Collecter les résultats de Security Command Center

Ce document explique comment collecter les journaux Security Command Center en configurant Security Command Center et en ingérant les résultats dans Google Security Operations. Ce document liste également les événements compatibles.

Pour en savoir plus, consultez Ingérer des données dans Google Security Operations et Exporter les résultats Security Command Center vers Google Security Operations. Un déploiement type se compose de Security Command Center et du flux Google Security Operations configuré pour envoyer des journaux à Google Security Operations. Chaque déploiement client peut être différent et plus complexe.

Le déploiement contient les composants suivants :

• Google Cloud : système à surveiller sur lequel Security Command Center est installé.

• Résultats Event Threat Detection de Security Command Center : collecte des informations à partir de la source de données et génère des résultats.

• Google Security Operations : conserve et analyse les journaux de Security Command Center.

Un libellé d'ingestion identifie l'analyseur qui normalise les données de journaux brutes au format UDM structuré. Les informations de ce document s'appliquent au parser Security Command Center avec les libellés d'ingestion suivants :

• GCP_SECURITYCENTER_ERROR

• GCP_SECURITYCENTER_MISCONFIGURATION

• GCP_SECURITYCENTER_OBSERVATION

• GCP_SECURITYCENTER_THREAT

• GCP_SECURITYCENTER_UNSPECIFIED

• GCP_SECURITYCENTER_VULNERABILITY

• GCP_SECURITYCENTER_POSTURE_VIOLATION

• GCP_SECURITYCENTER_TOXIC_COMBINATION

Configurer Security Command Center et Google Cloud pour envoyer les résultats à Google Security Operations

• Activez Security Command Center.

• Assurez-vous que tous les systèmes du déploiement sont configurés sur le fuseau horaire UTC.

• Activez l'ingestion des résultats Security Command Center.

Résultats Event Threat Detection compatibles

Cette section liste les résultats Event Threat Detection compatibles. Pour en savoir plus sur les règles et les résultats d'Event Threat Detection dans Security Command Center, consultez Règles d'Event Threat Detection.

Résultats GCP_SECURITYCENTER_ERROR acceptés

Vous trouverez le mappage UDM dans le tableau Référence du mappage des champs : ERREUR.

Résultats GCP_SECURITYCENTER_OBSERVATION compatibles

Vous trouverez le mappage UDM dans le tableau Référence du mappage des champs : OBSERVATION.

Résultats GCP_SECURITYCENTER_UNSPECIFIED acceptés

Vous trouverez le mappage UDM dans le tableau Référence du mappage des champs : UNSPECIFIED.

Résultats GCP_SECURITYCENTER_VULNERABILITY acceptés

Vous trouverez le mappage UDM dans le tableau Référence du mappage des champs : VULNERABILITY.

Résultats GCP_SECURITYCENTER_MISCONFIGURATION acceptés

Vous trouverez le mappage UDM dans le tableau Référence du mappage des champs : CONFIGURATION INCORRECTE.

Résultats GCP_SECURITYCENTER_POSTURE_VIOLATION acceptés

Vous trouverez le mappage UDM dans le tableau Référence du mappage des champs : VIOLATION DE POSTURE.

Formats de journaux Security Center acceptés

L'analyseur Security Center est compatible avec les journaux au format JSON.

Exemples de journaux Security Center compatibles

• Exemples de journaux GCP_SECURITYCENTER_THREAT

  • JSON

  {
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME",
      "state": "ACTIVE",
      "category": "Credential Access: External Member Added To Privileged Group",
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "technique": "persistence",
          "indicator": "audit_log",
          "ruleName": "external_member_added_to_privileged_group"
        },
        "detectionPriority": "HIGH",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1633622881",
                "nanos": 6.73869E8
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {
          "externalMemberAddedToPrivilegedGroup": {
            "principalEmail": "abc@gmail.com",
            "groupName": "group:GROUP_NAME@ORGANIZATION_NAME",
            "externalMember": "user:abc@gamil.com",
            "sensitiveRoles": [
              {
                "resource": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
                "roleName": [
                  "ROLES"
                ]
              }
            ]
          }
        },
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "dummy display name",
            "url": " dummy.url.com"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query\\u003dtimestamp%3D%222022-10-01T16:08:01.673869Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project\\u003d"
            }
          ]
        }
      },
      "securityMarks": {
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
      },
      "eventTime": "2022-10-01T16:08:03.888Z",
      "createTime": "2022-10-01T16:08:04.516Z",
      "severity": "HIGH",
      "workflowState": "NEW",
      "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "findingClass": "THREAT"
    },
    "resource": {
      "name": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
    }
  }
  

• Exemples de journaux GCP_SECURITYCENTER_MISCONFIGURATION

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "eventApps",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/1032183397765/sources/4563429019522465317/findings/fdb789f992c67f6386ec735aca337bab",
      "category": "API_KEY_APIS_UNRESTRICTED",
      "compliances": [
        {
          "standard": "cis",
          "version": "1.0",
          "ids": [
            "1.12"
          ]
        },
        {
          "standard": "cis",
          "version": "1.1",
          "ids": [
            "1.14"
          ]
        },
        {
          "standard": "cis",
          "version": "1.2",
          "ids": [
            "1.14"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        }
      },
      "createTime": "2022-12-01T15:16:21.119Z",
      "database": {},
      "description": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "eventTime": "2022-12-01T14:35:42.317Z",
      "exfiltration": {},
      "externalUri": "https://console.cloud.google.com/apis/credentials?project=eventapps-27705",
      "findingClass": "MISCONFIGURATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/security_health_advisor",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "severity": "MEDIUM",
      "sourceDisplayName": "Security Health Analytics",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "display_name": "dummy-display-name",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
      "parent_display_name": "domainname.com",
      "type": "google.cloud.resourcemanager.Project",
      "folders": []
    },
    "sourceProperties": {
      "Recommendation": "Go to https://console.cloud.google.com/apis/credentials?project=eventapps-27705. In the section \\"API keys,\\" for each API key, click the name of the key. It will display API Key properties on a new page. In the \\"Key restrictions\\" section, set API restrictions to \\"Restrict key.\\" Click the \\"Select APIs\\" drop-down menu to choose which APIs to allow. Click \\"Save.\\"
      "ExceptionInstructions": "Add the security mark \\"allow_api_key_apis_unrestricted\\" to the asset with a value of \\"true\\" to prevent this finding from being activated again.",
      "Explanation": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "ScannerName": "API_KEY_SCANNER",
      "ResourcePath": [
        "projects/eventapps-27705/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "cis": [
          {
            "version": "1.0",
            "ids": [
              "1.12"
            ]
          },
          {
            "version": "1.1",
            "ids": [
              "1.14"
            ]
          },
          {
            "version": "1.2",
            "ids": [
              "1.14"
            ]
          }
        ]
      },
      "ReactivationCount": 0
    }
  }
  

• Exemples de journaux GCP_SECURITYCENTER_OBSERVATION

  • JSON

  {
    "findings": {
      "access": {
        "principalEmail": "dummy.user@dummy.com",
        "callerIp": "198.51.100.1",
        "callerIpGeo": {
          "regionCode": "SG"
        },
        "serviceName": "compute.googleapis.com",
        "methodName": "v1.compute.projects.setCommonInstanceMetadata",
        "principalSubject": "user:dummy.user@dummy.com"
      },
      "canonicalName": "projects/856289305908/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "Persistence: Project SSH Key Added",        
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy.user@dummy.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2022-11-10T18:33:07.631Z",
      "database": {},
      "eventTime": "2022-11-10T18:33:07.271Z",
      "exfiltration": {},
      "findingClass": "OBSERVATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {
        "primaryTactic": "PERSISTENCE",
        "primaryTechniques": [
          "ACCOUNT_MANIPULATION",
          "SSH_AUTHORIZED_KEYS"
        ]
      },
      "mute": "UNDEFINED",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID",
      "parentDisplayName": "Sensitive Actions Service",
      "resourceName": "//compute.googleapis.com/projects/spring-banner-350111",
      "severity": "LOW",
      "sourceDisplayName": "Sensitive Actions Service",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/spring-banner-350111",
      "display_name": "spring-banner-350111",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "parent_display_name": "spring-banner-350111",
      "type": "google.compute.Project",
      "folders": []
    },
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "856289305908",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "ruleName": "sensitive_action",
        "subRuleName": "add_ssh_key"
      },
      "detectionPriority": "LOW",
      "affectedResources": [
        {
          "gcpResourceName": "//compute.googleapis.com/projects/spring-banner-350111"
        },
        {
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/856289305908"
        }
      ],
      "evidence": [
        {
          "sourceLogId": {
            "projectId": "spring-banner-350111",
            "resourceContainer": "projects/spring-banner-350111",
            "timestamp": {
              "seconds": "1668105185",
              "nanos": 642158000
            },
            "insertId": "v2stobd9ihi"
          }
        }
      ],
      "properties": {},
      "findingId": "findingId",
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "dummy.domain.com"
        }
      }
    }
  }
  

• Exemples de journaux GCP_SECURITYCENTER_VULNERABILITY

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "Sample-00000",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/PROJECT_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "CLEAR_TEXT_PASSWORD",
      "compliances": [
        {
          "standard": "owasp",
          "version": "2017",
          "ids": [
            "A3"
          ]
        },
        {
          "standard": "owasp",
          "version": "2021",
          "ids": [
            "A02"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        }
      },
      "createTime": "2022-11-24T09:28:52.589Z",
      "database": {},
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "eventTime": "2022-11-24T04:56:26Z",
      "exfiltration": {},
      "externalUri": "https://sample.dummy.com/",
      "findingClass": "VULNERABILITY",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/css",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Web Security Scanner",
      "resourceName": "//dummy.sample.com",
      "severity": "MEDIUM",
      "sourceDisplayName": "Web Security Scanner",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com",
      "display_name": "dummy_name",
      "project_name": "//cloudresourcemanager.googleapis.com",
      "project_display_name": "dummy_name",
      "parent_name": "//dummy.sample.com",
      "parent_display_name": "Sample-Dev-Project",
      "type": "sample.cloud.dummy.Project",
      "folders": [
        {
          "resourceFolderDisplayName": "Sample-Dev-Project",
          "resourceFolder": "//cloudresourcemanager.googleapis.com/"
        }
      ]
    },
    "sourceProperties": {
      "severity": "MEDIUM",
      "fuzzedUrl": "dummy.domain.com",
      "form": {
        "actionUri": "dummy.domain.com",
        "fields": [
          "os_username",
          "os_password",
          "",
          "os_cookie",
          "os_destination",
          "user_role",
          "atl_token",
          "login"
        ]
      },
      "name": "projects/PROJECT_ID/scanConfigs/SCAN_CONFIG_ID/scanRuns/SCAN_RUN_ID/findings/FINDING_ID",
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "reproductionUrl": "http://198.51.100.1:0000/login.jsp?searchString=",
      "httpMethod": "GET",
      "finalUrl": "http://0.0.0.0:0000/sample.dummy=",
      "ResourcePath": [
        "projects/sample-dummy/",
        "folders/FOLDER_ID/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "owasp": [
          {
            "version": "2017",
            "ids": [
              "A3"
            ]
          },
          {
            "version": "2021",
            "ids": [
              "A02"
            ]
          }
        ]
      }
    }
  }
  

• Exemples de journaux GCP_SECURITYCENTER_ERROR

  • JSON

  {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/742742027423",
    "state": "ACTIVE",
    "category": "KTD_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2022-11-23T16:36:03.458107Z",
    "createTime": "2022-11-01T07:36:37.078Z",
    "severity": "CRITICAL",
    "canonicalName": "projects/742742027423/sources/SOURCE_ID/findings/FINDING_ID",
    "mute": "UNDEFINED",
    "findingClass": "SCC_ERROR",
    "access": {
      "callerIpGeo": {}
    },
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      },
      "technical": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      }
    },
    "parentDisplayName": "Security Command Center",
    "description": "Either all or some Container Threat Detection findings aren\\u0027t being sent to Security Command Center. A service account is missing permissions required for Container Threat Detection.",
    "iamBindings": [
      {
        "member": "test.user@domain.com"
      }
    ],
    "nextSteps": "Restore the required IAM roles on the Container Threat Detection service account. \\n1. Go to [IAM](/iam-admin/iam) \\n2. Select the service account: \\"test.user@domain.com\\" \\n   - If you don\\u0027t see the service account listed, click  **Add** at the top of the page and enter it as a new principal \\n3. Apply the following role:* \\n    1. Container Threat Detection Service Agent \\n4. Click **Save**. \\n \\n*If you use custom roles, apply these missing permissions: \\n - container.clusterRoleBindings.create,container.clusterRoleBindings.delete,container.clusterRoleBindings.update,container.clusterRoles.create,container.clusterRoles.delete,container.clusterRoles.escalate,container.clusterRoles.update,container.customResourceDefinitions.create,container.customResourceDefinitions.delete,container.customResourceDefinitions.update,container.daemonSets.create,container.daemonSets.delete,container.daemonSets.update,container.daemonSets.updateStatus,container.networkPolicies.update,container.pods.attach,container.pods.create,container.pods.delete,container.pods.exec,container.pods.getLogs,container.pods.portForward,container.pods.update,container.roleBindings.create,container.roleBindings.delete,container.roleBindings.update,container.roles.bind,container.roles.create,container.roles.delete,container.roles.escalate,container.roles.update,container.secrets.create,container.secrets.list,container.secrets.delete,container.secrets.update,container.serviceAccounts.create,container.serviceAccounts.delete,container.serviceAccounts.update"
  }
  

• Exemples de journaux GCP_SECURITYCENTER_UNSPECIFIED

  • JSON

  {
    "findings": {
      "access": {},
      "canonicalName": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "OPEN_FIREWALL",
      "compliances": [
        {
          "standard": "pci",
          "ids": [
            "1.2.1"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2021-07-20T08:33:25.343Z",
      "database": {},
      "eventTime": "2022-07-19T07:44:38.374Z",
      "exfiltration": {},
      "externalUri": "dummy.domain.com",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "MUTED",
      "muteInitiator": "Muted by test.user@dummy.xyz",
      "muteUpdateTime": "2022-03-08T05:41:06.507Z",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID"
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "severity": "HIGH",
      "sourceDisplayName": "Sanity_grc",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "display_name": "",
      "project_name": "",
      "project_display_name": "",
      "parent_name": "",
      "parent_display_name": "",
      "type": "",
      "folders": []
    },
    "sourceProperties": {
      "ScannerName": "FIREWALL_SCANNER",
      "ResourcePath": [
        "projects/calcium-vial-280707/",
        "organizations/ORGANIZATION_ID/"
      ],
      "ReactivationCount": 0,
      "AllowedIpRange": "All",
      "ExternallyAccessibleProtocolsAndPorts": [
        {
          "IPProtocol": "tcp",
          "ports": [
            "80"
          ]
        }
      ]
    }
  }
  
  

Référence du mappage de champs

Cette section explique comment l'analyseur Google Security Operations mappe les champs de journaux Security Command Center aux champs UDM (Unified Data Model) de Google Security Operations pour les ensembles de données.

Référence du mappage de champs : champs de journaux bruts vers champs UDM

Le tableau suivant liste les champs de journaux et les mappages UDM correspondants pour les résultats Event Threat Detection de Security Command Center.

Référence de mise en correspondance des champs : identifiant d'événement et type d'événement

Les tableaux suivants contiennent les types d'événements UDM et le mappage des champs UDM pour les classes de résultats VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED et POSTURE_VIOLATION de Security Command Center.

Catégorie VULNERABILITY au type d'événement UDM

Le tableau suivant liste la catégorie VULNERABILITY et les types d'événements UDM correspondants.

Catégorie "CONFIGURATION INCORRECTE" vers le type d'événement UDM

Le tableau suivant liste la catégorie "CONFIGURATION INCORRECTE" et les types d'événements UDM correspondants.

Catégorie OBSERVATION au type d'événement UDM

Le tableau suivant liste la catégorie OBSERVATION et les types d'événements UDM correspondants.

Catégorie ERROR vers type d'événement UDM

Le tableau suivant liste la catégorie ERROR et les types d'événements UDM correspondants.

Catégorie UNSPECIFIED au type d'événement UDM

Le tableau suivant liste la catégorie "NON SPÉCIFIÉ" et les types d'événements UDM correspondants.

Catégorie POSTURE_VIOLATION au type d'événement UDM

Le tableau suivant liste la catégorie POSTURE_VIOLATION et les types d'événements UDM correspondants.

Documentation de référence sur le mappage des champs : VULNERABILITY

Le tableau suivant liste les champs de journaux de la catégorie VULNERABILITY et les champs UDM correspondants.

Référence du mappage de champ : CONFIGURATION INCORRECTE

Le tableau suivant répertorie les champs de journaux de la catégorie "MISCONFIGURATION" (Mauvaise configuration) et les champs UDM correspondants.

Référence du mappage de champ : OBSERVATION

Le tableau suivant répertorie les champs de journaux de la catégorie OBSERVATION et les champs UDM correspondants.

Référence du mappage de champs : ERREUR

Le tableau suivant répertorie les champs de journaux de la catégorie ERROR et les champs UDM correspondants.

Référence du mappage de champs : UNSPECIFIED

Le tableau suivant liste les champs de journaux de la catégorie "UNSPECIFIED" (NON SPÉCIFIÉ) et les champs UDM correspondants.

Référence du mappage de champ : POSTURE_VIOLATION

Le tableau suivant répertorie les champs de journaux de la catégorie POSTURE_VIOLATION et les champs UDM correspondants.

Champs courants : SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION

Le tableau suivant liste les champs courants des catégories SECURITY COMMAND CENTER – VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION et leurs champs UDM correspondants.

Étapes suivantes

• Ingestion de données dans Google Security Operations

Vous avez encore besoin d'aide ? Obtenez des réponses de membres de la communauté et de professionnels Google SecOps.