Google utilise la technologie IA pour traduire le contenu dans votre langue préférée. Les traductions générées par IA peuvent contenir des erreurs.

Collecter les journaux Zscaler Webproxy

Compatible avec :

Google SecOps SIEM

Ce document explique comment exporter les journaux Zscaler Webproxy en configurant un flux Google Security Operations et comment les champs de journaux sont mappés aux champs du modèle de données unifié (UDM) de Google SecOps.

Pour en savoir plus, consultez Présentation de l'ingestion de données dans Google SecOps.

Un déploiement standard se compose de Zscaler Webproxy et du flux de webhook Google SecOps configuré pour envoyer des journaux à Google SecOps. Chaque déploiement client peut être différent et plus complexe.

Le déploiement contient les composants suivants :

Zscaler Webproxy : plate-forme à partir de laquelle vous collectez les journaux.
Flux Google SecOps : flux Google SecOps qui récupère les journaux de Zscaler Webproxy et les écrit dans Google SecOps.
Google SecOps : conserve et analyse les journaux.

Une étiquette d'ingestion identifie l'analyseur qui normalise les données de journaux brutes au format UDM structuré. Les informations contenues dans ce document s'appliquent à l'analyseur avec l'étiquette d'ingestion ZSCALER_WEBPROXY.

Avant de commencer

Assurez-vous de remplir les conditions préalables suivantes :

Accès à la console Zscaler Internet Access. Pour en savoir plus, consultez l'aide de Secure Internet and SaaS Access ZIA.
Zscaler Webproxy 2024 ou version ultérieure
Tous les systèmes de l'architecture de déploiement sont configurés avec le fuseau horaire UTC.
La clé API nécessaire pour terminer la configuration du flux dans Google Security Operations. Pour en savoir plus, consultez Configurer des clés API.

Configurer des flux

Il existe deux points d'entrée différents pour configurer des flux dans la plate-forme Google SecOps :

Paramètres > Gestion des données > Flux > Ajouter un flux (sur la plate-forme SIEM uniquement, Paramètres > Flux > Ajouter un flux)
Content Hub > Packs de contenu > Premiers pas

Configurez les flux depuis Paramètres > Gestion des données > Flux.

Pour configurer plusieurs flux pour différents types de journaux dans cette famille de produits, consultez Configurer des flux par produit.

Pour configurer un seul flux, procédez comme suit :

Accédez à Paramètres > Gestion des données > Flux. Si vous utilisez une plate-forme SIEM uniquement, accédez à Paramètres > Flux.
Cliquez sur Ajouter un flux d'actualités.
Sur la page suivante, cliquez sur Configurer un seul flux.
Dans le champ Nom du flux, saisissez un nom pour le flux, par exemple Journaux du proxy Web Zscaler.
Sélectionnez Webhook comme Type de source.
Sélectionnez Zscaler comme Type de journal.
Cliquez sur Suivant.
Configurez les paramètres d'entrée suivants :
1. Délimiteur de division : saisissez \n pour séparer les lignes de journal JSON délimitées par un retour à la ligne (NDJSON) dans les requêtes de webhook par lot.
2. Espace de noms de l'élément (facultatif) : espace de noms de l'élément.
3. Étiquettes d'ingestion (facultatif) : étiquette à appliquer aux événements de ce flux.
Cliquez sur Suivant.
Vérifiez la configuration de votre nouveau flux d'actualités, puis cliquez sur Envoyer.
Cliquez sur Générer une clé secrète pour générer une clé secrète permettant d'authentifier ce flux.

Configurer des flux à partir du hub de contenus

Spécifiez les valeurs des champs suivants :

Délimiteur de division : saisissez \n pour séparer les lignes de journal JSON délimitées par un retour à la ligne (NDJSON) dans les requêtes de webhook par lot.

Options avancées

Nom du flux : valeur préremplie qui identifie le flux.
Type de source : méthode utilisée pour collecter les journaux dans Google SecOps.
Espace de noms de l'élément : espace de noms de l'élément.
Libellés d'ingestion : libellé appliqué aux événements de ce flux.
Cliquez sur Suivant.
Vérifiez la configuration du flux sur l'écran Finaliser, puis cliquez sur Envoyer.
Cliquez sur Générer une clé secrète pour générer une clé secrète permettant d'authentifier ce flux.

Configurer le proxy Web Zscaler

Dans la console Zscaler Internet Access, cliquez sur Administration > Nanolog Streaming Service > Cloud NSS Feeds (Administration > Service de streaming Nanolog > Flux Cloud NSS), puis sur Add Cloud NSS Feed (Ajouter un flux Cloud NSS).
La fenêtre Ajouter un flux Cloud NSS s'affiche. Dans la fenêtre Add Cloud NSS Feed (Ajouter un flux NSS cloud), saisissez les informations.
Saisissez un nom pour le flux dans le champ Nom du flux.
Sélectionnez NSS pour le Web dans Type de NSS.
Sélectionnez l'état dans la liste État pour activer ou désactiver le flux NSS.
Conservez la valeur Illimité dans le menu déroulant Tarif SIEM. Pour supprimer le flux de sortie en raison de contraintes de licence ou d'autres contraintes, modifiez la valeur.
Sélectionnez Autre dans la liste Type de SIEM.
Sélectionnez Désactivé dans la liste Authentification OAuth 2.0.
Saisissez une taille maximale pour la charge utile d'une requête HTTP individuelle, conformément aux bonnes pratiques du SIEM, dans Taille maximale du lot. Par exemple, 512 Ko.
Saisissez l'URL HTTPS du point de terminaison de l'API Chronicle dans l'URL de l'API au format suivant :
```
  https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
```
- CHRONICLE_REGION : région où votre instance Chronicle est hébergée. Par exemple, US.
- GOOGLE_PROJECT_NUMBER : numéro de projet Google Cloud .
- LOCATION : région Chronicle. Par exemple, US.
- CUSTOMER_ID : ID client Chronicle.
- FEED_ID : ID du flux affiché dans l'interface utilisateur du flux sur le nouveau webhook créé
- Exemple d'URL d'API :
```
https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs
```
Cliquez sur Ajouter un en-tête HTTP, puis ajoutez des en-têtes HTTP au format suivant :
- Header 1 : Clé 1 : X-goog-api-key et Valeur 1 : clé API générée dans les identifiants de l'API de Google Cloud.
- Header 2 : Clé2 : X-Webhook-Access-Key et Valeur2 : code secret de l'API généré sur la "CLÉ SECRÈTE" du webhook.
Sélectionnez Journaux Web dans la liste Types de journaux.
Sélectionnez JSON dans la liste Type de sortie du flux.
Désactivez l'option Notation de tableau JSON. Lorsque la notation de tableau JSON est désactivée, Zscaler Webproxy envoie les journaux par lot sous forme d'objets JSON délimités par un saut de ligne (NDJSON) séparés par \n. Dans la configuration du flux Google SecOps, définissez le délimiteur de division sur \n afin que chaque objet JSON soit analysé en tant qu'entrée de journal distincte.
Définissez Caractère d'échappement du flux sur , \ ".
Pour ajouter un champ au format de sortie du flux, sélectionnez Personnalisé dans la liste Type de sortie du flux.

Copiez et collez le format de sortie du flux suivant dans le format de sortie du flux par défaut :

  \{ "sourcetype" : "zscalernss-web", "event" : \{"datetime":"%04d{yyyy}-%02d{mth}-%02d{dd} %02d{hh}:%02d{mm}:%02d{ss}","reason":"%s{reason}","event_id":"%d{recordid}","protocol":"%s{proto}","action":"%s{action}","transactionsize":"%d{totalsize}","responsesize":"%d{respsize}","requestsize":"%d{reqsize}","urlcategory":"%s{urlcat}","serverip":"%s{sip}","requestmethod":"%s{reqmethod}","refererURL":"%s{ereferer}","useragent":"%s{eua}","product":"NSS","location":"%s{elocation}","ClientIP":"%s{cip}","status":"%s{respcode}","user":"%s{elogin}","url":"%s{eurl}","vendor":"Zscaler","hostname":"%s{ehost}","clientpublicIP":"%s{cintip}","threatcategory":"%s{malwarecat}","threatname":"%s{threatname}","filetype":"%s{filetype}","appname":"%s{appname}","app_status":"%s{app_status}","pagerisk":"%d{riskscore}","threatseverity":"%s{threatseverity}","department":"%s{edepartment}","urlsupercategory":"%s{urlsupercat}","appclass":"%s{appclass}","dlpengine":"%s{dlpeng}","urlclass":"%s{urlclass}","threatclass":"%s{malwareclass}","dlpdictionaries":"%s{dlpdict}","fileclass":"%s{fileclass}","bwthrottle":"%s{bwthrottle}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}","keyprotectiontype":"%s{keyprotectiontype}"\}\}

Pour inclure des champs supplémentaires, mettez à jour le format de sortie du flux en conséquence et assurez-vous que les noms des clés correspondent aux noms des champs réels tels qu'ils apparaissent dans la documentation officielle de Zscaler Webproxy. Pour en savoir plus sur les champs compatibles, consultez Référence sur le mappage de champs.
Dans la liste Fuseau horaire, sélectionnez GMT pour formater le champ Heure au format UTC. Par défaut, Zscaler Webproxy utilise le fuseau horaire de votre organisation. Toutefois, le champ datetime du format de sortie du flux omet le décalage de fuseau horaire, et l'analyseur ZSCALER_WEBPROXY interprète les valeurs datetime comme étant au format UTC.
Vérifiez les paramètres configurés.
Cliquez sur Enregistrer pour tester la connectivité. Si la connexion est établie, une coche verte s'affiche, accompagnée du message Test de connectivité réussi : OK (200).

Pour en savoir plus sur les flux Google SecOps, consultez la documentation sur les flux Google SecOps. Pour en savoir plus sur les exigences de chaque type de flux, consultez Configuration des flux par type.

Si vous rencontrez des problèmes lors de la création de flux, contactez l'assistance Google SecOps.

Formats de journaux Zscaler Webproxy compatibles

L'analyseur Zscaler Webproxy accepte les journaux au format JSON.

Exemples de journaux de proxy Web Zscaler compatibles

JSON

  {
    "event": {
      "ClientIP": "198.51.100.0",
      "action": "Allowed",
      "appclass": "Sales and Marketing",
      "appname": "Trend Micro",
      "bwthrottle": "NO",
      "clientpublicIP": "198.51.100.1",
      "contenttype": "Other",
      "datetime": "2024-05-06 10:56:04",
      "department": "Mid-Continent%20Companies",
      "devicehostname": "dummyhostname",
      "deviceowner": "dummydeviceowner",
      "dlpdictionaries": "None",
      "dlpengine": "None",
      "event_id": "7365838693731467265",
      "fileclass": "None",
      "filetype": "None",
      "hostname": "dummyhostname.com",
      "keyprotectiontype": "N/A",
      "location": "Road%20Warrior",
      "pagerisk": "0",
      "product": "NSS",
      "protocol": "HTTP_PROXY",
      "reason": "Allowed",
      "refererURL": "None",
      "requestmethod": "CONNECT",
      "requestsize": "606",
      "responsesize": "65",
      "serverip": "198.51.10.2",
      "status": "200",
      "threatcategory": "None",
      "threatclass": "None",
      "threatname": "None",
      "threatseverity": "None",
      "transactionsize": "671",
      "unscannabletype": "None",
      "url": "dummyurl.com:443",
      "urlcategory": "SSL - DNI - Bypass",
      "urlclass": "Bandwidth Loss",
      "urlsupercategory": "User-defined",
      "user": "abc@xyz.com",
      "useragent": "dummyuseragent",
      "vendor": "Zscaler"
    },
    "sourcetype": "zscalernss-web"
  }

Référence de mappage de champs

Le tableau suivant liste les champs de journal du type de journal ZSCALER_WEBPROXY et les champs UDM correspondants.

Log field	UDM mapping	Logic
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Zscaler`.
	`metadata.event_type`	If the `ClientIP` log field value is not empty and the `serverip` log field value is not empty and the `proto` log field value contain one of the following values, then the `metadata.event_type` UDM field is set to `NETWORK_HTTP`. `HTTPS` `HTTP` Else, if the `ClientIP` log field value is not empty and the `serverip` log field value is not empty, then the `metadata.event_type` UDM field is set to `NETWORK_CONNECTION`. Else, if the `user` log field value is not empty or the `deviceowner` log field value is not empty, then the `metadata.event_type` UDM field is set to `USER_UNCATEGORIZED`. Else, the `metadata.event_type` UDM field is set to `GENERIC_EVENT`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Web Proxy`.
`sourcetype`	`additional.fields[sourcetype]`
`datetime`	`metadata.event_timestamp`
`tz`	`additional.fields[tz]`
`ss`	`additional.fields[ss]`
`mm`	`additional.fields[mm]`
`hh`	`additional.fields[hh]`
`dd`	`additional.fields[dd]`
`mth`	`additional.fields[mth]`
`yyyy`	`additional.fields[yyyy]`
`mon`	`additional.fields[mon]`
`day`	`additional.fields[day]`
`department`	`principal.user.department`
`b64dept`	`principal.user.department`
`edepartment`	`principal.user.department`
`user`	`principal.user.email_addresses`
`user`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `user` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`b64login`	`principal.user.email_addresses`
`b64login`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `b64login` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`elogin`	`principal.user.email_addresses`
`elogin`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `elogin` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`ologin`	`principal.user.email_addresses`
`ologin`	`principal.user.userid`	The `EMAILLOCALPART` field is extracted from `ologin` log field using the Grok pattern, and the `EMAILLOCALPART` log field is mapped to the `principal.user.userid` UDM field.
`cloudname`	`intermediary.resource.attribute.labels[cloudname]`
`company`	`principal.user.company_name`
`throttlereqsize`	`security_result.detection_fields[throttlereqsize]`
`throttlerespsize`	`security_result.detection_fields[throttlerespsize]`
`bwthrottle`	`security_result.detection_fields[bwthrottle]`
	`security_result.category`	If the `bwthrottle` log field value is equal to `Yes`, then the `security_result.category` UDM field is set to `POLICY_VIOLATION`.
`bwclassname`	`security_result.detection_fields[bwclassname]`
`obwclassname`	`security_result.detection_fields[obwclassname]`
`bwrulename`	`security_result.rule_name`
`appname`	`target.application`
`appclass`	`security_result.detection_fields[appclass]`
`module`	`security_result.detection_fields[module]`
`app_risk_score`	`security_result.risk_score`	If the `app_risk_score` log field value matches the regular expression pattern `[0-9]+`, then the `app_risk_score` log field is mapped to the `security_result.risk_score` UDM field.
`datacenter`	`target.location.name`
`datacentercity`	`target.location.city`
`datacentercountry`	`target.location.country_or_region`
`dlpdictionaries`	`security_result.detection_fields[dlpdictionaries]`
`odlpdict`	`security_result.detection_fields[odlpdict]`
`dlpdicthitcount`	`security_result.detection_fields[dlpdicthitcount]`
`dlpengine`	`security_result.detection_fields[dlpengine]`
`odlpeng`	`security_result.detection_fields[odlpeng]`
`dlpidentifier`	`security_result.detection_fields[dlpidentifier]`
`dlpmd5`	`security_result.detection_fields[dlpmd5]`
`dlprulename`	`security_result.rule_name`
`b64dlprulename`	`security_result.rule_name`
`odlprulename`	`security_result.rule_name`
`fileclass`	`additional.fields[fileclass]`
`filetype`	`target.file.file_type`	If the `filetype` log field value matches the regular expression `(?i)(xlsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLSX`. Else, if the `filetype` log field value matches the regular expression `(?i)(xls)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLS`. Else, if the `filetype` log field value matches the regular expression `(?i)(cab)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAB`. Else, if the `filetype` log field value matches the regular expression `(?i)(pcapng\|pcap\|cap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAP`. Else, if the `filetype` log field value matches the regular expression `(?i)(tar.gz\|egg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_PKG`. Else, if the `filetype` log field value matches the regular expression `(?i)(gzip\|tgz\|gz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(zip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(gif)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIF`. Else, if the log message matches the regular expression `(?i)(\\bdos\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe\|com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_EXE`. Else, if the log message matches the regular expression `(?i)(\\bne_exe\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_EXE`. Else, if the `filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_EXE`. Else, if the `filetype` log field value matches the regular expression `(?i)(msi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSI`. Else, if the `filetype` log field value matches the regular expression `(?i)(ocx\|sys)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_DLL`. Else, if the `filetype` log field value matches the regular expression `(?i)(pdf\|(portable\\sdocument\\sformat))`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDF`. Else, if the `filetype` log field value matches the regular expression `(?i)(docx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOCX`. Else, if the `filetype` log field value matches the regular expression `(?i)(doc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOC`. Else, if the `filetype` log field value matches the regular expression `(?i)(html\|htm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HTML`. Else, if the `filetype` log field value matches the regular expression `(?i)(jar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(jpeg\|jpg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JPEG`. Else, if the `filetype` log field value matches the regular expression `(?i)(mov)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MOV`. Else, if the `filetype` log field value matches the regular expression `(?i)(mp3)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP3`. Else, if the `filetype` log field value matches the regular expression `(?i)(mp4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP4`. Else, if the `filetype` log field value matches the regular expression `(?i)(png)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PNG`. Else, if the `filetype` log field value matches the regular expression `(?i)(pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPTX`. Else, if the `filetype` log field value matches the regular expression `(?i)(ppt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(rar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(ace)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ACE`. Else, if the `filetype` log field value matches the regular expression `(?i)(apk\|aar\|dex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ANDROID`. Else, if the `filetype` log field value matches the regular expression `(?i)(plist)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE_PLIST`. Else, if the `filetype` log field value matches the regular expression `(?i)(applescript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(app)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE`. Else, if the `filetype` log field value matches the regular expression `(?i)(scpt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT_COMPILED`. Else, if the `filetype` log field value matches the regular expression `(?i)(arc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARC`. Else, if the `filetype` log field value matches the regular expression `(?i)(arj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARJ`. Else, if the `filetype` log field value matches the regular expression `(?i)(asd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASD`. Else, if the `filetype` log field value matches the regular expression `(?i)(asf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASF`. Else, if the `filetype` log field value matches the regular expression `(?i)(avi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AVI`. Else, if the `filetype` log field value matches the regular expression `(?i)(awk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AWK`. Else, if the `filetype` log field value matches the regular expression `(?i)(bmp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BMP`. Else, if the `filetype` log field value matches the regular expression `(?i)(dib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIB`. Else, if the `filetype` log field value matches the regular expression `(?i)(bz2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(chm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CHM`. Else, if the `filetype` log field value matches the regular expression `(?i)(cljc\|cljs\|clj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CLJ`. Else, if the `filetype` log field value matches the regular expression `(?i)(crt\|cer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRT`. Else, if the `filetype` log field value matches the regular expression `(?i)(crx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRX`. Else, if the `filetype` log field value matches the regular expression `(?i)(csv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CSV`. Else, if the `filetype` log field value matches the regular expression `(?i)(deb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DEB`. Else, if the `filetype` log field value matches the regular expression `(?i)(dmg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DMG`. Else, if the `filetype` log field value matches the regular expression `(?i)(divx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIVX`. Else, if the `filetype` log field value matches the regular expression `(?i)(com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_COM`. Else, if the `filetype` log field value matches the regular expression `(?i)(dwg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DWG`. Else, if the `filetype` log field value matches the regular expression `(?i)(dxf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DXF`. Else, if the `filetype` log field value matches the regular expression `(?i)(dyalog)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DYALOG`. Else, if the `filetype` log field value matches the regular expression `(?i)(dzip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(epub\|mobi\|azw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EBOOK`. Else, if the `filetype` log field value matches the regular expression `(?i)(elf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ELF`. Else, if the `filetype` log field value matches the regular expression `(?i)(eml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `filetype` log field value matches the regular expression `(?i)(emf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMF`. Else, if the `filetype` log field value matches the regular expression `(?i)(eot)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EOT`. Else, if the `filetype` log field value matches the regular expression `(?i)(eps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EPS`. Else, if the `filetype` log field value matches the regular expression `(?i)(flac)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLAC`. Else, if the `filetype` log field value matches the regular expression `(?i)(fla)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLA`. Else, if the `filetype` log field value matches the regular expression `(?i)(fli)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLI`. Else, if the `filetype` log field value matches the regular expression `(?i)(flc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLC`. Else, if the `filetype` log field value matches the regular expression `(?i)(flv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLV`. Else, if the `filetype` log field value matches the regular expression `(?i)(fpx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FPX`. Else, if the `filetype` log field value matches the regular expression `(?i)(xcf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIMP`. Else, if the `filetype` log field value matches the regular expression `(?i)(go)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GOLANG`. Else, if the `filetype` log field value matches the regular expression `(?i)(gul)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GUL`. Else, if the `filetype` log field value matches the regular expression `(?i)(hwp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HWP`. Else, if the `filetype` log field value matches the regular expression `(?i)(ico)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ICO`. Else, if the `filetype` log field value matches the regular expression `(?i)(indd\|idml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IN_DESIGN`. Else, if the `filetype` log field value matches the regular expression `(?i)(ipa)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPHONE`. Else, if the `filetype` log field value matches the regular expression `(?i)(ips)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPS`. Else, if the `filetype` log field value matches the regular expression `(?i)(iso)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ISOIMAGE`. Else, if the `filetype` log field value matches the regular expression `(?i)(java)` AND the `filetype` log field value does NOT match the regular expression `(?i)(javascript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA`. Else, if the `filetype` log field value matches the regular expression `(?i)(class)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA_BYTECODE`. Else, if the `filetype` log field value matches the regular expression `(?i)(jmod)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JMOD`. Else, if the `filetype` log field value matches the regular expression `(?i)(jng)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JNG`. Else, if the `filetype` log field value matches the regular expression `(?i)(json)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JSON`. Else, if the `filetype` log field value matches the regular expression `(?i)(js)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVASCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(kgb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_KGB`. Else, if the `filetype` log field value matches the regular expression `(?i)(tex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LATEX`. Else, if the `filetype` log field value matches the regular expression `(?i)(lzfse)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LZFSE`. Else, if the `filetype` log field value matches the regular expression `(?i)(vmlinuz\|ko)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX_KERNEL`. Else, if the `filetype` log field value matches the regular expression `(?i)(bundle\|framework)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the log message matches the regular expression `(?i)(\\bmach\\b)` AND the `filetype` log field value matches the regular expression `(?i)(dylib\|o)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the `filetype` log field value matches the regular expression `(?i)(so\|initrd\|vmlinux\|pkg.tar.zst\|ext4\|ext3\|ext2\|swap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `filetype` log field value matches the regular expression `(?i)(ini)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_INI`. Else, if the log message matches the regular expression `(?i)(\\blinux\\b)` AND the `filetype` log field value matches the regular expression `sfs`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `filetype` log field value matches the regular expression `(?i)(lnk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LNK`. Else, if the `filetype` log field value matches the regular expression `(?i)(m4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_M4`. Else, if the `filetype` log field value matches the regular expression `(?i)(midi\|mid)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MIDI`. Else, if the `filetype` log field value matches the regular expression `(?i)(mkv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MKV`. Else, if the `filetype` log field value matches the regular expression `(?i)(mpg\|mpeg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MPEG`. Else, if the `filetype` log field value matches the regular expression `(?i)(sz_)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSCOMPRESS`. Else, if the `filetype` log field value matches the regular expression `(?i)(dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_DLL`. Else, if the `filetype` log field value matches the regular expression `(?i)(odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODG`. Else, if the `filetype` log field value matches the regular expression `(?i)(odp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODP`. Else, if the `filetype` log field value matches the regular expression `(?i)(ods)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODS`. Else, if the `filetype` log field value matches the regular expression `(?i)(odt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODT`. Else, if the `filetype` log field value matches the regular expression `(?i)(ogg\|oga\|ogv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OGG`. Else, if the `filetype` log field value matches the regular expression `(?i)(one)` AND the `filetype` log field value does NOT match the regular expression `(?i)(none)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ONE_NOTE`. Else, if the `filetype` log field value matches the regular expression `(?i)(pst\|ost)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\boutlook\\b)` AND the `filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\bemail\\b)` AND the `filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `filetype` log field value matches the regular expression `(?i)(prc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PALMOS`. Else, if the `filetype` log field value matches the regular expression `(?i)(pdb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDB`. Else, if the `filetype` log field value matches the regular expression `(?i)(pem)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PEM`. Else, if the `filetype` log field value matches the regular expression `(?i)(pgp\|gpg\|asc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PGP`. Else, if the `filetype` log field value matches the regular expression `(?i)(php)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PHP`. Else, if the `filetype` log field value matches the regular expression `(?i)(pkg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PKG`. Else, if the `filetype` log field value matches the regular expression `(?i)(ps1\|psm1)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_POWERSHELL`. Else, if the `filetype` log field value matches the regular expression `(?i)(ppsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPSX`. Else, if the `filetype` log field value matches the regular expression `(?i)(psd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PSD`. Else, if the `filetype` log field value matches the regular expression `(?i)(ps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PS`. Else, if the `filetype` log field value matches the regular expression `(?i)(pyc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYC`. Else, if the `filetype` log field value matches the regular expression `(?i)(py\|pyw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON`. Else, if the `filetype` log field value matches the regular expression `(?i)(whl)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_WHL`. Else, if the `filetype` log field value matches the regular expression `(?i)(qt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_QUICKTIME`. Else, if the `filetype` log field value matches the regular expression `(?i)(rm\|rmvb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rom\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ROM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rpm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RPM`. Else, if the `filetype` log field value matches the regular expression `(?i)(rtf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RTF`. Else, if the `filetype` log field value matches the regular expression `(?i)(rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RUBY`. Else, if the `filetype` log field value matches the regular expression `(?i)(rz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(7z)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SEVENZIP`. Else, if the `filetype` log field value matches the regular expression `(?i)(sgml\|sgm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SGML`. Else, if the `filetype` log field value matches the regular expression `(?i)(bash\|csh\|zsh)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)(sql)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQL`. Else, if the `filetype` log field value matches the regular expression `(?i)(sqfs\|sfs)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQUASHFS`. Else, if the `filetype` log field value matches the regular expression `(?i)(svg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SVG`. Else, if the `filetype` log field value matches the regular expression `(?i)(swf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SWF`. Else, if the `filetype` log field value matches the regular expression `(?i)(sis\|sisx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SYMBIAN`. Else, if the `filetype` log field value matches the regular expression `(?i)(3gp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_T3GP`. Else, if the `filetype` log field value matches the regular expression `(?i)(tar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TAR`. Else, if the `filetype` log field value matches the regular expression `(?i)(tga)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TARGA`. Else, if the `filetype` log field value matches the regular expression `(?i)(3ds\|max)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_THREEDS`. Else, if the `filetype` log field value matches the regular expression `(?i)(tif\|tiff)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TIFF`. Else, if the `filetype` log field value matches the regular expression `(?i)(torrent)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TORRENT`. Else, if the `filetype` log field value matches the regular expression `(?i)(ttf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TTF`. Else, if the `filetype` log field value matches the regular expression `(?i)(vba)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VBA`. Else, if the `filetype` log field value matches the regular expression `(?i)(vhd\|vhdx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VHD`. Else, if the `filetype` log field value matches the regular expression `(?i)(wav)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WAV`. Else, if the `filetype` log field value matches the regular expression `(?i)(webm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBM`. Else, if the `filetype` log field value matches the regular expression `(?i)(webp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBP`. Else, if the `filetype` log field value matches the regular expression `(?i)(wer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WER`. Else, if the `filetype` log field value matches the regular expression `(?i)(wma)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMA`. Else, if the `filetype` log field value matches the regular expression `(?i)(wmv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMV`. Else, if the `filetype` log field value matches the regular expression `(?i)(woff\|woff2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WOFF`. Else, if the `filetype` log field value matches the regular expression `(?i)(xml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XML`. Else, if the `filetype` log field value matches the regular expression `(?i)(xpi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XPI`. Else, if the `filetype` log field value matches the regular expression `(?i)(xwd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XWD`. Else, if the `filetype` log field value matches the regular expression `(?i)(zst)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZST`. Else, if the `filetype` log field value matches the regular expression `(?i)(Makefile\|makefile\|mk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MAKEFILE`. Else, if the `filetype` log field value matches the regular expression `(?i)(zlib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZLIB`. Else, if the `filetype` log field value matches the regular expression `(?i)(hqx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH`. Else, if the `filetype` log field value matches the regular expression `(?i)(hfs\|dsk\|toast)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_HFS`. Else, if the `filetype` log field value matches the regular expression `(?i)(bh\|log\|dat)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BLACKHOLE`. Else, if the log message matches the regular expression `(?i)(\\bcookie\\b)` AND the `filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COOKIE`. Else, if the `filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TEXT`. Else, if the `filetype` log field value matches the regular expression `(?i)(docx\|xlsx\|pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OOXML`. Else, if the `filetype` log field value matches the regular expression `(?i)(odt\|ods\|odp\|odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODF`. Else, if the `filetype` log field value matches the regular expression `(?i)(for\|f90\|f95)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, if the log message matches the regular expression `(?i)(\\bwince\\b)` AND the `filetype` log field value matches the regular expression `(?i)(exe\|cab\|dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WINCE`. Else, if the log message matches the regular expression `(?i)(\\bscript\\b)` AND the `filetype` log field value matches the regular expression `(?i)(py\|js\|pl\|rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SCRIPT`. Else, if the log message matches the regular expression `(?i)(\\bapplesingle\\b)` AND the `filetype` log field value matches the regular expression `(?i)(as\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESINGLE`. Else, if the log message matches the regular expression `(?i)(\\bmacintosh\\b)` AND the `filetype` log field value matches the regular expression `(?i)(dylib\|a)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_LIB`. Else, if the log message matches the regular expression `(?i)(\\bappledouble\\b)` AND the `filetype` log field value matches the regular expression `(?i)(ad\|._)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLEDOUBLE`. Else, if the log message matches the regular expression `(?i)(\\bobjetivec\\b)` AND the `filetype` log field value matches the regular expression `(?i)(m\|mm\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OBJETIVEC`. Else, if the `filetype` log field value matches the regular expression `(?i)(obj\|lib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COFF`. Else, if the log message matches the regular expression `(?i)(\\bcpp\\b)` AND the `filetype` log field value matches the regular expression `(?i)(hpp\|cpp\|cc\|cxx\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CPP`. Else, if the `filetype` log field value matches the regular expression `(?i)(pas\|pp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PASCAL`. Else, if the `filetype` log field value matches the regular expression `(?i)(pl\|pm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PERL`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bsh\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bc\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_C`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bn\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NEKO`. Else, if the `filetype` log field value matches the regular expression `(?i)\\bf\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, the UDM field `additional.fields.key` is set to `file_type` and the log field value `filetype` is mapped to the `additional.fields.value` UDM field, provided the `filetype` value is not empty.
`filename`	`target.file.full_path`
`b64filename`	`target.file.full_path`
`efilename`	`target.file.full_path`
`filesubtype`	`additional.fields[filesubtype]`
`upload_fileclass`	`additional.fields[upload_fileclass]`
`upload_filetype`	`target.file.file_type`	If the `filetype` log field value is empty or equal to `None` and the `upload_filetype` log field value is not empty and not equal to `None`, then: If the `upload_filetype` log field value matches the regular expression `(?i)(xlsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLSX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xls)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XLS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(cab)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pcapng\|pcap\|cap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CAP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tar.gz\|egg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_PKG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gzip\|tgz\|gz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gif)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIF`. Else, if the log message matches the regular expression `(?i)(\\bdos\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe\|com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_EXE`. Else, if the log message matches the regular expression `(?i)(\\bne_exe\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_EXE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(exe)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_EXE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(msi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ocx\|sys)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PE_DLL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pdf\|(portable\\sdocument\\sformat))`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(docx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOCX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(doc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(html\|htm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HTML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jpeg\|jpg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JPEG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mov)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MOV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mp3)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP3`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mp4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MP4`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(png)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PNG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPTX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ppt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ace)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ACE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(apk\|aar\|dex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ANDROID`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(plist)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE_PLIST`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(applescript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(app)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(scpt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESCRIPT_COMPILED`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(arc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(arj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ARJ`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(asd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(asf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ASF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(avi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AVI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(awk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_AWK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bmp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BMP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bz2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(chm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CHM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(cljc\|cljs\|clj)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CLJ`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(crt\|cer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(crx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CRX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(csv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CSV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(deb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DEB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dmg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DMG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(divx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DIVX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(com)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DOS_COM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dwg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DWG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dxf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DXF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dyalog)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DYALOG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dzip)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_DZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(epub\|mobi\|azw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EBOOK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(elf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ELF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(emf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eot)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EOT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(eps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EPS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flac)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLAC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fla)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fli)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(flv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FLV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(fpx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FPX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xcf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GIMP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(go)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GOLANG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(gul)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_GUL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hwp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_HWP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ico)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ICO`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(indd\|idml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IN_DESIGN`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ipa)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPHONE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ips)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_IPS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(iso)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ISOIMAGE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(java)` AND the `upload_filetype` log field value does NOT match the regular expression `(?i)(javascript)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(class)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVA_BYTECODE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jmod)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JMOD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(jng)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JNG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(json)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JSON`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(js)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_JAVASCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(kgb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_KGB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tex)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LATEX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(lzfse)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LZFSE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vmlinuz\|ko)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX_KERNEL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bundle\|framework)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the log message matches the regular expression `(?i)(\\bmach\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(dylib\|o)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACH_O`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(so\|initrd\|vmlinux\|pkg.tar.zst\|ext4\|ext3\|ext2\|swap)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ini)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_INI`. Else, if the log message matches the regular expression `(?i)(\\blinux\\b)` AND the `upload_filetype` log field value matches the regular expression `sfs`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LINUX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(lnk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_LNK`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(m4)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_M4`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(midi\|mid)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MIDI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mkv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MKV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(mpg\|mpeg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MPEG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sz_)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MSCOMPRESS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NE_DLL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ods)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ogg\|oga\|ogv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OGG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(one)` AND the `upload_filetype` log field value does NOT match the regular expression `(?i)(none)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ONE_NOTE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pst\|ost)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\boutlook\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OUTLOOK`. Else, if the log message matches the regular expression `(?i)(\\bemail\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(msg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_EMAIL_TYPE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(prc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PALMOS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pdb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PDB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pem)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PEM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pgp\|gpg\|asc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PGP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(php)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PHP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pkg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PKG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ps1\|psm1)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_POWERSHELL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ppsx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PPSX`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(psd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PSD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ps)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pyc)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(py\|pyw)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(whl)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PYTHON_WHL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(qt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_QUICKTIME`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rm\|rmvb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rom\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ROM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rpm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RPM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rtf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RTF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RUBY`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(rz)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_RZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(7z)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SEVENZIP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sgml\|sgm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SGML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bash\|csh\|zsh)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sql)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sqfs\|sfs)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SQUASHFS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(svg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SVG`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(swf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SWF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(sis\|sisx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SYMBIAN`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(3gp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_T3GP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tar)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TAR`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tga)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TARGA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(3ds\|max)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_THREEDS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(tif\|tiff)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TIFF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(torrent)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TORRENT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(ttf)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TTF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vba)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VBA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(vhd\|vhdx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_VHD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wav)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WAV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(webm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBM`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(webp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WEBP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wer)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WER`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wma)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMA`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(wmv)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WMV`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(woff\|woff2)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WOFF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xml)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xpi)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XPI`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(xwd)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_XWD`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zst)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZST`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(Makefile\|makefile\|mk)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MAKEFILE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(zlib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ZLIB`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hqx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(hfs\|dsk\|toast)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_HFS`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(bh\|log\|dat)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_BLACKHOLE`. Else, if the log message matches the regular expression `(?i)(\\bcookie\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COOKIE`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(txt)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_TEXT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(docx\|xlsx\|pptx)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OOXML`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(odt\|ods\|odp\|odg)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_ODF`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(for\|f90\|f95)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, if the log message matches the regular expression `(?i)(\\bwince\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(exe\|cab\|dll)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_WINCE`. Else, if the log message matches the regular expression `(?i)(\\bscript\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(py\|js\|pl\|rb)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SCRIPT`. Else, if the log message matches the regular expression `(?i)(\\bapplesingle\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(as\|bin)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLESINGLE`. Else, if the log message matches the regular expression `(?i)(\\bmacintosh\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(dylib\|a)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_MACINTOSH_LIB`. Else, if the log message matches the regular expression `(?i)(\\bappledouble\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(ad\|._)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_APPLEDOUBLE`. Else, if the log message matches the regular expression `(?i)(\\bobjetivec\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(m\|mm\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_OBJETIVEC`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(obj\|lib)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_COFF`. Else, if the log message matches the regular expression `(?i)(\\bcpp\\b)` AND the `upload_filetype` log field value matches the regular expression `(?i)(hpp\|cpp\|cc\|cxx\|h)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_CPP`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pas\|pp)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PASCAL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)(pl\|pm)`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_PERL`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bsh\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_SHELLSCRIPT`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bc\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_C`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bn\\b$`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_NEKO`. Else, if the `upload_filetype` log field value matches the regular expression `(?i)\\bf\\b`, then the `target.file.file_type` UDM field is set to `FILE_TYPE_FORTRAN`. Else, the UDM field `additional.fields.key` is set to `file_type` and the log field value `upload_filetype` is mapped to the `additional.fields.value` UDM field, provided the `upload_filetype` value is not empty.
`upload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `upload_filename` log field value is not equal to `None`, then the `upload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `upload_filename` log field value is not equal to `None`, then the `upload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`b64upload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `b64upload_filename` log field value is not equal to `None`, then the `b64upload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `b64upload_filename` log field value is not equal to `None`, then the `b64upload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`eupload_filename`	`target.file.full_path`	If the `filename` log field value is equal to `None` and the `eupload_filename` log field value is not equal to `None`, then the `eupload_filename` log field is mapped to the `target.file.full_path` UDM field. Else, if the `filename` log field value is not equal to `None` and the `eupload_filename` log field value is not equal to `None`, then the `eupload_filename` log field is mapped to the `target.resource.attribute.labels[upload_filename]` UDM field.
`upload_filesubtype`	`additional.fields[upload_filesubtype]`
`upload_doctypename`	`additional.fields[upload_doctypename]`
`unscannabletype`	`security_result.detection_fields[unscannabletype]`
`rdr_rulename`	`security_result.rule_name`
`b64rdr_rulename`	`security_result.rule_name`
`ordr_rulename`	`security_result.rule_name`
`fwd_type`	`intermediary.resource.attribute.labels[fwd_type]`
`fwd_gw_name`	`intermediary.resource.name`
`b64fwd_gw_name`	`intermediary.resource.name`
`ofwd_gw_name`	`intermediary.resource.name`
`fwd_gw_ip`	`intermediary.ip`
`zpa_app_seg_name`	`additional.fields[zpa_app_seg_name]`
`b64zpa_app_seg_name`	`additional.fields[zpa_app_seg_name]`
`ozpa_app_seg_name`	`additional.fields[ozpa_app_seg_name]`
`reqdatasize`	`additional.fields[reqdatasize]`
`reqhdrsize`	`additional.fields[reqhdrsize]`
`requestsize`	`network.sent_bytes`
`respdatasize`	`additional.fields[respdatasize]`
`resphdrsize`	`additional.fields[resphdrsize]`
`responsesize`	`network.received_bytes`
`transactionsize`	`additional.fields[transactionsize]`
`contenttype`	`target.file.mime_type`
`df_hosthead`	`security_result.detection_fields[df_hosthead]`
`df_hostname`	`security_result.detection_fields[df_hostname]`
`hostname`	`target.hostnametarget.asset.hostname`
`b64host`	`target.hostnametarget.asset.hostname`
`ehost`	`target.hostnametarget.asset.hostname`
`refererURL`	`network.http.referral_url`
`b64referer`	`network.http.referral_url`
`ereferer`	`network.http.referral_url`
`erefererpath`	`additional.fields[erefererpath]`
`refererhost`	`additional.fields[refererhost]`
`erefererhost`	`additional.fields[refererhost]`
`requestmethod`	`network.http.method`
`reqversion`	`additional.fields[reqversion]`
`status`	`network.http.response_code`
`respversion`	`additional.fields[respversion]`
`ua_token`	`additional.fields[ua_token]`
`useragent`	`network.http.user_agent`
`b64ua`	`network.http.user_agent`
`eua`	`network.http.user_agent`
`useragent`	`network.http.parsed_user_agent`
`b64ua`	`network.http.parsed_user_agent`
`eua`	`network.http.parsed_user_agent`
`uaclass`	`additional.fields[uaclass]`
`url`	`target.url`
`b64url`	`target.url`
`eurl`	`target.url`
`eurlpath`	`additional.fields[eurlpath]`
`mobappname`	`additional.fields[mobappname]`
`b64mobappname`	`additional.fields[mobappname]`
`emobappname`	`additional.fields[mobappname]`
`mobappcat`	`security_result.detection_fields[mobappcat]`
`mobdevtype`	`security_result.detection_fields[mobdevtype]`
`clt_sport`	`principal.port`
`ClientIP`	`principal.ip`
`ocip`	`principal.ip`
`cpubip`	`principal.ip`
`ocpubip`	`principal.ip`
`clientpublicIP`	`principal.nat_ip`
`serverip`	`target.ip`
	`network.application_protocol`	If the `protocol` log field value contain one of the following values, then the `network.application_protocol` UDM field is set to `HTTP`. `HTTP` `HTTP_PROXY` Else, if the `protocol` log field value contain one of the following values, then the `network.application_protocol` UDM field is set to `HTTPS`. `HTTPS` `SSL` `TUNNEL_SSL` `DNSOVERHTTPS` `TUNNEL` Else, the `network.application_protocol` UDM field is set to `UNKNOWN_APPLICATION_PROTOCOL`.
`alpnprotocol`	`additional.fields[alpnprotocol]`
`trafficredirectmethod`	`intermediary.resource.attribute.labels[trafficredirectmethod]`
`location`	`principal.location.name`
`elocation`	`principal.location.name`
`userlocationname`	`principal.location.name`	If the `userlocationname` log field value is not equal to `None`, then the `userlocationname` log field is mapped to the `principal.location.name` UDM field.
`b64userlocationname`	`principal.location.name`
`euserlocationname`	`principal.location.name`
`rulelabel`	`security_result.rule_name`	If the `action` log field value is equal to `Blocked`, then the `rulelabel` log field is mapped to the `security_result.rule_name` UDM field.
`b64rulelabel`	`security_result.rule_name`
`erulelabel`	`security_result.rule_name`
`ruletype`	`security_result.rule_type`
`reason`	`security_result.description`
`action`	`security_result.action_details`
	`security_result.action`	If the `action` log field value is equal to `Allowed`, then the `security_result.action` UDM field is set to `ALLOW`. Else, if the `action` log field value is equal to `Blocked`, then the `security_result.action` UDM field is set to `BLOCK`.
`urlfilterrulelabel`	`security_result.rule_name`
`b64urlfilterrulelabel`	`security_result.rule_name`
`eurlfilterrulelabel`	`security_result.rule_name`
`ourlfilterrulelabel`	`security_result.rule_name`
`apprulelabel`	`security_result.rule_name`
`eapprulelabel`	`security_result.rule_name`
`b64apprulelabel`	`security_result.rule_name`
`oapprulelabel`	`security_result.rule_name`
`bamd5`	`target.file.md5`
`sha256`	`target.file.sha256`
`ssldecrypted`	`security_result.detection_fields[ssldecrypted]`
`externalspr`	`security_result.detection_fields[externalspr]`
`keyprotectiontype`	`security_result.detection_fields[keyprotectiontype]`
`clientsslcipher`	`network.tls.client.supported_ciphers`
`clienttlsversion`	`network.tls.version`
`clientsslsessreuse`	`security_result.detection_fields[clientsslsessreuse]`
`cltsslfailreason`	`security_result.summary`
`cltsslfailcount`	`security_result.detection_fields[cltsslfailcount]`
`srvsslcipher`	`network.tls.cipher`
`srvtlsversion`	`security_result.detection_fields[srvtlsversion]`
`srvocspresult`	`security_result.detection_fields[srvocspresult]`
`srvcertchainvalpass`	`security_result.detection_fields[srvcertchainvalpass]`
`srvwildcardcert`	`security_result.detection_fields[srvwildcardcert]`
`serversslsessreuse`	`security_result.detection_fields[server_ssl_sess_reuse]`
`srvcertvalidationtype`	`security_result.detection_fields[srvcertvalidationtype]`
`srvcertvalidityperiod`	`security_result.detection_fields[srvcertvalidityperiod]`
`is_ssluntrustedca`	`security_result.detection_fields[is_ssluntrustedca]`
`is_sslselfsigned`	`security_result.detection_fields[is_sslselfsigned]`
`is_sslexpiredca`	`security_result.detection_fields[is_sslexpiredca]`
`pagerisk`	`security_result.risk_score`
	`security_result.severity`	If the `pagerisk` log field value is greater than or equal to `90` and the `pagerisk` log field value is less than or equal to `100`, then the `security_result.severity` UDM field is set to `CRITICAL`. If the `pagerisk` log field value is greater than or equal to `75` and the `pagerisk` log field value is less than or equal to `89`, then the `security_result.severity` UDM field is set to `HIGH`. If the `pagerisk` log field value is greater than or equal to `46` and the `pagerisk` log field value is less than or equal to `74`, then the `security_result.severity` UDM field is set to `MEDIUM`. If the `pagerisk` log field value is greater than or equal to `1` and the `pagerisk` log field value &is less than or equal to `45`, then the `security_result.severity` UDM field is set to `LOW`. If the `pagerisk` log field value is equal to `0`, then the `security_result.severity` UDM field is set to `NONE`.
`threatseverity`	`security_result.severity_details`	If the `pagerisk` log field value is not empty and the `threatseverity` log field value is not empty, then the `security_result.severity_details` UDM field is set to `%{pagerisk} - %{threatseverity}`. Else, if the `threatseverity` log field value is not empty, then the `threatseverity` log field is mapped to the `security_result.severity_details` UDM field.
`activity`	`metadata.product_event_type`
`is_dst_cntry_risky`	`security_result.detection_fields[is_dst_cntry_risky]`
`is_src_cntry_risky`	`security_result.detection_fields[is_src_cntry_risky]`
`prompt_req`	`additional.fields[prompt_req]`
`srcip_country`	`principal.ip_geo_artifact.location.country_or_region`
`pcapid`	`security_result.about.file.full_path`
`all_dlprulenames`	`security_result.rule_labels[all_dlprulenames]`
`other_dlprulenames`	`security_result.rule_labels[other_dlprulenames]`
`trig_dlprulename`	`security_result.rule_name`
`dstip_country`	`target.ip_geo_artifact.location.country_or_region`
`srv_dport`	`target.port`
`inst_level2_name`	`target.resource_ancestors.name`
`inst_level3_name`	`target.resource_ancestors.name`
`inst_level2_id`	`target.resource_ancestors.product_object_id`
`inst_level3_id`	`target.resource_ancestors.product_object_id`
`inst_level2_type`	`target.resource_ancestors.resource_subtype`
`inst_level3_type`	`target.resource_ancestors.resource_subtype`
	`target.resource_ancestors.resource_type`	If the `inst_level2_type` log field value matches the regular expression pattern `organization` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level2_type` log field value matches the regular expression pattern `service` then, the `target.resource_ancestors.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level2_type` log field value matches the regular expression pattern `policy` then, the `target.resource_ancestors.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level2_type` log field value matches the regular expression pattern `project` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level2_type` log field value matches the regular expression pattern `cluster` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level2_type` log field value matches the regular expression pattern `container` then, the `target.resource_ancestors.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level2_type` log field value matches the regular expression pattern `pod` then, the `target.resource_ancestors.resource_type` UDM field is set to `POD`. Else, if `inst_level2_type` log field value matches the regular expression pattern `repository` then, the `target.resource_ancestors.resource_type` UDM field is set to `REPOSITORY`. If the `inst_level3_type` log field value matches the regular expression pattern `organization` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level3_type` log field value matches the regular expression pattern `service` then, the `target.resource_ancestors.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level3_type` log field value matches the regular expression pattern `policy` then, the `target.resource_ancestors.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level3_type` log field value matches the regular expression pattern `project` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level3_type` log field value matches the regular expression pattern `cluster` then, the `target.resource_ancestors.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level3_type` log field value matches the regular expression pattern `container` then, the `target.resource_ancestors.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level3_type` log field value matches the regular expression pattern `pod` then, the `target.resource_ancestors.resource_type` UDM field is set to `POD`. Else, if `inst_level3_type` log field value matches the regular expression pattern `repository` then, the `target.resource_ancestors.resource_type` UDM field is set to `REPOSITORY`.
`inst_level1_name`	`target.resource.name`
`inst_level1_id`	`target.resource.product_object_id`
`inst_level1_type`	`target.resource.resource_subtype`
	`target.resource.resource_type`	If the `inst_level1_type` log field value matches the regular expression pattern `organization` then, the `target.resource.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if `inst_level1_type` log field value matches the regular expression pattern `service` then, the `target.resource.resource_type` UDM field is set to `BACKEND_SERVICE`. Else, if `inst_level1_type` log field value matches the regular expression pattern `policy` then, the `target.resource.resource_type` UDM field is set to `ACCESS_POLICY`. Else, if `inst_level1_type` log field value matches the regular expression pattern `project` then, the `target.resource.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if `inst_level1_type` log field value matches the regular expression pattern `cluster` then, the `target.resource.resource_type` UDM field is set to `CLUSTER`. Else, if `inst_level1_type` log field value matches the regular expression pattern `container` then, the `target.resource.resource_type` UDM field is set to `CONTAINER`. Else, if `inst_level1_type` log field value matches the regular expression pattern `pod` then, the `target.resource.resource_type` UDM field is set to `POD`. Else, if `inst_level1_type` log field value matches the regular expression pattern `repository` then, the `target.resource.resource_type` UDM field is set to `REPOSITORY`.
`app_status`	`security_result.detection_fields[app_status]`
`threatname`	`security_result.threat_name`
`b64threatname`	`security_result.threat_name`
`threatcategory`	`security_result.associations.name`
`threatclass`	`security_result.associations.description`
`urlclass`	`security_result.detection_fields[urlclass]`
`urlsupercategory`	`security_result.category_details`
`urlcategory`	`security_result.category_details`
`b64urlcat`	`security_result.category_details`
`ourlcat`	`security_result.category_details`
`urlcatmethod`	`security_result.detection_fields[urlcatmethod]`
`bypassed_traffic`	`security_result.detection_fields[bypassed_traffic]`
`bypassed_etime`	`security_result.detection_fields[bypassed_etime]`
`deviceappversion`	`principal.asset.platform_software.platform_version`
`devicehostname`	`principal.asset.hostname`
`edevicehostname`	`principal.asset.hostname`
`odevicehostname`	`principal.asset.hostname`
`devicemodel`	`principal.asset.hardware.model`
`devicename`	`principal.asset.asset_id`
`edevicename`	`principal.asset.asset_id`
`odevicename`	`principal.asset.asset_id`
	`principal.asset.platform_software.platform`	If the `deviceostype` log field value matches the regular expression pattern `(?i)iOS`, then the `principal.asset.platform_software.platform` UDM field is set to `IOS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Android`, then the `principal.asset.platform_software.platform` UDM field is set to `ANDROID`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Windows`, then the `principal.asset.platform_software.platform` UDM field is set to `WINDOWS`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)MAC`, then the `principal.asset.platform_software.platform` UDM field is set to `MAC`. Else, if the `deviceostype` log field value matches the regular expression pattern `(?i)Other`, then the `principal.asset.platform_software.platform` UDM field is set to `UNKNOWN_PLATFORM`.
`deviceosversion`	`principal.asset.software.version`
`deviceowner`	`principal.asset.attribute.labels[deviceowner]`
`odeviceowner`	`principal.asset.attribute.labels[deviceowner]`
`devicetype`	`principal.asset.category`
`external_devid`	`additional.fields[external_devid]`
`flow_type`	`additional.fields[flow_type]`
`ztunnelversion`	`additional.fields[ztunnelversion]`
`event_id`	`metadata.product_log_id`
`productversion`	`metadata.product_version`
`nsssvcip`	`about.ip`
`eedone`	`additional.fields[eedone]`
`ssl_rulename`	`security_result.rule_name`
`client_tls_keyex_pqc_offers`	`additional.fields[client_tls_keyex_pqc_offers]`
`client_tls_keyex_hybrid_offers`	`additional.fields[client_tls_keyex_hybrid_offers]`
`client_tls_keyex_unknown_offers`	`additional.fields[client_tls_keyex_unknown_offers]`
`client_tls_sig_pqc_offers`	`additional.fields[client_tls_sig_pqc_offers]`
`client_tls_sig_non_pqc_offers`	`additional.fields[client_tls_sig_non_pqc_offers]`
`client_tls_sig_hybrid_offers`	`additional.fields[client_tls_sig_hybrid_offers]`
`client_tls_sig_unknown_offers`	`additional.fields[client_tls_sig_unknown_offers]`
`client_tls_keyex_alg`	`additional.fields[client_tls_keyex_alg]`
`client_tls_sig_alg`	`additional.fields[client_tls_sig_alg]`
`server_tls_keyex_alg`	`additional.fields[server_tls_keyex_alg]`
`server_tls_sig_alg`	`additional.fields[server_tls_sig_alg]`
`time`	`additional.fields[time]`
`ft_rulename`	`security_result.rule_name`
`upload_doc_sub_type`	`additional.fields[upload_doc_sub_type]`
`client_tls_keyex_non_pqc_offers`	`additional.fields[client_tls_keyex_non_pqc_offers]`

Journal des modifications

Afficher le journal des modifications de cet analyseur

Vous avez encore besoin d'aide ? Obtenez des réponses de membres de la communauté et de professionnels Google SecOps.