Mengumpulkan log Proofpoint On-Demand
Didukung di:
Google SecOps
SIEM
Dokumen ini menjelaskan cara menyerap log Proofpoint On-Demand ke Google Security Operations menggunakan integrasi API bawaan. Parser mengekstrak kolom dari log JSON, lalu mengubahnya menjadi format UDM Chronicle. Parser ini menangani dua format log utama: satu berisi metadata email dan yang lainnya berisi detail transaksi SMTP, menggunakan logika bersyarat untuk mengurai kolom dengan tepat dan mengisi kolom Model Data Terpadu (UDM) berdasarkan data yang tersedia. Parser juga melakukan pembersihan data, seperti menghapus karakter yang tidak relevan dan mengonversi stempel waktu.
Sebelum memulai
Pastikan Anda memiliki prasyarat berikut:
- Instance Google SecOps
- Lisensi Proofpoint On-Demand Remote Syslog
- Akses istimewa ke Proofpoint
Mengonfigurasi akses Proofpoint On-Demand API
- Login ke portal Proofpoint Admin.
- Salin ID Cluster Anda (ditampilkan di sudut kanan atas antarmuka pengelolaan, di samping nomor rilis).
- Buka Setelan > Pengelolaan Kunci API.
- Klik Create New untuk membuka dialog Create New kunci API.
- Masukkan Nama yang unik (misalnya,
Google SecOps Key). - Buat Kunci API.
- Pilih View Details dari menu elipsis pada Kunci API baru.
- Salin kunci API.
Menyiapkan feed
Untuk mengonfigurasi feed, ikuti langkah-langkah berikut:
- Buka SIEM Settings > Feeds.
- Klik Tambahkan Feed Berita Baru.
- Klik paket feed Proofpoint.
- Pilih jenis log Proofpoint On-Demand.
- Klik Berikutnya.
- Tentukan nilai untuk parameter input berikut:
- Jenis Sumber: API pihak ketiga
- Header HTTP autentikasi: Masukkan Kunci API Proofpoint dalam format
Authorization: Bearer {API_KEY}, dan tambahkan baris baru dengan data WebSocket-Key berikut:Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==. - ID Cluster: Masukkan ID Cluster Proofpoint yang Anda salin sebelumnya.
Opsi lanjutan
- Nama Feed: Nilai yang diisi otomatis yang mengidentifikasi feed.
- Namespace Aset: Namespace yang terkait dengan feed.
- Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
- Klik Buat Feed.
Tabel pemetaan UDM
Tabel berikut mencantumkan pemetaan kolom log Proofpoint On-Demand ke kolom UDM.
Pemetaan jenis peristiwa
Tabel berikut mencantumkan pemetaan jenis peristiwa Proofpoint On-Demand. Untuk mengetahui informasi selengkapnya, lihat Metadata.EventType dan Metadata.
| Jenis peristiwa | Pemetaan | Keterangan |
|---|---|---|
EMAIL_TRANSACTION |
metadata.event_type |
Jika (([has_sender_email] == "true" or [has_recipient_email] == "true") and (([has_principal] == "true" or [has_principal_user] == "true"))). |
GENERIC_EVENT |
metadata.event_type |
Penggantian default untuk event_type. |
NETWORK_CONNECTION |
metadata.event_type |
Jika [has_principal] == "true" and [has_target] == "true". |
STATUS_UPDATE |
metadata.event_type |
Jika [has_principal] == "true". |
Kolom log umum
| Kolom log | pemetaan UDM | Keterangan |
|---|---|---|
aliasedRcptsvalue.alias |
additional.fields |
|
aliasedRcptsvalue.primary |
additional.fields |
|
alignment.fromDomain |
additional.fields |
|
alignmentresult.identity |
security_result.detection_fields |
|
alignmentresult.identityOrg |
security_result.detection_fields |
|
alignmentresult.result |
security_result.detection_fields |
|
ALLOW |
security_result.action |
Jika [tls][verify] == "OK" atau [filter][disposition] in ["continue", "accept", "CLEAR", "OK", "redirect"]. |
app_protocol_output |
network.application_protocol |
Diekstrak dari kolom data. |
audit.action |
security_result.about.resource.attribute.labels |
|
audit.level |
security_result.severity_details |
Diekstrak dari key-value pair di kolom data. |
audit.resourceType |
target.resource.name |
Diekstrak dari key-value pair di kolom data. |
audit.tags.value |
security_result.detection_fields |
|
audit.user.email |
principal.user.email_addresses |
Jika [audit][user][email] =~ "^.+@.+$". |
audit.user.id |
principal.user.userid |
Diekstrak dari key-value pair di kolom data. |
audit.user.ipAddress |
principal.asset.ip,principal.ip |
|
autheresults.method |
security_result.detection_fields |
|
autheresults.result |
additional.fields |
|
BLOCK |
security_result.action |
Jika [tls][verify] == "FAIL" atau [filter][disposition] in ["discard", "reject"]. |
campaignID |
security_result.detection_fields |
|
cc |
network.email.cc |
Jika [cc] =~ "^.+@.+$". |
CHALLENGE |
security_result.action |
Jika [filter][disposition] in ["hold", "retry"]. |
charsets |
security_result.detection_fields |
|
classification |
security_result.detection_fields |
|
cluster |
security_result.detection_fields |
|
cmd |
principal.process.command_line |
Diekstrak dari kolom data. |
completelyRewritten |
security_result.detection_fields |
|
connection.country |
principal.location.country_or_region |
Diekstrak dari key-value pair di kolom data. |
connection.helo |
network.smtp.helo |
Diekstrak dari key-value pair di kolom data. |
connection.host |
principal.asset.hostname,principal.hostname |
Diekstrak dari key-value pair di kolom data. |
connection.ip |
principal.asset.ip,principal.ip |
|
connection.resolveStatus |
additional.fields |
|
connection.sid |
security_result.detection_fields |
|
connection.tls.inbound.cipher |
network.tls.cipher |
Diekstrak dari key-value pair di kolom data. Jika [tls_cipher] not in ["", "null", "None", "none", "NONE"] AND [tls_version] not in ["", "null", "None", "none", "NONE"]. |
connection.tls.inbound.cipherBits |
additional.fields |
|
connection.tls.inbound.version |
network.tls.version |
Diekstrak dari key-value pair di kolom data. Jika [tls_cipher] not in ["", "null", "None", "none", "NONE"] AND [tls_version] not in ["", "null", "None", "none", "NONE"]. |
data |
network.email.to,target.user.email_addresses |
Jika [email] =~ "^.+@.+$". |
detectedExt |
additional.fields |
|
detectedName |
additional.fields |
|
disposition |
additional.fields |
|
duration |
security_result.detection_fields |
|
emailaddr |
target.user.email_addresses |
|
emailaddrnorm |
target.user.email_addresses |
|
emailaddrparsed |
target.user.email_addresses |
|
envelope.from |
network.email.from |
|
ERROR |
security_result.severity |
Jika [audit][level] =~ "(?i)(error)". |
eventTime |
metadata.event_timestamp |
|
event_type |
security_result.summary |
|
extracted_bytes |
network.sent_bytes |
Diekstrak dari kolom data. |
extracted_internal_id |
additional.fields |
|
extracted_msgid |
additional.fields |
|
extracted_queue_status |
additional.fields |
|
extracted_target_host |
target.asset.hostname,target.hostname |
Diekstrak dari kolom data. |
extracted_throughput |
additional.fields |
|
extracted_transfer_time |
additional.fields |
|
FAIL |
security_result.action |
Jika [filter][disposition] in ["FAIL", "TEMP"]. |
field_ |
additional.fields |
Jika NOT = "agent". |
FILTER |
metadata.product_event_type |
Jika [is_filter] == "true". |
filter.actions.action |
additional.fields |
|
filter.actions.isFinal |
security_result.detection_fields |
|
filter.actions.module |
additional.fields,security_result.detection_fields |
|
filter.actions.rule |
additional.fields,security_result.detection_fields |
|
filter.disposition |
security_result.action_details |
Diekstrak dari key-value pair di kolom data. Jika [filter_disposition] not in ["", "null", "None", "none", "NONE"]. |
filter.durationSecs |
additional.fields |
|
filter.isMsgEncrypted |
additional.fields |
|
filter.isMsgInDigest |
additional.fields |
|
filter.isMsgOnHold |
additional.fields |
|
filter.isMsgReinjected |
additional.fields |
|
filter.isMsgSplit |
additional.fields |
|
filter.langs |
additional.fields |
|
filter.modules.av.virusNames.0 |
security_result.threat_name |
Diekstrak dari key-value pair di kolom data. |
filter.modules.banner.insertedBanner |
security_result.detection_fields |
|
filter.modules.dkimv.domain |
security_result.detection_fields |
|
filter.modules.dkimv.result |
security_result.detection_fields |
|
filter.modules.dkimv.selector |
security_result.detection_fields |
|
filter.modules.dmarc.filterdResult |
security_result.detection_fields |
|
filter.modules.dmarc.isVerified |
additional.fields |
|
filter.modules.dmarc.srvid |
additional.fields |
|
filter.modules.pdr.v2.response |
security_result.detection_fields |
|
filter.modules.pdr.v2.rscore |
additional.fields |
|
filter.modules.spam.authority.analysis |
additional.fields |
|
filter.modules.spam.authority.cartVersion |
additional.fields |
|
filter.modules.spam.authority.isComplete |
additional.fields |
|
filter.modules.spam.authority.isTruncated |
additional.fields |
|
filter.modules.spam.authority.score |
additional.fields |
|
filter.modules.spam.classifiers.profile |
additional.fields |
|
filter.modules.spam.classifiers.status.clx |
additional.fields |
|
filter.modules.spam.classifiers.status.nostradamus |
additional.fields |
|
filter.modules.spam.classifiers.status.supernova |
additional.fields |
|
filter.modules.spam.classifiers.status.uribl |
additional.fields |
|
filter.modules.spam.scores.classifiers.adult |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.bulk |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.cot |
additional.fields |
|
filter.modules.spam.scores.classifiers.impostor |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.lowpriority |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.malware |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.mlx |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.mlxlog |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.phish |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.spam |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.suspect |
security_result.detection_fields |
|
filter.modules.spam.scores.classifiers.unknownsender |
additional.fields |
|
filter.modules.spam.scores.classifiers.unsafe |
additional.fields |
|
filter.modules.spam.scores.engine |
security_result.detection_fields |
|
filter.modules.spam.scores.overall |
security_result.detection_fields |
|
filter.modules.spam.triggeredClassifier |
security_result.category_details |
|
filter.modules.spam.version.definitions |
security_result.summary |
Diekstrak dari key-value pair di kolom data. |
filter.modules.spam.version.engine |
metadata.product_version |
Diekstrak dari key-value pair di kolom data. |
filter.modules.spf.domain |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsEmail |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsExcludedDomain |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsSchemeless |
additional.fields |
|
filter.modules.urldefense.counts.noRewriteIsUnsupportedScheme |
additional.fields |
|
filter.modules.urldefense.counts.rewritten |
additional.fields |
|
filter.modules.urldefense.counts.total |
security_result.detection_fields |
|
filter.modules.urldefense.counts.unique |
additional.fields |
|
filter.modules.urldefense.counts.unrewritten |
additional.fields |
|
filter.modules.urldefense.version.engine |
additional.fields |
|
filter.modules.zerohour.score |
additional.fields |
|
filter.msgSizeBytes |
network.received_bytes |
Diekstrak dari key-value pair di kolom data. |
filter.origGuid |
additional.fields |
|
filter.qid |
additional.fields |
|
filter.quarantine.expirationTs |
security_result.detection_fields |
|
filter.quarantine.folder |
security_result.detection_fields |
|
filter.quarantine.folderId |
security_result.detection_fields |
|
filter.quarantine.module |
security_result.detection_fields |
|
filter.quarantine.rule |
security_result.detection_fields |
|
filter.quarantine.type |
security_result.detection_fields |
|
filter.reinjectedType |
additional.fields |
|
filter.routes |
additional.fields |
|
filter.splitType |
additional.fields |
|
filter.startTime |
metadata.event_timestamp |
|
filter.suborgs.sender |
additional.fields |
|
from_hashed |
additional.fields |
|
fromadd |
network.email.from |
Diekstrak dari key-value pair di kolom data. Jika [fromadd] =~ "^.+@.+$". |
GUID |
metadata.product_log_id |
Diekstrak dari kolom data. |
guid |
metadata.product_log_id |
Diekstrak dari kolom data. |
headerfromHashedvalue |
additional.fields |
|
headertoHashedvalue |
additional.fields |
|
hostname |
principal.asset.hostname,principal.hostname |
Diekstrak dari kolom message. |
id |
additional.fields |
|
impostorScore |
security_result.detection_fields |
|
INBOUND |
network.direction |
Jika [rule] == "outbound", [filter][routeDirection] == "inbound", atau [quarantineRule] =~ "outbound". |
INFORMATIONAL |
security_result.severity |
Jika [audit][level] =~ "(?i)(notice)". |
intermediary.ip |
intermediary.asset.ip,intermediary.ip |
|
intermediary.ip1 |
intermediary.asset.ip,intermediary.ip |
|
intermediary_hostname |
intermediary.asset.hostname,intermediary.hostname |
Diekstrak dari kolom data. |
isArchive |
additional.fields |
|
isCorrupted |
additional.fields |
|
isDeleted |
additional.fields |
|
isProtected |
additional.fields |
|
isTimedOut |
additional.fields |
|
isVirtual |
additional.fields |
|
item.cluster |
security_result.detection_fields |
|
item.GUID |
security_result.detection_fields |
|
item.headerFrom |
security_result.detection_fields |
|
item.id |
security_result.detection_fields |
|
item.impostorScore |
security_result.detection_fields |
|
item.malwareScore |
security_result.detection_fields |
|
item.messageID |
security_result.detection_fields |
|
item.messageSize |
security_result.detection_fields |
|
item.modulesRun |
additional.fields |
|
item.phishScore |
security_result.detection_fields |
|
item.policyRoutes |
additional.fields |
|
item.QID |
security_result.detection_fields |
|
item.quarantineFolder |
security_result.detection_fields |
|
item.quarantineRule |
security_result.detection_fields |
|
item.sender |
principal.user.email_addresses |
Jika [item_sender] =~ "^.+@.+$". |
item.senderIP |
principal.asset.ip,principal.ip |
|
item.spamScore |
security_result.detection_fields |
|
item.subject |
network.email.subject |
|
item.threats.classification |
security_result.detection_fields |
|
item.threats.threat |
security_result.detection_fields |
|
item.threats.threatID |
security_result.detection_fields |
|
item.threats.threatStatus |
security_result.detection_fields |
|
item.threats.threatTime |
security_result.detection_fields |
|
item.threats.threatType |
security_result.detection_fields |
|
item.threats.threatUrl |
security_result.detection_fields |
|
key.data |
security_result.detection_fields |
|
labeledCharset |
additional.fields |
|
labeledExt |
additional.fields |
|
labeledMime |
about.file.mime_type |
|
labeledName |
about.file.full_path |
|
malwareScore |
security_result.detection_fields |
|
matches.offset |
additional.fields |
|
matches.part |
additional.fields |
|
MEDIUM |
security_result.severity |
Jika [audit][level] =~ "(?i)(warn)". |
messageID |
network.email.mail_id |
Diekstrak dari kolom data. |
messageSize |
security_result.detection_fields |
|
messageTime |
metadata.event_timestamp |
|
metadata.customerId |
principal.resource.attribute.labels |
|
metadata.origin.data.agent |
network.http.parsed_user_agent,network.http.user_agent |
Diekstrak dari key-value pair di kolom data. |
metadata.origin.data.cid |
additional.fields |
|
metadata.origin.data.mode |
additional.fields |
|
metadata.origin.data.theater |
additional.fields,principal.location.country_or_region |
principal.location.country_or_region diekstrak dari pasangan nilai kunci di kolom data. |
metadata.origin.data.version |
metadata.product_version |
Diekstrak dari key-value pair di kolom data. |
metadata.origin.schemaVersion |
additional.fields |
|
mod |
security_result.detection_fields |
|
modulesRun |
additional.fields |
|
msg.header.cc |
additional.fields |
|
msg.header.from |
additional.fields,principal.user.email_addresses |
principal.user.email_addresses dipetakan ke kolom ini menggunakan loop, dengan elemen array JSON digabungkan di sini, atau string non-JSON dipetakan di sini. |
msg.header.message-id.0 |
additional.fields,network.email.mail_id |
|
msg.header.reply-to.0 |
additional.fields,network.email.reply_to |
|
msg.header.to |
additional.fields,target.user.email_addresses |
target.user.email_addresses dipetakan di sini sebagai string non-JSON menggunakan loop. |
msg.header.x-mailer |
additional.fields |
|
msg.lang |
additional.fields |
|
msg.normalizedHeader.from |
principal.user.email_addresses |
Dipetakan ke kolom ini menggunakan loop. Elemen array JSON digabungkan di sini; string non-JSON dipetakan di sini. |
msg.normalizedHeader.subject |
network.email.subject |
Jika msg.normalizedHeader.subject tidak sama dengan nilai kolom log mentah subject. |
msg.normalizedHeader.to |
target.user.email_addresses |
Dipetakan ke kolom ini menggunakan loop. String non-JSON dipetakan di sini. |
msg.normalizedHeader.x-mailer |
additional.fields |
|
msg.parsedAddresses.from.0 |
additional.fields,network.email.from |
|
msg.parsedAddresses.to |
target.user.email_addresses |
Dipetakan ke kolom ini menggunakan loop. String non-JSON dipetakan di sini. |
msg.sizeBytes |
additional.fields |
|
msgBlocked.filename |
about.file.full_path |
|
msgBlocked.labeledMime |
about.file.mime_type |
|
msgBlocked.msgPart.detectedSizeBytes |
about.file.size |
|
msgBlocked.msgPart.md5 |
about.file.md5 |
|
msgheadersubject |
additional.fields |
|
msgheaderxmailervalue |
additional.fields |
|
msgPart.dataBase64 |
additional.fields |
|
msgPart.detectedCharset |
additional.fields |
|
msgPart.detectedMime |
additional.fields |
|
msgPart.detectedSizeBytes |
about.file.size |
|
msgPart.filename |
about.file.full_path |
|
msgPart.md5 |
about.file.md5 |
|
msgPart.metadata.appversion |
additional.fields |
|
msgPart.metadata.codepage |
additional.fields |
|
msgPart.metadata.color-scheme |
additional.fields |
|
msgPart.metadata.content-language |
additional.fields |
|
msgPart.metadata.format-detection |
additional.fields |
|
msgPart.metadata.history[1]/stevt:action |
additional.fields |
|
msgPart.metadata.history[1]/stevt:softwareagent |
additional.fields |
|
msgPart.metadata.history[1]/stevt:when |
additional.fields |
|
msgPart.oContentType |
additional.fields |
|
msgPart.sha256 |
about.file.sha256 |
|
msgs.metadata._PROOFPOINT_CONTENT_LENGTH_ |
additional.fields |
|
msgs.metadata.application |
additional.fields |
|
msgs.metadata.appname |
additional.fields |
|
msgs.metadata.author |
security_result.detection_fields |
|
msgs.metadata.company |
security_result.detection_fields |
|
msgs.metadata.createdate |
additional.fields |
|
msgs.metadata.documentid |
additional.fields |
|
msgs.metadata.instanceid |
additional.fields |
|
msgs.metadata.modifydate |
additional.fields |
|
msgs.metadata.pagecount |
additional.fields |
|
msgs.metadata.subject |
additional.fields |
|
msgs.metadata.title |
additional.fields |
|
msgs.textExtracted |
additional.fields |
|
msgUrls.url |
additional.fields,security_result.detection_fields |
|
normalizedHeader.x_originating_ip |
principal.asset.ip,principal.ip |
|
normalizedHeaderfromHashed |
additional.fields |
|
normalizedHeaderHashedvalue |
additional.fields |
|
normalizedHeaderMessageidvalue |
additional.fields |
|
normalizedheaderreplytohashed |
additional.fields |
|
normalizedheaderreturnpath |
additional.fields |
|
oContentType |
additional.fields |
|
OUTBOUND |
network.direction |
Jika [rule] == "outbound", [filter][routeDirection] == "outbound", atau [quarantineRule] =~ "outbound". |
parsed.useragent |
network.http.parsed_user_agent |
|
parsed_stat_value |
security_result.detection_fields |
|
parsedAddress |
network.email.cc |
Jika [parsedAddress] =~ "^.+@.+$". |
parsedAddressesfromHashedvalue |
additional.fields |
|
parsedaddressesreplytohashed |
additional.fields |
|
parsedAddrestoHashedvalue |
additional.fields |
|
phishScore |
security_result.detection_fields |
|
pid |
principal.process.pid |
Diekstrak dari kolom message. |
PoD |
metadata.product_name |
Penetapan statis. |
policy_route.* |
additional.fields |
[list_values] / menggunakan fungsi peta. |
policyRoutes |
additional.fields |
|
pps.agent |
observer.hostname |
|
prod_event_name |
metadata.product_event_type |
Diekstrak dari kolom message. |
Proofpoint |
metadata.vendor_name |
Penetapan statis. |
QID |
security_result.detection_fields |
|
QUARANTINE |
security_result.action |
Jika [filter][disposition] == "quarantine". |
quarantineFolder |
security_result.detection_fields |
|
quarantineRule |
security_result.detection_fields |
|
queryEndTime |
metadata.collected_timestamp |
|
rcd.error |
additional.fields |
|
rcd.record |
additional.fields |
|
rcpt |
additional.fields,security_result.detection_fields |
|
rcpt_hashed |
additional.fields |
|
reply |
network.email.reply_to |
Diekstrak dari key-value pair di kolom data. Jika [reply] =~ "^.+@.+$". |
replytohashed |
additional.fields |
|
res.emailIdentities.header.from |
additional.fields |
|
res.emailIdentities.smtp.mailfrom |
additional.fields |
|
res.emailIdentities.smtp.mailfromHashed |
additional.fields |
|
res.method |
additional.fields |
|
res.propspec.header.d |
additional.fields |
|
res.propspec.header.s |
additional.fields |
|
rules.name |
additional.fields |
|
rules.severity |
additional.fields |
|
s |
network.session_id |
Diekstrak dari kolom data. |
safeBlockedListMatches_listType |
security_result.detection_fields |
|
safeBlockedListMatchesvalue.listType |
security_result.detection_fields |
|
safeBlockedListMatchesvalue.rule |
security_result.detection_fields |
|
sandbox.status |
additional.fields |
|
sec_result_action |
security_result.action |
|
sec_result_category |
security_result.category |
|
sender |
principal.user.email_addresses |
Jika [sender] =~ "^.+@.+$". |
senderIP |
principal.asset.ip,principal.ip |
|
SENDMAIL |
metadata.product_event_type |
Jika [message] =~ "sendmail". |
sendmail_hostname |
principal.asset.hostname,principal.hostname |
Diekstrak dari kolom data. |
sendmail_process_name |
principal.process.file.full_path |
Diekstrak dari kolom data. |
sendmail_qid |
additional.fields |
|
sendmail_ts |
metadata.collected_timestamp |
Diekstrak dari kolom data. |
sig.engine |
security_result.detection_fields |
|
sig.isPresent |
security_result.detection_fields |
|
sig.signature |
security_result.detection_fields |
|
sizeDecodedBytes |
additional.fields |
|
sm.daemon |
additional.fields |
|
sm.delay |
additional.fields |
|
sm.dsn |
additional.fields |
|
sm.from |
network.email.from |
Diekstrak dari key-value pair di kolom data. Jika [email_src] =~ "^.+@.+$". |
sm.guid |
metadata.product_log_id |
Diekstrak dari key-value pair di kolom data. Jika [message] =~ "sendmail". |
sm.mailer |
additional.fields |
|
sm.messageTs |
additional.fields |
|
sm.msgid |
network.email.mail_id |
Diekstrak dari key-value pair di kolom data. |
sm.nrcpts |
additional.fields |
|
sm.pri |
additional.fields |
|
sm.qid |
security_result.detection_fields |
|
sm.stat |
security_result.description |
Diekstrak dari key-value pair di kolom data. |
sm.xdelay |
additional.fields |
|
smtoemail |
network.email.to |
Jika [sm_to_email] =~ "^.+@.+$". |
spamScore |
security_result.detection_fields |
|
SpamType |
security_result.detection_fields |
|
subject |
network.email.subject |
|
suborgs |
additional.fields |
|
threat |
security_result.detection_fields |
|
threatType |
security_result.detection_fields |
|
tls.verify |
security_result.action_details |
Diekstrak dari key-value pair di kolom data. Jika [tls_verify] not in ["", "null", "None", "none", "NONE"]. |
to |
network.email.to |
Jika [to] =~ "^.+@.+$". |
ts |
metadata.event_timestamp |
|
uinteger |
network.received_bytes,network.sent_bytes |
|
UNKNOWN_ACTION |
security_result.action |
Jika [filter][disposition] in ["hold", "retry"]. |
UNKNOWN_SEVERITY |
security_result.severity |
|
urlsource |
security_result.detection_fields |
|
value |
additional.fields |
|
x_originating_ip |
principal.asset.ip,principal.ip |
Referensi delta pemetaan UDM
Pada 13 Oktober 2026, Google SecOps merilis versi baru parser Proofpoint On-Demand, yang mencakup perubahan signifikan pada pemetaan kolom log Proofpoint On-Demand ke kolom UDM dan pembaruan pada klasifikasi menurut jenis (pemetaan) peristiwa.
Delta pemetaan kolom log
Tabel berikut menunjukkan perubahan pada cara kolom log Proofpoint On-Demand dipetakan ke kolom UDM. Kolom Pemetaan lama mencantumkan kolom yang ditampilkan sebelum 13 Oktober 2026, dan kolom Pemetaan saat ini mencantumkan kolom baru.
| Kolom log | Pemetaan lama | Pemetaan saat ini |
|---|---|---|
connection.sid |
additional.fields |
security_result.detection_fields |
filter.modules.pdr.v2.response |
additional.fields |
security_result.detection_fields |
filter.modules.urldefense.counts.total |
additional.fields |
security_result.detection_fields |
filter.quarantine.expirationTs |
additional.fields |
security_result.detection_fields |
filter.quarantine.folder |
additional.fields |
security_result.detection_fields |
filter.quarantine.folderId |
additional.fields |
security_result.detection_fields |
filter.quarantine.module |
additional.fields |
security_result.detection_fields |
filter.quarantine.rule |
additional.fields |
security_result.detection_fields |
filter.quarantine.type |
additional.fields |
security_result.detection_fields |
messageTime |
additional.fields |
metadata.event_timestamp |
messagesBlocked.spamScore |
additional.fields |
security_result.detection_fields |
metadata.customerId |
additional.fields |
principal.resource.attribute.labelsmod |
msgParts.detectedSizeBytes |
additional.fields |
about.file.size |
msg_header_from_json_array.value |
additional.fields |
principal.user.email_addresses |
principal.resource.attribute.labelsmod |
additional.fields |
security_result.detection_fields |
Log Perubahan
Melihat Log Perubahan untuk parser ini
Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.