Zscaler Webproxy ログを収集する

以下でサポートされています。

Google SecOps SIEM

このドキュメントでは、Google Security Operations フィードを設定して Zscaler Webproxy のログをエクスポートする方法と、ログフィールドが Google SecOps 統合データモデル（UDM）フィールドにマッピングする方法について説明します。

詳細については、Google SecOps へのデータの取り込みの概要をご覧ください。

一般的なデプロイは、Zscaler Webproxy と、Google SecOps にログを送信するように構成された Google SecOps Webhook フィードで構成されます。お客様のデプロイはそれぞれ異なり、より複雑になる場合もあります。

デプロイには次のコンポーネントが含まれます。

Zscaler Webproxy: ログを収集するプラットフォーム。
Google SecOps フィード: Zscaler Webproxy からログを取得して Google SecOps に書き込む Google SecOps フィード。
Google SecOps: ログを保持して分析します。

取り込みラベルによって、未加工のログデータを構造化 UDM 形式に正規化するパーサーが識別されます。このドキュメントの情報は、取り込みラベル ZSCALER_WEBPROXY が付加されたパーサーに適用されます。

始める前に

次の前提条件を満たしていることを確認します。

Zscaler Internet Access コンソールへのアクセス権。詳細については、インターネットと SaaS への安全なアクセス ZIA のヘルプをご覧ください。
Zscaler Webproxy 2024 以降
デプロイアーキテクチャ内のすべてのシステムが、UTC タイムゾーンで構成されている。
Google Security Operations でフィードの設定を完了するために必要な API キー。詳細については、API キーの設定をご覧ください。

フィードを設定する

Google SecOps プラットフォームでフィードを設定するには、次の 2 つのエントリポイントがあります。

[SIEM 設定] > [フィード]
[Content Hub] > [Content Packs]

[SIEM 設定] > [フィード] でフィードを設定する

このプロダクトファミリー内で異なるログタイプに対して複数のフィードを構成するには、プロダクト別にフィードを構成するをご覧ください。

単一のフィードを構成する手順は次のとおりです。

[SIEM 設定] > [フィード] に移動します。
[Add New Feed] をクリックします。
次のページで、[単一のフィードを設定] をクリックします。
[フィード名] フィールドに、フィードの名前を入力します（例: Zscaler Webproxy Logs）。
[ソースの種類] として [Webhook] を選択します。
[ログタイプ] として [Zscaler] を選択します。
[次へ] をクリックします。
省略可: 次の入力パラメータの値を入力します。
1. Split delimiter: ログ行を区切るために使用される区切り文字。区切り文字を使用しない場合は空白のままにします。
2. アセットの名前空間: アセットの名前空間。
3. Ingestion labels: このフィードのイベントに適用されるラベル。
[次へ] をクリックします。
新しいフィードの設定を確認し、[送信] をクリックします。
[シークレットキーを生成する] をクリックして、このフィードを認証するためのシークレットキーを生成します。

コンテンツハブからフィードを設定する

次のフィールドに値を指定します。

Split delimiter: ログ行を区切るために使用される区切り文字（\n など）。

詳細オプション

フィード名: フィードを識別する事前入力された値。
ソースタイプ: ログを Google SecOps に収集するために使用される方法。
アセットの名前空間: アセットの名前空間。
Ingestion labels: このフィードのイベントに適用されるラベル。
[次へ] をクリックします。
[Finalize] 画面でフィードの設定を確認し、[Submit] をクリックします。
[秘密鍵を生成する] をクリックして、このフィードを認証するためのシークレットキーを生成します。

Zscaler Webproxy を設定する

Zscaler Internet Access コンソールで、[管理> Nanolog ストリーミングサービス > クラウド NSS フィード] をクリックし、[クラウド NSS フィードを追加] をクリックします。
[クラウド NSS フィードを追加] ウィンドウが表示されます。[クラウド NSS フィードを追加] ウィンドウで詳細を入力します。
[フィード名] フィールドにフィードの名前を入力します。
[NSS タイプ] で [NSS for Web] を選択します。
[ステータス] リストからステータスを選択して、NSS フィードを有効または無効にします。
[SIEM レート] プルダウンの値は [無制限] のままにします。ライセンスなどの制約により出力ストリームを抑制するには、値を変更します。
[SIEM タイプ] リストで [その他] を選択します。
[OAuth 2.0 認証] リストで [無効] を選択します。
最大バッチサイズに、個々の HTTP リクエストペイロードのサイズ上限を SIEM のベストプラクティスに沿って入力します。たとえば、512 KB などです。
Chronicle API エンドポイントの HTTPS URL を次の形式で API URL に入力します。
```
  https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
```
- CHRONICLE_REGION: Chronicle インスタンスがホストされているリージョン。たとえば US。
- GOOGLE_PROJECT_NUMBER: BYOP プロジェクト番号。これは C4 から取得します。
- LOCATION: Chronicle のリージョン。たとえば US。
- CUSTOMER_ID: Chronicle のお客様 ID。C4 から取得します。
- FEED_ID: 新しいウェブフックの作成時にフィード UI に表示されるフィード ID
- API URL の例:
```
https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
```
[HTTP ヘッダーを追加] をクリックし、次の形式で HTTP ヘッダーを追加します。
- Header 1: Key1: X-goog-api-key、Value1: Google Cloud BYOP の API 認証情報で生成された API キー。
- Header 2: Key2: X-Webhook-Access-Key と Value2: ウェブフックの [SECRET KEY] で生成された API シークレットキー。
[ログタイプ] リストで [Web Logs] を選択します。
[フィード出力タイプ] リストで [JSON] を選択します。
[JSON Array Notation] を無効にします。
[Feed Escape Character] を , \ " に設定します。
フィード出力形式に新しいフィールドを追加するには、[フィード出力タイプ] リストで [カスタム] を選択します。
[フィード出力形式] をコピーして貼り付け、新しいフィールドを追加します。キー名が実際のフィールド名と一致していることを確認します。

デフォルトの [フィード出力形式] は次のとおりです。

  \{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%d{yy}-%02d{mth}-%02d{dd} %02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{sip}","requestmethod":"%s{reqmethod}","refererURL":"%s{ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zscaler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malwarecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}","app_status":"%s{app_status}","pagerisk":"%d{riskscore}","threatseverity":"%s{threatseverity}","department":"%s{edepartment}","urlsupercategory":"%s{urlsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclass}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fileclass}","bwthrottle":"%s{bwthrottle}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","keyprotectiontype":"%s{keyprotectiontype}"\}\}

[タイムゾーン] リストで、出力ファイルの [時間] フィールドのタイムゾーンを選択します。デフォルトでは、タイムゾーンは組織のタイムゾーンに設定されています。
構成された設定を確認します。
[保存] をクリックして接続をテストします。接続に成功すると、緑色のチェックマークと [Test Connectivity Successful: OK (200)] というメッセージが表示されます。

Google SecOps フィードの詳細については、Google SecOps フィードのドキュメントをご覧ください。各フィードタイプの要件については、タイプ別のフィード構成をご覧ください。

フィードの作成時に問題が発生した場合は、Google SecOps サポートにお問い合わせください。

サポートされている Zscaler Webproxy ログ形式

Zscaler Webproxy パーサーは JSON 形式のログをサポートしています。

サポートされている Zscaler Webproxy のサンプルログ

JSON

  {
    "event": {
      "ClientIP": "198.51.100.0",
      "action": "Allowed",
      "appclass": "Sales and Marketing",
      "appname": "Trend Micro",
      "bwthrottle": "NO",
      "clientpublicIP": "198.51.100.1",
      "contenttype": "Other",
      "datetime": "2024-05-06 10:56:04",
      "department": "Mid-Continent%20Companies",
      "devicehostname": "dummyhostname",
      "deviceowner": "dummydeviceowner",
      "dlpdictionaries": "None",
      "dlpengine": "None",
      "event_id": "7365838693731467265",
      "fileclass": "None",
      "filetype": "None",
      "hostname": "dummyhostname.com",
      "keyprotectiontype": "N/A",
      "location": "Road%20Warrior",
      "pagerisk": "0",
      "product": "NSS",
      "protocol": "HTTP_PROXY",
      "reason": "Allowed",
      "refererURL": "None",
      "requestmethod": "CONNECT",
      "requestsize": "606",
      "responsesize": "65",
      "serverip": "198.51.10.2",
      "status": "200",
      "threatcategory": "None",
      "threatclass": "None",
      "threatname": "None",
      "threatseverity": "None",
      "transactionsize": "671",
      "unscannabletype": "None",
      "url": "dummyurl.com:443",
      "urlcategory": "SSL - DNI - Bypass",
      "urlclass": "Bandwidth Loss",
      "urlsupercategory": "User-defined",
      "user": "abc@xyz.com",
      "useragent": "dummyuseragent",
      "vendor": "Zscaler"
    },
    "sourcetype": "zscalernss-web"
  }

フィールドマッピングリファレンス

次の表に、ZSCALER_WEBPROXY ログタイプのログフィールドと、対応する UDM フィールドを示します。

Log field	UDM mapping	Logic
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Zscaler`.
	`metadata.event_type`	If the `ClientIP` log field value is not empty and the `serverip` log field value is not empty and the `proto` log field value contain one of the following values, then the `metadata.event_type` UDM field is set to `NETWORK_HTTP`. `HTTPS` `HTTP` Else, if the `ClientIP` log field value is not empty and the `serverip` log field value is not empty, then the `metadata.event_type` UDM field is set to `NETWORK_CONNECTION`. Else, if the `user` log field value is not empty or the `deviceowner` log field value is not empty, then the `metadata.event_type` UDM field is set to `USER_UNCATEGORIZED`. Else, the `metadata.event_type` UDM field is set to `GENERIC_EVENT`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Web Proxy`.
`sourcetype`	`additional.fields[sourcetype]`
`datetime`	`metadata.event_timestamp`
`tz`	`additional.fields[tz]`
`ss`	`additional.fields[ss]`
`mm`	`additional.fields[mm]`
`hh`	`additional.fields[hh]`
`dd`	`additional.fields[dd]`
`mth`	`additional.fields[mth]`
`yyyy`	`additional.fields[yyyy]`
`mon`	`additional.fields[mon]`
`day`	`additional.fields[day]`
`department`	`principal.user.department`
`b64dept`	`principal.user.department`
`edepartment`	`principal.user.department`
`user`	`principal.user.email_addresses`
`user`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `user` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`b64login`	`principal.user.email_addresses`
`elogin`	`principal.user.email_addresses`
`ologin`	`additional.fields[ologin]`
`cloudname`	`principal.user.attribute.labels[cloudname]`
`company`	`principal.user.company_name`
`throttlereqsize`	`security_result.detection_fields[throttlereqsize]`
`throttlerespsize`	`security_result.detection_fields[throttlerespsize]`
`bwthrottle`	`security_result.detection_fields[bwthrottle]`
	`security_result.category`	If the `bwthrottle` log field value is equal to `Yes`, then the `security_result.category` UDM field is set to `POLICY_VIOLATION`.
`bwclassname`	`security_result.detection_fields[bwclassname]`
`obwclassname`	`security_result.detection_fields[obwclassname]`
`bwrulename`	`security_result.rule_name`
`appname`	`target.application`
`appclass`	`target.security_result.detection_fields[appclass]`
`module`	`target.security_result.detection_fields[module]`
`app_risk_score`	`target.security_result.risk_score`	If the `app_risk_score` log field value matches the regular expression pattern `[0-9]+`, then the `app_risk_score` log field is mapped to the `security_result.risk_score` UDM field.
`datacenter`	`target.location.name`
`datacentercity`	`target.location.city`
`datacentercountry`	`target.location.country_or_region`
`dlpdictionaries`	`security_result.detection_fields[dlpdictionaries]`
`odlpdict`	`security_result.detection_fields[odlpdict]`
`dlpdicthitcount`	`security_result.detection_fields[dlpdicthitcount]`
`dlpengine`	`security_result.detection_fields[dlpengine]`
`odlpeng`	`security_result.detection_fields[odlpeng]`
`dlpidentifier`	`security_result.detection_fields[dlpidentifier]`
`dlpmd5`	`security_result.detection_fields[dlpmd5]`
`dlprulename`	`security_result.rule_name`
`odlprulename`	`security_result.detection_fields[odlprulename]`
`fileclass`	`additional.fields[fileclass]`
`filetype`	`target.file.file_type`	If the `filetype` log field value matches the regular expression `(?i)(xlsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLSX`. Else, if the `filetype` log field value matches the regular expression `(?i)(xls)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLS`. Else, if the `filetype` log field value matches the regular expression `(?i)(cab)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAB`. Else, if the `filetype` log field value matches the regular expression `(?i)(pcapng\|pcap\|cap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAP`. Else, if the `filetype` log field value matches the regular expression `(?i)(tar.gz\|egg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_PKG`. Else, if the `filetype` log field value matches the regular expression `(?i)(gzip\|tgz\|gz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(zip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(gif)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIF`. Else, if the log message matches the regular expression `(?i)(\\bdos\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe\|com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_EXE`. Else, if the log message matches the regular expression `(?i)(\\bne_exe\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_EXE`. Else, if the `filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_EXE`. Else, if the `filetype` log field value matches the regular expression `(?i)(msi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSI`. Else, if the `filetype` log field value matches the regular expression `(?i)(ocx\|sys)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_DLL`. Else, if the `filetype` log field value matches the regular expression `(?i)(pdf\|(portable\\sdocument\\sformat))`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDF`. Else, if the `filetype` log field value matches the regular expression `(?i)(docx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOCX`. Else, if the `filetype` log field value matches the regular expression `(?i)(doc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOC`. Else, if the `filetype` log field value matches the regular expression `(?i)(html\|htm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HTML`. Else, if the `filetype` log field value matches the regular expression `(?i)(jar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(jpeg\|jpg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JPEG`. Else, if the `filetype` log field value matches the regular expression `(?i)(mov)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MOV`. Else, if the `filetype` log field value matches the regular expression `(?i)(mp3)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP3`. Else, if the `filetype` log field value matches the regular expression `(?i)(mp4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP4`. Else, if the `filetype` log field value matches the regular expression `(?i)(png)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PNG`. Else, if the `filetype` log field value matches the regular expression `(?i)(pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPTX`. Else, if the `filetype` log field value matches the regular expression `(?i)(ppt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(rar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(ace)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ACE`. Else, if the `filetype` log field value matches the regular expression `(?i)(apk\|aar\|dex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ANDROID`. Else, if the `filetype` log field value matches the regular expression `(?i)(plist)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE_PLIST`. Else, if the `filetype` log field value matches the regular expression `(?i)(applescript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(app)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE`. Else, if the `filetype` log field value matches the regular expression `(?i)(scpt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT_COMPILED`. Else, if the `filetype` log field value matches the regular expression `(?i)(arc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARC`. Else, if the `filetype` log field value matches the regular expression `(?i)(arj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARJ`. Else, if the `filetype` log field value matches the regular expression `(?i)(asd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASD`. Else, if the `filetype` log field value matches the regular expression `(?i)(asf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASF`. Else, if the `filetype` log field value matches the regular expression `(?i)(avi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AVI`. Else, if the `filetype` log field value matches the regular expression `(?i)(awk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AWK`. Else, if the `filetype` log field value matches the regular expression `(?i)(bmp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BMP`. Else, if the `filetype` log field value matches the regular expression `(?i)(dib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIB`. Else, if the `filetype` log field value matches the regular expression `(?i)(bz2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(chm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CHM`. Else, if the `filetype` log field value matches the regular expression `(?i)(cljc\|cljs\|clj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CLJ`. Else, if the `filetype` log field value matches the regular expression `(?i)(crt\|cer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRT`. Else, if the `filetype` log field value matches the regular expression `(?i)(crx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRX`. Else, if the `filetype` log field value matches the regular expression `(?i)(csv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CSV`. Else, if the `filetype` log field value matches the regular expression `(?i)(deb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DEB`. Else, if the `filetype` log field value matches the regular expression `(?i)(dmg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DMG`. Else, if the `filetype` log field value matches the regular expression `(?i)(divx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIVX`. Else, if the `filetype` log field value matches the regular expression `(?i)(com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_COM`. Else, if the `filetype` log field value matches the regular expression `(?i)(dwg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DWG`. Else, if the `filetype` log field value matches the regular expression `(?i)(dxf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DXF`. Else, if the `filetype` log field value matches the regular expression `(?i)(dyalog)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DYALOG`. Else, if the `filetype` log field value matches the regular expression `(?i)(dzip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(epub\|mobi\|azw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EBOOK`. Else, if the `filetype` log field value matches the regular expression `(?i)(elf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ELF`. Else, if the `filetype` log field value matches the regular expression `(?i)(eml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `filetype` log field value matches the regular expression `(?i)(emf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMF`. Else, if the `filetype` log field value matches the regular expression `(?i)(eot)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EOT`. Else, if the `filetype` log field value matches the regular expression `(?i)(eps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EPS`. Else, if the `filetype` log field value matches the regular expression `(?i)(flac)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLAC`. Else, if the `filetype` log field value matches the regular expression `(?i)(fla)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLA`. Else, if the `filetype` log field value matches the regular expression `(?i)(fli)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLI`. Else, if the `filetype` log field value matches the regular expression `(?i)(flc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLC`. Else, if the `filetype` log field value matches the regular expression `(?i)(flv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLV`. Else, if the `filetype` log field value matches the regular expression `(?i)(fpx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FPX`. Else, if the `filetype` log field value matches the regular expression `(?i)(xcf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIMP`. Else, if the `filetype` log field value matches the regular expression `(?i)(go)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GOLANG`. Else, if the `filetype` log field value matches the regular expression `(?i)(gul)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GUL`. Else, if the `filetype` log field value matches the regular expression `(?i)(hwp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HWP`. Else, if the `filetype` log field value matches the regular expression `(?i)(ico)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ICO`. Else, if the `filetype` log field value matches the regular expression `(?i)(indd\|idml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IN_DESIGN`. Else, if the `filetype` log field value matches the regular expression `(?i)(ipa)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPHONE`. Else, if the `filetype` log field value matches the regular expression `(?i)(ips)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPS`. Else, if the `filetype` log field value matches the regular expression `(?i)(iso)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ISOIMAGE`. Else, if the `filetype` log field value matches the regular expression `(?i)(java)` AND the `filetype` log field value does NOT match the regular expression `(?i)(javascript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA`. Else, if the `filetype` log field value matches the regular expression `(?i)(class)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA_BYTECODE`. Else, if the `filetype` log field value matches the regular expression `(?i)(jmod)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JMOD`. Else, if the `filetype` log field value matches the regular expression `(?i)(jng)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JNG`. Else, if the `filetype` log field value matches the regular expression `(?i)(json)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JSON`. Else, if the `filetype` log field value matches the regular expression `(?i)(js)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVASCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(kgb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_KGB`. Else, if the `filetype` log field value matches the regular expression `(?i)(tex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LATEX`. Else, if the `filetype` log field value matches the regular expression `(?i)(lzfse)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LZFSE`. Else, if the `filetype` log field value matches the regular expression `(?i)(vmlinuz\|ko)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX_KERNEL`. Else, if the `filetype` log field value matches the regular expression `(?i)(bundle\|framework)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the log message matches the regular expression `(?i)(\\bmach\\b)` AND the `filetype` log field value matches the regular expression `(?i)(dylib\|o)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the `filetype` log field value matches the regular expression `(?i)(so\|initrd\|vmlinux\|pkg.tar.zst\|ext4\|ext3\|ext2\|swap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `filetype` log field value matches the regular expression `(?i)(ini)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_INI`. Else, if the log message matches the regular expression `(?i)(\\blinux\\b)` AND the `filetype` log field value matches the regular expression `sfs`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `filetype` log field value matches the regular expression `(?i)(lnk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LNK`. Else, if the `filetype` log field value matches the regular expression `(?i)(m4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_M4`. Else, if the `filetype` log field value matches the regular expression `(?i)(midi\|mid)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MIDI`. Else, if the `filetype` log field value matches the regular expression `(?i)(mkv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MKV`. Else, if the `filetype` log field value matches the regular expression `(?i)(mpg\|mpeg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MPEG`. Else, if the `filetype` log field value matches the regular expression `(?i)(sz_)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSCOMPRESS`. Else, if the `filetype` log field value matches the regular expression `(?i)(dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_DLL`. Else, if the `filetype` log field value matches the regular expression `(?i)(odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODG`. Else, if the `filetype` log field value matches the regular expression `(?i)(odp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODP`. Else, if the `filetype` log field value matches the regular expression `(?i)(ods)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODS`. Else, if the `filetype` log field value matches the regular expression `(?i)(odt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODT`. Else, if the `filetype` log field value matches the regular expression `(?i)(ogg\|oga\|ogv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OGG`. Else, if the `filetype` log field value matches the regular expression `(?i)(one)` AND the `filetype` log field value does NOT match the regular expression `(?i)(none)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ONE_NOTE`. Else, if the `filetype` log field value matches the regular expression `(?i)(pst\|ost)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\boutlook\\b)` AND the `filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\bemail\\b)` AND the `filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `filetype` log field value matches the regular expression `(?i)(prc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PALMOS`. Else, if the `filetype` log field value matches the regular expression `(?i)(pdb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDB`. Else, if the `filetype` log field value matches the regular expression `(?i)(pem)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PEM`. Else, if the `filetype` log field value matches the regular expression `(?i)(pgp\|gpg\|asc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PGP`. Else, if the `filetype` log field value matches the regular expression `(?i)(php)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PHP`. Else, if the `filetype` log field value matches the regular expression `(?i)(pkg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PKG`. Else, if the `filetype` log field value matches the regular expression `(?i)(ps1\|psm1)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_POWERSHELL`. Else, if the `filetype` log field value matches the regular expression `(?i)(ppsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPSX`. Else, if the `filetype` log field value matches the regular expression `(?i)(psd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PSD`. Else, if the `filetype` log field value matches the regular expression `(?i)(ps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PS`. Else, if the `filetype` log field value matches the regular expression `(?i)(pyc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYC`. Else, if the `filetype` log field value matches the regular expression `(?i)(py\|pyw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON`. Else, if the `filetype` log field value matches the regular expression `(?i)(whl)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_WHL`. Else, if the `filetype` log field value matches the regular expression `(?i)(qt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_QUICKTIME`. Else, if the `filetype` log field value matches the regular expression `(?i)(rm\|rmvb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rom\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ROM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rpm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RPM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rtf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RTF`. Else, if the `filetype` log field value matches the regular expression `(?i)(rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RUBY`. Else, if the `filetype` log field value matches the regular expression `(?i)(rz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(7z)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SEVENZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(sgml\|sgm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SGML`. Else, if the `filetype` log field value matches the regular expression `(?i)(bash\|csh\|zsh)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(sql)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQL`. Else, if the `filetype` log field value matches the regular expression `(?i)(sqfs\|sfs)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQUASHFS`. Else, if the `filetype` log field value matches the regular expression `(?i)(svg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SVG`. Else, if the `filetype` log field value matches the regular expression `(?i)(swf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SWF`. Else, if the `filetype` log field value matches the regular expression `(?i)(sis\|sisx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SYMBIAN`. Else, if the `filetype` log field value matches the regular expression `(?i)(3gp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_T3GP`. Else, if the `filetype` log field value matches the regular expression `(?i)(tar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(tga)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TARGA`. Else, if the `filetype` log field value matches the regular expression `(?i)(3ds\|max)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_THREEDS`. Else, if the `filetype` log field value matches the regular expression `(?i)(tif\|tiff)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TIFF`. Else, if the `filetype` log field value matches the regular expression `(?i)(torrent)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TORRENT`. Else, if the `filetype` log field value matches the regular expression `(?i)(ttf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TTF`. Else, if the `filetype` log field value matches the regular expression `(?i)(vba)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VBA`. Else, if the `filetype` log field value matches the regular expression `(?i)(vhd\|vhdx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VHD`. Else, if the `filetype` log field value matches the regular expression `(?i)(wav)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WAV`. Else, if the `filetype` log field value matches the regular expression `(?i)(webm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBM`. Else, if the `filetype` log field value matches the regular expression `(?i)(webp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBP`. Else, if the `filetype` log field value matches the regular expression `(?i)(wer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WER`. Else, if the `filetype` log field value matches the regular expression `(?i)(wma)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMA`. Else, if the `filetype` log field value matches the regular expression `(?i)(wmv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMV`. Else, if the `filetype` log field value matches the regular expression `(?i)(woff\|woff2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WOFF`. Else, if the `filetype` log field value matches the regular expression `(?i)(xml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XML`. Else, if the `filetype` log field value matches the regular expression `(?i)(xpi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XPI`. Else, if the `filetype` log field value matches the regular expression `(?i)(xwd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XWD`. Else, if the `filetype` log field value matches the regular expression `(?i)(zst)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZST`. Else, if the `filetype` log field value matches the regular expression `(?i)(Makefile\|makefile\|mk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MAKEFILE`. Else, if the `filetype` log field value matches the regular expression `(?i)(zlib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZLIB`. Else, if the `filetype` log field value matches the regular expression `(?i)(hqx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH`. Else, if the `filetype` log field value matches the regular expression `(?i)(hfs\|dsk\|toast)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_HFS`. Else, if the `filetype` log field value matches the regular expression `(?i)(bh\|log\|dat)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BLACKHOLE`. Else, if the log message matches the regular expression `(?i)(\\bcookie\\b)` AND the `filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COOKIE`. Else, if the `filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TEXT`. Else, if the `filetype` log field value matches the regular expression `(?i)(docx\|xlsx\|pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OOXML`. Else, if the `filetype` log field value matches the regular expression `(?i)(odt\|ods\|odp\|odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODF`. Else, if the `filetype` log field value matches the regular expression `(?i)(for\|f90\|f95)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, if the log message matches the regular expression `(?i)(\\bwince\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe\|cab\|dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WINCE`. Else, if the log message matches the regular expression `(?i)(\\bscript\\b)` AND the `filetype` log field value matches the regular expression `(?i)(py\|js\|pl\|rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SCRIPT`. Else, if the log message matches the regular expression `(?i)(\\bapplesingle\\b)` AND the `filetype` log field value matches the regular expression `(?i)(as\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESINGLE`. Else, if the log message matches the regular expression `(?i)(\\bmacintosh\\b)` AND the `filetype` log field value matches the regular expression `(?i)(dylib\|a)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_LIB`. Else, if the log message matches the regular expression `(?i)(\\bappledouble\\b)` AND the `filetype` log field value matches the regular expression `(?i)(ad\|._)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLEDOUBLE`. Else, if the log message matches the regular expression `(?i)(\\bobjetivec\\b)` AND the `filetype` log field value matches the regular expression `(?i)(m\|mm\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OBJETIVEC`. Else, if the `filetype` log field value matches the regular expression `(?i)(obj\|lib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COFF`. Else, if the log message matches the regular expression `(?i)(\\bcpp\\b)` AND the `filetype` log field value matches the regular expression `(?i)(hpp\|cpp\|cc\|cxx\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CPP`. Else, if the `filetype` log field value matches the regular expression `(?i)(pas\|pp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PASCAL`. Else, if the `filetype` log field value matches the regular expression `(?i)(pl\|pm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PERL`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bsh\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bc\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_C`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bn\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NEKO`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bf\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, the UDM field `additional.fields.key` is set to `file_type` and the log field value `filetype` is mapped to the `additional.fields.value` UDM field, provided the `filetype` value is not empty.
`filename`	`target.file.full_path`
`b64filename`	`target.file.full_path`
`efilename`	`target.file.full_path`
`filesubtype`	`additional.fields[filesubtype]`
`upload_fileclass`	`additional.fields[upload_fileclass]`
`upload_filetype`	`target.file.file_type`	If the `filetype` log field value is empty or equal to `None` and the `upload_filetype` log field value is not empty and not equal to `None`, then: If the `upload_filetype` log field value matches the regular expression `(?i)(xlsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLSX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xls)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(cab)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pcapng\|pcap\|cap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tar.gz\|egg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_PKG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gzip\|tgz\|gz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gif)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIF`. Else, if the log message matches the regular expression `(?i)(\\bdos\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe\|com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_EXE`. Else, if the log message matches the regular expression `(?i)(\\bne_exe\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_EXE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_EXE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(msi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ocx\|sys)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_DLL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pdf\|(portable\\sdocument\\sformat))`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(docx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOCX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(doc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(html\|htm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HTML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jpeg\|jpg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JPEG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mov)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MOV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mp3)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP3`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mp4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP4`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(png)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PNG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPTX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ppt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ace)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ACE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(apk\|aar\|dex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ANDROID`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(plist)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE_PLIST`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(applescript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(app)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(scpt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT_COMPILED`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(arc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(arj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARJ`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(asd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(asf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(avi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AVI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(awk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AWK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bmp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BMP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bz2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(chm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CHM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(cljc\|cljs\|clj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CLJ`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(crt\|cer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(crx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(csv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CSV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(deb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DEB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dmg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DMG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(divx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIVX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_COM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dwg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DWG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dxf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DXF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dyalog)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DYALOG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dzip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(epub\|mobi\|azw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EBOOK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(elf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ELF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(emf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eot)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EOT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EPS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flac)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLAC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fla)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fli)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fpx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FPX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xcf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIMP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(go)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GOLANG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gul)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GUL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hwp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HWP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ico)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ICO`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(indd\|idml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IN_DESIGN`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ipa)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPHONE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ips)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(iso)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ISOIMAGE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(java)` AND the `upload_filetype` log field value does NOT match the regular expression `(?i)(javascript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(class)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA_BYTECODE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jmod)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JMOD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jng)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JNG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(json)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JSON`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(js)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVASCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(kgb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_KGB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LATEX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(lzfse)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LZFSE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vmlinuz\|ko)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX_KERNEL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bundle\|framework)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the log message matches the regular expression `(?i)(\\bmach\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(dylib\|o)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(so\|initrd\|vmlinux\|pkg.tar.zst\|ext4\|ext3\|ext2\|swap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ini)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_INI`. Else, if the log message matches the regular expression `(?i)(\\blinux\\b)` AND the `upload_filetype` log field value matches the regular expression `sfs`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(lnk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LNK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(m4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_M4`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(midi\|mid)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MIDI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mkv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MKV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mpg\|mpeg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MPEG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sz_)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSCOMPRESS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_DLL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ods)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ogg\|oga\|ogv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OGG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(one)` AND the `upload_filetype` log field value does NOT match the regular expression `(?i)(none)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ONE_NOTE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pst\|ost)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\boutlook\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\bemail\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(prc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PALMOS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pdb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pem)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PEM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pgp\|gpg\|asc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PGP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(php)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PHP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pkg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PKG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ps1\|psm1)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_POWERSHELL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ppsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPSX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(psd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PSD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pyc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(py\|pyw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(whl)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_WHL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(qt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_QUICKTIME`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rm\|rmvb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rom\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ROM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rpm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RPM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rtf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RTF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RUBY`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(7z)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SEVENZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sgml\|sgm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SGML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bash\|csh\|zsh)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sql)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sqfs\|sfs)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQUASHFS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(svg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SVG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(swf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SWF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sis\|sisx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SYMBIAN`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(3gp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_T3GP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tga)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TARGA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(3ds\|max)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_THREEDS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tif\|tiff)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TIFF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(torrent)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TORRENT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ttf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TTF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vba)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VBA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vhd\|vhdx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VHD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wav)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WAV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(webm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(webp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WER`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wma)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wmv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(woff\|woff2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WOFF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xpi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XPI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xwd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XWD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zst)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZST`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(Makefile\|makefile\|mk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MAKEFILE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zlib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZLIB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hqx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hfs\|dsk\|toast)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_HFS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bh\|log\|dat)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BLACKHOLE`. Else, if the log message matches the regular expression `(?i)(\\bcookie\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COOKIE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TEXT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(docx\|xlsx\|pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OOXML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odt\|ods\|odp\|odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(for\|f90\|f95)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, if the log message matches the regular expression `(?i)(\\bwince\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe\|cab\|dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WINCE`. Else, if the log message matches the regular expression `(?i)(\\bscript\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(py\|js\|pl\|rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SCRIPT`. Else, if the log message matches the regular expression `(?i)(\\bapplesingle\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(as\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESINGLE`. Else, if the log message matches the regular expression `(?i)(\\bmacintosh\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(dylib\|a)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_LIB`. Else, if the log message matches the regular expression `(?i)(\\bappledouble\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(ad\|._)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLEDOUBLE`. Else, if the log message matches the regular expression `(?i)(\\bobjetivec\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(m\|mm\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OBJETIVEC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(obj\|lib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COFF`. Else, if the log message matches the regular expression `(?i)(\\bcpp\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(hpp\|cpp\|cc\|cxx\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CPP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pas\|pp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PASCAL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pl\|pm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PERL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bsh\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bc\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_C`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bn\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NEKO`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bf\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, the UDM field `additional.fields.key` is set to `file_type` and the log field value `upload_filetype` is mapped to the `additional.fields.value` UDM field, provided the `upload_filetype` value is not empty.
`upload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `upload_filename` log field value is not equal to `None`, then the `upload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `upload_filename` log field value is not equal to `None`, then the `upload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`b64upload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `b64upload_filename` log field value is not equal to `None`, then the `b64upload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `b64upload_filename` log field value is not equal to `None`, then the `b64upload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`eupload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `eupload_filename` log field value is not equal to `None`, then the `eupload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `eupload_filename` log field value is not equal to `None`, then the `eupload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`upload_filesubtype`	`additional.fields[upload_filesubtype]`
`upload_doctypename`	`additional.fields[upload_doctypename]`
`unscannabletype`	`security_result.detection_fields[unscannabletype]`
`rdr_rulename`	`intermediary.security_result.rule_name`
`b64rdr_rulename`	`intermediary.security_result.rule_name`
	`intermediary.resource.resource_type`	If the `rdr_rulename` log field value is not empty, then the `intermediary.resource.resource_type` UDM field is set to `GATEWAY`.
`ordr_rulename`	`additional.fields[ordr_rulename]`
`fwd_type`	`intermediary.resource.attribute.labels[fwd_type]`
`fwd_gw_name`	`intermediary.resource.name`
`b64fwd_gw_name`	`intermediary.resource.name`
`ofwd_gw_name`	`security_result.detection_fields[ofwd_gw_name]`
`fwd_gw_ip`	`intermediary.ip`
`zpa_app_seg_name`	`additional.fields[zpa_app_seg_name]`
`b64zpa_app_seg_name`	`additional.fields[zpa_app_seg_name]`
`ozpa_app_seg_name`	`additional.fields[ozpa_app_seg_name]`
`reqdatasize`	`additional.fields[reqdatasize]`
`reqhdrsize`	`additional.fields[reqhdrsize]`
`requestsize`	`network.sent_bytes`
`respdatasize`	`additional.fields[respdatasize]`
`resphdrsize`	`additional.fields[resphdrsize]`
`responsesize`	`network.received_bytes`
`transactionsize`	`additional.fields[transactionsize]`
`contenttype`	`target.file.mime_type`
`df_hosthead`	`security_result.detection_fields[df_hosthead]`
`df_hostname`	`security_result.detection_fields[df_hostname]`
`hostname`	`target.hostnametarget.asset.hostname`
`b64host`	`target.hostnametarget.asset.hostname`
`ehost`	`target.hostnametarget.asset.hostname`
`refererURL`	`network.http.referral_url`
`b64referer`	`network.http.referral_url`
`ereferer`	`network.http.referral_url`
`erefererpath`	`additional.fields[erefererpath]`
`refererhost`	`additional.fields[refererhost]`
`erefererhost`	`additional.fields[refererhost]`
`requestmethod`	`network.http.method`
`reqversion`	`additional.fields[reqversion]`
`status`	`network.http.response_code`
`respversion`	`additional.fields[respversion]`
`ua_token`	`additional.fields[ua_token]`
`useragent`	`network.http.user_agent`
`b64ua`	`network.http.user_agent`
`eua`	`network.http.user_agent`
`useragent`	`network.http.parsed_user_agent`
`b64ua`	`network.http.parsed_user_agent`
`eua`	`network.http.parsed_user_agent`
`uaclass`	`additional.fields[uaclass]`
`url`	`target.url`
`b64url`	`target.url`
`eurl`	`target.url`
`eurlpath`	`additional.fields[eurlpath]`
`mobappname`	`additional.fields[mobappname]`
`b64mobappname`	`additional.fields[mobappname]`
`emobappname`	`additional.fields[mobappname]`
`mobappcat`	`additional.fields[mobappcat]`
`mobdevtype`	`additional.fields[mobdevtype]`
`clt_sport`	`principal.port`
`ClientIP`	`principal.ip`
`ocip`	`security_result.detection_fields[ocip]`
`cpubip`	`additional.fields[cpubip]`
`ocpubip`	`additional.fields[ocpubip]`
`clientpublicIP`	`principal.nat_ip`
`serverip`	`target.ip`
	`network.application_protocol`	If the `protocol` log field value contain one of the following values, then the `network.application_protocol` UDM field is set to `HTTP`. `HTTP` `HTTP_PROXY` Else, if the `protocol` log field value contain one of the following values, then the `network.application_protocol` UDM field is set to `HTTPS`. `HTTPS` `SSL` `TUNNEL_SSL` `DNSOVERHTTPS` `TUNNEL` Else, the `network.application_protocol` UDM field is set to `UNKNOWN_APPLICATION_PROTOCOL`.
`alpnprotocol`	`additional.fields[alpnprotocol]`
`trafficredirectmethod`	`intermediary.resource.attribute.labels[trafficredirectmethod]`
`location`	`principal.location.name`
`elocation`	`principal.location.name`
`userlocationname`	`principal.location.name`	If the `userlocationname` log field value is not equal to `None`, then the `userlocationname` log field is mapped to the `principal.location.name` UDM field.
`b64userlocationname`	`principal.location.name`
`euserlocationname`	`principal.location.name`
`rulelabel`	`security_result.rule_name`	If the `action` log field value is equal to `Blocked`, then the `rulelabel` log field is mapped to the `security_result.rule_name` UDM field.
`b64rulelabel`	`security_result.rule_name`
`erulelabel`	`security_result.rule_name`
`ruletype`	`security_result.rule_type`
`reason`	`security_result.description`	If the `action` log field value is equal to `Blocked`, then the `reason` log field is mapped to the `security_result.description` UDM field.
`action`	`security_result.action_details`
	`security_result.action`	If the `action` log field value is equal to `Allowed`, then the `security_result.action` UDM field is set to `ALLOW`. Else, if the `action` log field value is equal to `Blocked`, then the `security_result.action` UDM field is set to `BLOCK`.
`urlfilterrulelabel`	`security_result.rule_name`
`b64urlfilterrulelabel`	`security_result.rule_name`
`eurlfilterrulelabel`	`security_result.rule_name`
`ourlfilterrulelabel`	`security_result.detection_fields[ourlfilterrulelabel]`
`apprulelabel`	`target.security_result.rule_name`
`b64apprulelabel`	`target.security_result.rule_name`
`oapprulelabel`	`security_result.detection_fields[oapprulelabel]`
`bamd5`	`target.file.md5`
`sha256`	`target.file.sha256`
`ssldecrypted`	`security_result.detection_fields[ssldecrypted]`
`externalspr`	`security_result.about.artifact.last_https_certificate.extension.certificate_policies`
`keyprotectiontype`	`security_result.about.artifact.last_https_certificate.extension.key_usage`
`clientsslcipher`	`network.tls.client.supported_ciphers`
`clienttlsversion`	`network.tls.version`
`clientsslsessreuse`	`security_result.detection_fields[clientsslsessreuse]`
`cltsslfailreason`	`security_result.detection_fields[cltsslfailreason]`
`cltsslfailcount`	`security_result.detection_fields[cltsslfailcount]`
`srvsslcipher`	`network.tls.cipher`
`srvtlsversion`	`security_result.detection_fields[srvtlsversion]`
`srvocspresult`	`security_result.detection_fields[srvocspresult]`
`srvcertchainvalpass`	`security_result.detection_fields[srvcertchainvalpass]`
`srvwildcardcert`	`security_result.detection_fields[srvwildcardcert]`
`serversslsessreuse`	`security_result.detection_fields[server_ssl_sess_reuse]`
`srvcertvalidationtype`	`security_result.detection_fields[srvcertvalidationtype]`
`srvcertvalidityperiod`	`security_result.detection_fields[srvcertvalidityperiod]`
`is_ssluntrustedca`	`security_result.detection_fields[is_ssluntrustedca]`
`is_sslselfsigned`	`security_result.detection_fields[is_sslselfsigned]`
`is_sslexpiredca`	`security_result.detection_fields[is_sslexpiredca]`
`pagerisk`	`security_result.risk_score`
	`security_result.severity`	If the `pagerisk` log field value is greater than or equal to `90` and the `pagerisk` log field value is less than or equal to `100`, then the `security_result.severity` UDM field is set to `CRITICAL`. If the `pagerisk` log field value is greater than or equal to `75` and the `pagerisk` log field value is less than or equal to `89`, then the `security_result.severity` UDM field is set to `HIGH`. If the `pagerisk` log field value is greater than or equal to `46` and the `pagerisk` log field value is less than or equal to `74`, then the `security_result.severity` UDM field is set to `MEDIUM`. If the `pagerisk` log field value is greater than or equal to `1` and the `pagerisk` log field value &is less than or equal to `45`, then the `security_result.severity` UDM field is set to `LOW`. If the `pagerisk` log field value is equal to `0`, then the `security_result.severity` UDM field is set to `NONE`.
`threatseverity`	`security_result.severity_details`	If the `pagerisk` log field value is not empty and the `threatseverity` log field value is not empty, then the `security_result.severity_details` UDM field is set to `%{pagerisk} - %{threatseverity}`. Else, if the `threatseverity` log field value is not empty, then the `threatseverity` log field is mapped to the `security_result.severity_details` UDM field.
`activity`	`additional.fields[activity]`
`is_dst_cntry_risky`	`additional.fields[is_dst_cntry_risky]`
`is_src_cntry_risky`	`additional.fields[is_src_cntry_risky]`
`prompt_req`	`additional.fields[prompt_req]`
`srcip_country`	`principal.ip_geo_artifact.location.country_or_region`
`pcapid`	`security_result.about.file.full_path`
`all_dlprulenames`	`security_result.rule_labels[all_dlprulenames]`
`other_dlprulenames`	`security_result.rule_labels[other_dlprulenames]`
`trig_dlprulename`	`security_result.rule_name`
`dstip_country`	`target.ip_geo_artifact.location.country_or_region`
`srv_dport`	`target.port`
`inst_level2_name`	`target.resource_ancestors.name`
`inst_level3_name`	`target.resource_ancestors.name`
`inst_level2_id`	`target.resource_ancestors.product_object_id`
`inst_level3_id`	`target.resource_ancestors.product_object_id`
`inst_level2_type`	`target.resource_ancestors.resource_subtype`
`inst_level3_type`	`target.resource_ancestors.resource_subtype`
	`target.resource_ancestors.resource_type`	If the `inst_level2_type` log field value matches the regular expression pattern `organization` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level2_type` log field value matches the regular expression pattern `service` then, the `target.resource_ancestors.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level2_type` log field value matches the regular expression pattern `policy` then, the `target.resource_ancestors.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level2_type` log field value matches the regular expression pattern `project` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level2_type` log field value matches the regular expression pattern `cluster` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level2_type` log field value matches the regular expression pattern `container` then, the `target.resource_ancestors.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level2_type` log field value matches the regular expression pattern `pod` then, the `target.resource_ancestors.resource_type` UDM field is set to `POD`. Else, if `inst_level2_type` log field value matches the regular expression pattern `repository` then, the `target.resource_ancestors.resource_type` UDM field is set to `REPOSITORY`. If the `inst_level3_type` log field value matches the regular expression pattern `organization` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level3_type` log field value matches the regular expression pattern `service` then, the `target.resource_ancestors.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level3_type` log field value matches the regular expression pattern `policy` then, the `target.resource_ancestors.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level3_type` log field value matches the regular expression pattern `project` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level3_type` log field value matches the regular expression pattern `cluster` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level3_type` log field value matches the regular expression pattern `container` then, the `target.resource_ancestors.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level3_type` log field value matches the regular expression pattern `pod` then, the `target.resource_ancestors.resource_type` UDM field is set to `POD`. Else, if `inst_level3_type` log field value matches the regular expression pattern `repository` then, the `target.resource_ancestors.resource_type` UDM field is set to `REPOSITORY`.
`inst_level1_name`	`target.resource.name`
`inst_level1_id`	`target.resource.product_object_id`
`inst_level1_type`	`target.resource.resource_subtype`
	`target.resource.resource_type`	If the `inst_level1_type` log field value matches the regular expression pattern `organization` then, the `target.resource.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level1_type` log field value matches the regular expression pattern `service` then, the `target.resource.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level1_type` log field value matches the regular expression pattern `policy` then, the `target.resource.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level1_type` log field value matches the regular expression pattern `project` then, the `target.resource.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level1_type` log field value matches the regular expression pattern `cluster` then, the `target.resource.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level1_type` log field value matches the regular expression pattern `container` then, the `target.resource.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level1_type` log field value matches the regular expression pattern `pod` then, the `target.resource.resource_type` UDM field is set to `POD`. Else, if `inst_level1_type` log field value matches the regular expression pattern `repository` then, the `target.resource.resource_type` UDM field is set to `REPOSITORY`.
`app_status`	`target.security_result.detection_fields[app_status]`
`threatname`	`security_result.threat_name`
`b64threatname`	`security_result.threat_name`
`threatcategory`	`security_result.associations.name`
`threatclass`	`security_result.associations.description`
`urlclass`	`security_result.detection_fields[urlclass]`
`urlsupercategory`	`security_result.category_details`
`urlcategory`	`security_result.category_details`
`b64urlcat`	`security_result.category_details`
`ourlcat`	`security_result.detection_fields[ourlcat]`
`urlcatmethod`	`security_result.detection_fields[urlcatmethod]`
`bypassed_traffic`	`security_result.detection_fields[bypassed_traffic]`
`bypassed_etime`	`security_result.detection_fields[bypassed_etime]`
`deviceappversion`	`additional.fields[deviceappversion]`
`devicehostname`	`principal.asset.hostname`
`odevicehostname`	`security_result.detection_fields[odevicehostname]`
`devicemodel`	`principal.asset.hardware.model`
`devicename`	`principal.asset.asset_id`
`odevicename`	`security_result.detection_fields[odevicename]`
	`principal.asset.platform_software.platform`	If the `deviceostype` log field value matches the regular expression pattern `(?i)iOS`, then the `principal.asset.platform_software.platform` UDM field is set to `IOS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Android`, then the `principal.asset.platform_software.platform` UDM field is set to `ANDROID`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Windows`, then the `principal.asset.platform_software.platform` UDM field is set to `WINDOWS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)MAC`, then the `principal.asset.platform_software.platform` UDM field is set to `MAC`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Other`, then the `principal.asset.platform_software.platform` UDM field is set to `UNKNOWN_PLATFORM`.
`deviceosversion`	`principal.asset.software.version`
`deviceowner`	`principal.asset.attribute.labels[deviceowner]`
`odeviceowner`	`security_result.detection_fields[odeviceowner]`
`devicetype`	`principal.asset.category`
`external_devid`	`additional.fields[external_devid]`
`flow_type`	`additional.fields[flow_type]`
`ztunnelversion`	`additional.fields[ztunnelversion]`
`event_id`	`metadata.product_log_id`
`productversion`	`metadata.product_version`
`nsssvcip`	`about.ip`
`eedone`	`additional.fields[eedone]`
`ssl_rulename`	`security_result.rule_name`
`client_tls_keyex_pqc_offers`	`additional.fields[client_tls_keyex_pqc_offers]`
`client_tls_keyex_hybrid_offers`	`additional.fields[client_tls_keyex_hybrid_offers]`
`client_tls_keyex_unknown_offers`	`additional.fields[client_tls_keyex_unknown_offers]`
`client_tls_sig_pqc_offers`	`additional.fields[client_tls_sig_pqc_offers]`
`client_tls_sig_non_pqc_offers`	`additional.fields[client_tls_sig_non_pqc_offers]`
`client_tls_sig_hybrid_offers`	`additional.fields[client_tls_sig_hybrid_offers]`
`client_tls_sig_unknown_offers`	`additional.fields[client_tls_sig_unknown_offers]`
`client_tls_keyex_alg`	`additional.fields[client_tls_keyex_alg]`
`client_tls_sig_alg`	`additional.fields[client_tls_sig_alg]`
`server_tls_keyex_alg`	`additional.fields[server_tls_keyex_alg]`
`server_tls_sig_alg`	`additional.fields[server_tls_sig_alg]`
`time`	`additional.fields[time]`
`ft_rulename`	`security_result.rule_name`
`upload_doc_sub_type`	`additional.fields[upload_doc_sub_type]`
`client_tls_keyex_non_pqc_offers`	`additional.fields[client_tls_keyex_non_pqc_offers]`

さらにサポートが必要な場合 コミュニティメンバーや Google SecOps のプロフェッショナルから回答を得ることができます。