |
target.user.email_addresses |
|
emailaddrnorm |
target.user.email_addresses |
|
emailaddrparsed |
target.user.email_addresses |
|
envelope.from |
network.email.from |
|
ERROR |
security_result.severity |
Si [audit][level] =~ "(?i)(error)". |
eventTime |
metadata.event_timestamp |
|
event_type |
security_result.summary |
|
extracted_bytes |
network.sent_bytes |
Se extrae de un campo data. |
extracted_internal_id |
additional.fields |
|
extracted_msgid |
additional.fields |
|
extracted_queue_status |
additional.fields |
|
extracted_target_host |
target.asset.hostname,target.hostname |
Se extrae de un campo data. |
extracted_throughput |
additional.fields |
|
extracted_transfer_time |
additional.fields |
|
FAIL |
security_result.action |
Si [filter][disposition] in ["FAIL", "TEMP"]. |
field_ |
additional.fields |
Si NOT = "agent". |
FILTER |
metadata.product_event_type |
Si [is_filter] == "true". |
filter.actions.action |
additional.fields |
|
filter.actions.isFinal |
security_result.detection_fields |
|
filter.actions.module |
additional.fields,security_result.detection_fields |
|
filter.actions.rule |
additional.fields,security_result.detection_fields |
|
filter.disposition |
security_result.action_details |
Se extrae de un par clave-valor en un campo data. Si [filter_disposition] not in ["", "null", "None", "none", "NONE"]. |
filter.durationSecs |
additional.fields |
|
filter.isMsgEncrypted |
additional.fields |
|
filter.isMsgInDigest |
additional.fields |
|
filter.isMsgOnHold |
additional.fields |
|
filter.isMsgReinjected |
additional.fields |
|
filter.isMsgSplit |
additional.fields |
|
filter.langs |
additional.fields |
|
filter.modules.av.virusNames.0 |
security_result.threat_name |
Se extrae de un par clave-valor en un campo data. |
filter.modules.banner.insertedBanner |
security_result.detection_fields |
|
filter.modules.dkimv.domain |
security_result.detection_fields |
|
filter.modules.dkimv.result |
security_result.detection_fields |
|
filter.modules.dkimv.selector |
security_result.detection_fields |
|
filter.modules.dmarc.filterdResult |
security_result.detection_fields |
|
filter.modules.dmarc.isVerified |
additional.fields |
|
filter.modules.dmarc.srvid |
additional.fields |
|
filter.modules.pdr.v2.response |
security_result.detection_fields |
|
filter.modules.pdr.v2.rscore |
additional.fields |
|
filter.modules.spam.authority.analysis |
additional.fields |
|
filter.modules.spam.authority.cartVersion |
additional.fields |
|
filter.modules.spam.authority.isComplete |
additional.fields |
|
filter.modules.spam.authority.isTruncated |
additional.fields |
|
filter.modules.spam.authority.score |
additional.fields |
|
filter.modules.spam.classifiers.profile |
additional.fields |
|
filter.modules.spam.classifiers.status.clx |
additional.fields |
|
filter.modules.spam.classifiers.status.nostradamus |
additional.fields |
|
filter.modules.spam.classifiers.status.supernova |
additional.fields |
|
filter.modules.spam.classifiers.status.uribl |
additional.fields |
|
filter.modules.spam.scores.classifiers.adult |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.bulk |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.cot |
additional.fields |
|
filter.modules.spam.scores.classifiers.impostor |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.lowpriority |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.malware |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.mlx |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.mlxlog |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.phish |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.spam |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.suspect |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.unknownsender |
additional.fields |
|
filter.modules.spam.scores.classifiers.unsafe |
additional.fields |
|
filter.modules.spam.scores.engine |
security_result.detection_fields |
|
filter.modules.spam.scores.overall |
security_result.detection_fields |
|
filter.modules.spam.triggeredClassifier |
security_result.category_details |
|
filter.modules.spam.version.definitions |
security_result.summary |
Se extrae de un par clave-valor en un campo data. |
filter.modules.spam.version.engine |
metadata.product_version |
Se extrae de un par clave-valor en un campo data. |
filter.modules.spf.domain |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsEmail |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsExcludedDomain |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsSchemeless |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsUnsupportedScheme |
additional.fields |
|
filter.modules.urldefense.counts.rewritten |
additional.fields |
|
filter.modules.urldefense.counts.total |
security_result.detection_fields |
|
filter.modules.urldefense.counts.unique |
additional.fields |
|
filter.modules.urldefense.counts.unrewritten |
additional.fields |
|
filter.modules.urldefense.version.engine |
additional.fields |
|
filter.modules.zerohour.score |
additional.fields |
|
filter.msgSizeBytes |
network.received_bytes |
Se extrae de un par clave-valor en un campo data. |
filter.origGuid |
additional.fields |
|
filter.qid |
additional.fields |
|
filter.quarantine.expirationTs |
security_result.detection_fields |
|
filter.quarantine.folder |
security_result.detection_fields |
|
filter.quarantine.folderId |
security_result.detection_fields |
|
filter.quarantine.module |
security_result.detection_fields |
|
filter.quarantine.rule |
security_result.detection_fields |
|
filter.quarantine.type |
security_result.detection_fields |
|
filter.reinjectedType |
additional.fields |
|
filter.routes |
additional.fields |
|
filter.splitType |
additional.fields |
|
filter.startTime |
metadata.event_timestamp |
|
filter.suborgs.sender |
additional.fields |
|
from_hashed |
additional.fields |
|
fromadd |
network.email.from |
Se extrae de un par clave-valor en un campo data. Si [fromadd] =~ "^.+@.+$". |
GUID |
metadata.product_log_id |
Se extrae de un campo data. |
guid |
metadata.product_log_id |
Se extrae de un campo data. |
headerfromHashedvalue |
additional.fields |
|
headertoHashedvalue |
additional.fields |
|
hostname |
principal.asset.hostname,principal.hostname |
Se extrae de un campo message. |
id |
additional.fields |
|
impostorScore |
security_result.detection_fields |
|
INBOUND |
network.direction |
Si es [rule] == "outbound", [filter][routeDirection] == "inbound" o [quarantineRule] =~ "outbound". |
INFORMATIONAL |
security_result.severity |
Si [audit][level] =~ "(?i)(notice)". |
intermediary.ip |
intermediary.asset.ip,intermediary.ip |
|
intermediary.ip1 |
intermediary.asset.ip,intermediary.ip |
|
intermediary_hostname |
intermediary.asset.hostname,intermediary.hostname |
Se extrae de un campo data. |
isArchive |
additional.fields |
|
isCorrupted |
additional.fields |
|
isDeleted |
additional.fields |
|
isProtected |
additional.fields |
|
isTimedOut |
additional.fields |
|
isVirtual |
additional.fields |
|
item.cluster |
security_result.detection_fields |
|
item.GUID |
security_result.detection_fields |
|
item.headerFrom |
security_result.detection_fields |
|
item.id |
security_result.detection_fields |
|
item.impostorScore |
security_result.detection_fields |
|
item.malwareScore |
security_result.detection_fields |
|
item.messageID |
security_result.detection_fields |
|
item.messageSize |
security_result.detection_fields |
|
item.modulesRun |
additional.fields |
|
item.phishScore |
security_result.detection_fields |
|
item.policyRoutes |
additional.fields |
|
item.QID |
security_result.detection_fields |
|
item.quarantineFolder |
security_result.detection_fields |
|
item.quarantineRule |
security_result.detection_fields |
|
item.sender |
principal.user.email_addresses |
Si [item_sender] =~ "^.+@.+$". |
item.senderIP |
principal.asset.ip,principal.ip |
|
item.spamScore |
security_result.detection_fields |
|
item.subject |
network.email.subject |
|
item.threats.classification |
security_result.detection_fields |
|
item.threats.threat |
security_result.detection_fields |
|
item.threats.threatID |
security_result.detection_fields |
|
item.threats.threatStatus |
security_result.detection_fields |
|
item.threats.threatTime |
security_result.detection_fields |
|
item.threats.threatType |
security_result.detection_fields |
|
item.threats.threatUrl |
security_result.detection_fields |
|
key.data |
security_result.detection_fields |
|
labeledCharset |
additional.fields |
|
labeledExt |
additional.fields |
|
labeledMime |
about.file.mime_type |
|
labeledName |
about.file.full_path |
|
malwareScore |
security_result.detection_fields |
|
matches.offset |
additional.fields |
|
matches.part |
additional.fields |
|
MEDIUM |
security_result.severity |
Si [audit][level] =~ "(?i)(warn)". |
messageID |
network.email.mail_id |
Se extrae de un campo data. |
messageSize |
security_result.detection_fields |
|
messageTime |
metadata.event_timestamp |
|
metadata.customerId |
principal.resource.attribute.labels |
|
metadata.origin.data.agent |
network.http.parsed_user_agent,network.http.user_agent |
Se extrae de un par clave-valor en un campo data. |
metadata.origin.data.cid |
additional.fields |
|
metadata.origin.data.mode |
additional.fields |
|
metadata.origin.data.theater |
additional.fields,principal.location.country_or_region |
principal.location.country_or_region se extrae de un par clave-valor en un campo data. |
metadata.origin.data.version |
metadata.product_version |
Se extrae de un par clave-valor en un campo data. |
metadata.origin.schemaVersion |
additional.fields |
|
mod |
security_result.detection_fields |
|
modulesRun |
additional.fields |
|
msg.header.cc |
additional.fields |
|
msg.header.from |
additional.fields,principal.user.email_addresses |
principal.user.email_addresses se asigna a este campo con un bucle, con elementos de array JSON combinados aquí o cadenas que no son JSON asignadas aquí. |
msg.header.message-id.0 |
additional.fields,network.email.mail_id |
|
msg.header.reply-to.0 |
additional.fields,network.email.reply_to |
|
msg.header.to |
additional.fields,target.user.email_addresses |
target.user.email_addresses se asigna aquí como una cadena que no es JSON con un bucle. |
msg.header.x-mailer |
additional.fields |
|
msg.lang |
additional.fields |
|
msg.normalizedHeader.from |
principal.user.email_addresses |
Se asigna a este campo con un bucle. Aquí se combinan los elementos del array JSON y se asignan las cadenas que no son JSON. |
msg.normalizedHeader.subject |
network.email.subject |
Si msg.normalizedHeader.subject no es igual al valor del campo de registro sin procesar subject. |
msg.normalizedHeader.to |
target.user.email_addresses |
Se asigna a este campo con un bucle. Aquí se asignan las cadenas que no son JSON. |
msg.normalizedHeader.x-mailer |
additional.fields |
|
msg.parsedAddresses.from.0 |
additional.fields,network.email.from |
|
msg.parsedAddresses.to |
target.user.email_addresses |
Se asigna a este campo con un bucle. Las cadenas que no son JSON se asignan aquí. |
msg.sizeBytes |
additional.fields |
|
msgBlocked.filename |
about.file.full_path |
|
msgBlocked.labeledMime |
about.file.mime_type |
|
msgBlocked.msgPart.detectedSizeBytes |
about.file.size |
|
msgBlocked.msgPart.md5 |
about.file.md5 |
|
msgheadersubject |
additional.fields |
|
msgheaderxmailervalue |
additional.fields |
|
msgPart.dataBase64 |
additional.fields |
|
msgPart.detectedCharset |
additional.fields |
|
msgPart.detectedMime |
additional.fields |
|
msgPart.detectedSizeBytes |
about.file.size |
|
msgPart.filename |
about.file.full_path |
|
msgPart.md5 |
about.file.md5 |
|
msgPart.metadata.appversion |
additional.fields |
|
msgPart.metadata.codepage |
additional.fields |
|
msgPart.metadata.color-scheme |
additional.fields |
|
msgPart.metadata.content-language |
additional.fields |
|
msgPart.metadata.format-detection |
additional.fields |
|
msgPart.metadata.history[1]/stevt:action |
additional.fields |
|
msgPart.metadata.history[1]/stevt:softwareagent |
additional.fields |
|
msgPart.metadata.history[1]/stevt:when |
additional.fields |
|
msgPart.oContentType |
additional.fields |
|
msgPart.sha256 |
about.file.sha256 |
|
msgs.metadata._PROOFPOINT_CONTENT_LENGTH_ |
additional.fields |
|
msgs.metadata.application |
additional.fields |
|
msgs.metadata.appname |
additional.fields |
|
msgs.metadata.author |
security_result.detection_fields |
|
msgs.metadata.company |
security_result.detection_fields |
|
msgs.metadata.createdate |
additional.fields |
|
msgs.metadata.documentid |
additional.fields |
|
msgs.metadata.instanceid |
additional.fields |
|
msgs.metadata.modifydate |
additional.fields |
|
msgs.metadata.pagecount |
additional.fields |
|
msgs.metadata.subject |
additional.fields |
|
msgs.metadata.title |
additional.fields |
|
msgs.textExtracted |
additional.fields |
|
msgUrls.url |
additional.fields,security_result.detection_fields |
|
normalizedHeader.x_originating_ip |
principal.asset.ip,principal.ip |
|
normalizedHeaderfromHashed |
additional.fields |
|
normalizedHeaderHashedvalue |
additional.fields |
|
normalizedHeaderMessageidvalue |
additional.fields |
|
normalizedheaderreplytohashed |
additional.fields |
|
normalizedheaderreturnpath |
additional.fields |
|
oContentType |
additional.fields |
|
OUTBOUND |
network.direction |
Si es [rule] == "outbound", [filter][routeDirection] == "outbound" o [quarantineRule] =~ "outbound". |
parsed.useragent |
network.http.parsed_user_agent |
|
parsed_stat_value |
security_result.detection_fields |
|
parsedAddress |
network.email.cc |
Si [parsedAddress] =~ "^.+@.+$". |
parsedAddressesfromHashedvalue |
additional.fields |
|
parsedaddressesreplytohashed |
additional.fields |
|
parsedAddrestoHashedvalue |
additional.fields |
|
phishScore |
security_result.detection_fields |
|
pid |
principal.process.pid |
Se extrae de un campo message. |
PoD |
metadata.product_name |
Asignación estática. |
policy_route.* |
additional.fields |
[list_values] / se usó la función de mapa. |
policyRoutes |
additional.fields |
|
pps.agent |
observer.hostname |
|
prod_event_name |
metadata.product_event_type |
Se extrae de un campo message. |
Proofpoint |
metadata.vendor_name |
Asignación estática. |
QID |
security_result.detection_fields |
|
QUARANTINE |
security_result.action |
Si [filter][disposition] == "quarantine". |
quarantineFolder |
security_result.detection_fields |
|
quarantineRule |
security_result.detection_fields |
|
queryEndTime |
metadata.collected_timestamp |
|
rcd.error |
additional.fields |
|
rcd.record |
additional.fields |
|
rcpt |
additional.fields,security_result.detection_fields |
|
rcpt_hashed |
additional.fields |
|
reply |
network.email.reply_to |
Se extrae de un par clave-valor en un campo data. Si [reply] =~ "^.+@.+$". |
replytohashed |
additional.fields |
|
res.emailIdentities.header.from |
additional.fields |
|
res.emailIdentities.smtp.mailfrom |
additional.fields |
|
res.emailIdentities.smtp.mailfromHashed |
additional.fields |
|
res.method |
additional.fields |
|
res.propspec.header.d |
additional.fields |
|
res.propspec.header.s |
additional.fields |
|
rules.name |
additional.fields |
|
rules.severity |
additional.fields |
|
s |
network.session_id |
Se extrae de un campo data. |
safeBlockedListMatches_listType |
security_result.detection_fields |
|
safeBlockedListMatchesvalue.listType |
security_result.detection_fields |
|
safeBlockedListMatchesvalue.rule |
security_result.detection_fields |
|
sandbox.status |
additional.fields |
|
sec_result_action |
security_result.action |
|
sec_result_category |
security_result.category |
|
sender |
principal.user.email_addresses |
Si [sender] =~ "^.+@.+$". |
senderIP |
principal.asset.ip,principal.ip |
|
SENDMAIL |
metadata.product_event_type |
Si [message] =~ "sendmail". |
sendmail_hostname |
principal.asset.hostname,principal.hostname |
Se extrae de un campo data. |
sendmail_process_name |
principal.process.file.full_path |
Se extrae de un campo data. |
sendmail_qid |
additional.fields |
|
sendmail_ts |
metadata.collected_timestamp |
Se extrae de un campo data. |
sig.engine |
security_result.detection_fields |
|
sig.isPresent |
security_result.detection_fields |
|
sig.signature |
security_result.detection_fields |
|
sizeDecodedBytes |
additional.fields |
|
sm.daemon |
additional.fields |
|
sm.delay |
additional.fields |
|
sm.dsn |
additional.fields |
|
sm.from |
network.email.from |
Se extrae de un par clave-valor en un campo data. Si [email_src] =~ "^.+@.+$". |
sm.guid |
metadata.product_log_id |
Se extrae de un par clave-valor en un campo data. Si [message] =~ "sendmail". |
sm.mailer |
additional.fields |
|
sm.messageTs |
additional.fields |
|
sm.msgid |
network.email.mail_id |
Se extrae de un par clave-valor en un campo data. |
sm.nrcpts |
additional.fields |
|
sm.pri |
additional.fields |
|
sm.qid |
security_result.detection_fields |
|
sm.stat |
security_result.description |
Se extrae de un par clave-valor en un campo data. |
sm.xdelay |
additional.fields |
|
smtoemail |
network.email.to |
Si [sm_to_email] =~ "^.+@.+$". |
spamScore |
security_result.detection_fields |
|
SpamType |
security_result.detection_fields |
|
subject |
network.email.subject |
|
suborgs |
additional.fields |
|
threat |
security_result.detection_fields |
|
threatType |
security_result.detection_fields |
|
tls.verify |
security_result.action_details |
Se extrae de un par clave-valor en un campo data. Si [tls_verify] not in ["", "null", "None", "none", "NONE"]. |
to |
network.email.to |
Si [to] =~ "^.+@.+$". |
ts |
metadata.event_timestamp |
|
uinteger |
network.received_bytes,network.sent_bytes |
|
UNKNOWN_ACTION |
security_result.action |
Si [filter][disposition] in ["hold", "retry"]. |
UNKNOWN_SEVERITY |
security_result.severity |
|
urlsource |
security_result.detection_fields |
|
value |
additional.fields |
|
x_originating_ip |
principal.asset.ip,principal.ip |
Referencia delta de asignación de UDM
El 13 de octubre de 2026, Google SecOps lanzó una nueva versión del analizador de Proofpoint On-Demand, que incluye cambios significativos en la asignación de los campos de registro de Proofpoint On-Demand a los campos de UDM y actualizaciones en las clasificaciones de tipos de eventos (asignaciones).
Diferencia de asignación de campos de registro
En la siguiente tabla, se muestran los cambios en la forma en que se asignan los campos de registro de Proofpoint On-Demand a los campos de UDM. En la columna Asignación anterior, se enumeran los campos expuestos antes del 13 de octubre de 2026, y en la columna Asignación actual, se enumeran los campos nuevos.
| Campo de registro | Asignación anterior | Asignación actual |
|---|---|---|
connection.sid |
additional.fields |
security_result.detection_fields |
filter.modules.pdr.v2.response |
additional.fields |
security_result.detection_fields |
filter.modules.urldefense.counts.total |
additional.fields |
security_result.detection_fields |
filter.quarantine.expirationTs |
additional.fields |
security_result.detection_fields |
filter.quarantine.folder |
additional.fields |
security_result.detection_fields |
filter.quarantine.folderId |
additional.fields |
security_result.detection_fields |
filter.quarantine.module |
additional.fields |
security_result.detection_fields |
filter.quarantine.rule |
additional.fields |
security_result.detection_fields |
filter.quarantine.type |
additional.fields |
security_result.detection_fields |
messageTime |
additional.fields |
metadata.event_timestamp |
messagesBlocked.spamScore |
additional.fields |
security_result.detection_fields |
metadata.customerId |
additional.fields |
principal.resource.attribute.labelsmod |
msgParts.detectedSizeBytes |
additional.fields |
about.file.size |
msg_header_from_json_array.value |
additional.fields |
principal.user.email_addresses |
principal.resource.attribute.labelsmod |
additional.fields |
security_result.detection_fields |
Registro de cambios
Consulta el registro de cambios de este analizador
¿Necesitas más ayuda? Obtén respuestas de miembros de la comunidad y profesionales de Google SecOps.