Mengumpulkan temuan Security Command Center

Dokumen ini menjelaskan cara mengumpulkan log Security Command Center dengan mengonfigurasi Security Command Center dan menyerap temuan ke Google Security Operations. Dokumen ini juga mencantumkan peristiwa yang didukung.

Untuk mengetahui informasi selengkapnya, lihat Penyerapan data ke Google Security Operations dan Mengekspor temuan Security Command Center ke Google Security Operations. Deployment umum terdiri dari Security Command Center dan feed Google Security Operations yang dikonfigurasi untuk mengirim log ke Google Security Operations. Setiap deployment pelanggan mungkin berbeda dan mungkin lebih kompleks.

Deployment berisi komponen berikut:

• Google Cloud: Sistem yang akan dipantau tempat Security Command Center diinstal.

• Temuan Deteksi Ancaman Peristiwa Security Command Center: Mengumpulkan informasi dari sumber data dan membuat temuan.

• Google Security Operations: Mempertahankan dan menganalisis log dari Security Command Center.

Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser Security Command Center dengan label penyerapan berikut:

• GCP_SECURITYCENTER_ERROR

• GCP_SECURITYCENTER_MISCONFIGURATION

• GCP_SECURITYCENTER_OBSERVATION

• GCP_SECURITYCENTER_THREAT

• GCP_SECURITYCENTER_UNSPECIFIED

• GCP_SECURITYCENTER_VULNERABILITY

• GCP_SECURITYCENTER_POSTURE_VIOLATION

• GCP_SECURITYCENTER_TOXIC_COMBINATION

Mengonfigurasi Security Command Center dan Google Cloud untuk mengirimkan temuan ke Google Security Operations

• Aktifkan Security Command Center.

• Pastikan semua sistem dalam deployment dikonfigurasi dalam zona waktu UTC.

• Aktifkan penyerapan temuan Security Command Center.

Temuan Event Threat Detection yang didukung

Bagian ini mencantumkan temuan Event Threat Detection yang didukung. Untuk mengetahui informasi tentang aturan dan temuan Event Threat Detection Security Command Center, lihat Aturan Event Threat Detection.

Temuan GCP_SECURITYCENTER_ERROR yang didukung

Anda dapat menemukan pemetaan UDM di tabel Referensi pemetaan kolom: ERROR.

Temuan GCP_SECURITYCENTER_OBSERVATION yang didukung

Anda dapat menemukan pemetaan UDM di tabel Referensi pemetaan kolom: OBSERVATION.

Temuan GCP_SECURITYCENTER_UNSPECIFIED yang didukung

Anda dapat menemukan pemetaan UDM di tabel Referensi pemetaan kolom: UNSPECIFIED.

Temuan GCP_SECURITYCENTER_VULNERABILITY yang didukung

Anda dapat menemukan pemetaan UDM di tabel Referensi pemetaan kolom: VULNERABILITAS.

Temuan GCP_SECURITYCENTER_MISCONFIGURATION yang didukung

Anda dapat menemukan pemetaan UDM di tabel Referensi pemetaan kolom: KONFIGURASI YANG SALAH.

Temuan GCP_SECURITYCENTER_POSTURE_VIOLATION yang didukung

Anda dapat menemukan pemetaan UDM di tabel Referensi pemetaan kolom: PELANGGARAN POSTUR.

Format log Pusat Keamanan yang didukung

Parser Security Center mendukung log dalam format JSON.

Contoh log Security Center yang didukung

• Contoh log GCP_SECURITYCENTER_THREAT

  • JSON

  {
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME",
      "state": "ACTIVE",
      "category": "Credential Access: External Member Added To Privileged Group",
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "technique": "persistence",
          "indicator": "audit_log",
          "ruleName": "external_member_added_to_privileged_group"
        },
        "detectionPriority": "HIGH",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1633622881",
                "nanos": 6.73869E8
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {
          "externalMemberAddedToPrivilegedGroup": {
            "principalEmail": "abc@gmail.com",
            "groupName": "group:GROUP_NAME@ORGANIZATION_NAME",
            "externalMember": "user:abc@gamil.com",
            "sensitiveRoles": [
              {
                "resource": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
                "roleName": [
                  "ROLES"
                ]
              }
            ]
          }
        },
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "dummy display name",
            "url": " dummy.url.com"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query\\u003dtimestamp%3D%222022-10-01T16:08:01.673869Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project\\u003d"
            }
          ]
        }
      },
      "securityMarks": {
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
      },
      "eventTime": "2022-10-01T16:08:03.888Z",
      "createTime": "2022-10-01T16:08:04.516Z",
      "severity": "HIGH",
      "workflowState": "NEW",
      "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "findingClass": "THREAT"
    },
    "resource": {
      "name": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
    }
  }
  

• Contoh log GCP_SECURITYCENTER_MISCONFIGURATION

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "eventApps",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/1032183397765/sources/4563429019522465317/findings/fdb789f992c67f6386ec735aca337bab",
      "category": "API_KEY_APIS_UNRESTRICTED",
      "compliances": [
        {
          "standard": "cis",
          "version": "1.0",
          "ids": [
            "1.12"
          ]
        },
        {
          "standard": "cis",
          "version": "1.1",
          "ids": [
            "1.14"
          ]
        },
        {
          "standard": "cis",
          "version": "1.2",
          "ids": [
            "1.14"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        }
      },
      "createTime": "2022-12-01T15:16:21.119Z",
      "database": {},
      "description": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "eventTime": "2022-12-01T14:35:42.317Z",
      "exfiltration": {},
      "externalUri": "https://console.cloud.google.com/apis/credentials?project=eventapps-27705",
      "findingClass": "MISCONFIGURATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/security_health_advisor",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "severity": "MEDIUM",
      "sourceDisplayName": "Security Health Analytics",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "display_name": "dummy-display-name",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
      "parent_display_name": "domainname.com",
      "type": "google.cloud.resourcemanager.Project",
      "folders": []
    },
    "sourceProperties": {
      "Recommendation": "Go to https://console.cloud.google.com/apis/credentials?project=eventapps-27705. In the section \\"API keys,\\" for each API key, click the name of the key. It will display API Key properties on a new page. In the \\"Key restrictions\\" section, set API restrictions to \\"Restrict key.\\" Click the \\"Select APIs\\" drop-down menu to choose which APIs to allow. Click \\"Save.\\"
      "ExceptionInstructions": "Add the security mark \\"allow_api_key_apis_unrestricted\\" to the asset with a value of \\"true\\" to prevent this finding from being activated again.",
      "Explanation": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "ScannerName": "API_KEY_SCANNER",
      "ResourcePath": [
        "projects/eventapps-27705/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "cis": [
          {
            "version": "1.0",
            "ids": [
              "1.12"
            ]
          },
          {
            "version": "1.1",
            "ids": [
              "1.14"
            ]
          },
          {
            "version": "1.2",
            "ids": [
              "1.14"
            ]
          }
        ]
      },
      "ReactivationCount": 0
    }
  }
  

• Contoh log GCP_SECURITYCENTER_OBSERVATION

  • JSON

  {
    "findings": {
      "access": {
        "principalEmail": "dummy.user@dummy.com",
        "callerIp": "198.51.100.1",
        "callerIpGeo": {
          "regionCode": "SG"
        },
        "serviceName": "compute.googleapis.com",
        "methodName": "v1.compute.projects.setCommonInstanceMetadata",
        "principalSubject": "user:dummy.user@dummy.com"
      },
      "canonicalName": "projects/856289305908/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "Persistence: Project SSH Key Added",        
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy.user@dummy.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2022-11-10T18:33:07.631Z",
      "database": {},
      "eventTime": "2022-11-10T18:33:07.271Z",
      "exfiltration": {},
      "findingClass": "OBSERVATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {
        "primaryTactic": "PERSISTENCE",
        "primaryTechniques": [
          "ACCOUNT_MANIPULATION",
          "SSH_AUTHORIZED_KEYS"
        ]
      },
      "mute": "UNDEFINED",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID",
      "parentDisplayName": "Sensitive Actions Service",
      "resourceName": "//compute.googleapis.com/projects/spring-banner-350111",
      "severity": "LOW",
      "sourceDisplayName": "Sensitive Actions Service",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/spring-banner-350111",
      "display_name": "spring-banner-350111",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "parent_display_name": "spring-banner-350111",
      "type": "google.compute.Project",
      "folders": []
    },
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "856289305908",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "ruleName": "sensitive_action",
        "subRuleName": "add_ssh_key"
      },
      "detectionPriority": "LOW",
      "affectedResources": [
        {
          "gcpResourceName": "//compute.googleapis.com/projects/spring-banner-350111"
        },
        {
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/856289305908"
        }
      ],
      "evidence": [
        {
          "sourceLogId": {
            "projectId": "spring-banner-350111",
            "resourceContainer": "projects/spring-banner-350111",
            "timestamp": {
              "seconds": "1668105185",
              "nanos": 642158000
            },
            "insertId": "v2stobd9ihi"
          }
        }
      ],
      "properties": {},
      "findingId": "findingId",
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "dummy.domain.com"
        }
      }
    }
  }
  

• Contoh log GCP_SECURITYCENTER_VULNERABILITY

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "Sample-00000",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/PROJECT_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "CLEAR_TEXT_PASSWORD",
      "compliances": [
        {
          "standard": "owasp",
          "version": "2017",
          "ids": [
            "A3"
          ]
        },
        {
          "standard": "owasp",
          "version": "2021",
          "ids": [
            "A02"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        }
      },
      "createTime": "2022-11-24T09:28:52.589Z",
      "database": {},
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "eventTime": "2022-11-24T04:56:26Z",
      "exfiltration": {},
      "externalUri": "https://sample.dummy.com/",
      "findingClass": "VULNERABILITY",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/css",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Web Security Scanner",
      "resourceName": "//dummy.sample.com",
      "severity": "MEDIUM",
      "sourceDisplayName": "Web Security Scanner",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com",
      "display_name": "dummy_name",
      "project_name": "//cloudresourcemanager.googleapis.com",
      "project_display_name": "dummy_name",
      "parent_name": "//dummy.sample.com",
      "parent_display_name": "Sample-Dev-Project",
      "type": "sample.cloud.dummy.Project",
      "folders": [
        {
          "resourceFolderDisplayName": "Sample-Dev-Project",
          "resourceFolder": "//cloudresourcemanager.googleapis.com/"
        }
      ]
    },
    "sourceProperties": {
      "severity": "MEDIUM",
      "fuzzedUrl": "dummy.domain.com",
      "form": {
        "actionUri": "dummy.domain.com",
        "fields": [
          "os_username",
          "os_password",
          "",
          "os_cookie",
          "os_destination",
          "user_role",
          "atl_token",
          "login"
        ]
      },
      "name": "projects/PROJECT_ID/scanConfigs/SCAN_CONFIG_ID/scanRuns/SCAN_RUN_ID/findings/FINDING_ID",
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "reproductionUrl": "http://198.51.100.1:0000/login.jsp?searchString=",
      "httpMethod": "GET",
      "finalUrl": "http://0.0.0.0:0000/sample.dummy=",
      "ResourcePath": [
        "projects/sample-dummy/",
        "folders/FOLDER_ID/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "owasp": [
          {
            "version": "2017",
            "ids": [
              "A3"
            ]
          },
          {
            "version": "2021",
            "ids": [
              "A02"
            ]
          }
        ]
      }
    }
  }
  

• Contoh log GCP_SECURITYCENTER_ERROR

  • JSON

  {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/742742027423",
    "state": "ACTIVE",
    "category": "KTD_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2022-11-23T16:36:03.458107Z",
    "createTime": "2022-11-01T07:36:37.078Z",
    "severity": "CRITICAL",
    "canonicalName": "projects/742742027423/sources/SOURCE_ID/findings/FINDING_ID",
    "mute": "UNDEFINED",
    "findingClass": "SCC_ERROR",
    "access": {
      "callerIpGeo": {}
    },
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      },
      "technical": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      }
    },
    "parentDisplayName": "Security Command Center",
    "description": "Either all or some Container Threat Detection findings aren\\u0027t being sent to Security Command Center. A service account is missing permissions required for Container Threat Detection.",
    "iamBindings": [
      {
        "member": "test.user@domain.com"
      }
    ],
    "nextSteps": "Restore the required IAM roles on the Container Threat Detection service account. \\n1. Go to [IAM](/iam-admin/iam) \\n2. Select the service account: \\"test.user@domain.com\\" \\n   - If you don\\u0027t see the service account listed, click  **Add** at the top of the page and enter it as a new principal \\n3. Apply the following role:* \\n    1. Container Threat Detection Service Agent \\n4. Click **Save**. \\n \\n*If you use custom roles, apply these missing permissions: \\n - container.clusterRoleBindings.create,container.clusterRoleBindings.delete,container.clusterRoleBindings.update,container.clusterRoles.create,container.clusterRoles.delete,container.clusterRoles.escalate,container.clusterRoles.update,container.customResourceDefinitions.create,container.customResourceDefinitions.delete,container.customResourceDefinitions.update,container.daemonSets.create,container.daemonSets.delete,container.daemonSets.update,container.daemonSets.updateStatus,container.networkPolicies.update,container.pods.attach,container.pods.create,container.pods.delete,container.pods.exec,container.pods.getLogs,container.pods.portForward,container.pods.update,container.roleBindings.create,container.roleBindings.delete,container.roleBindings.update,container.roles.bind,container.roles.create,container.roles.delete,container.roles.escalate,container.roles.update,container.secrets.create,container.secrets.list,container.secrets.delete,container.secrets.update,container.serviceAccounts.create,container.serviceAccounts.delete,container.serviceAccounts.update"
  }
  

• Contoh log GCP_SECURITYCENTER_UNSPECIFIED

  • JSON

  {
    "findings": {
      "access": {},
      "canonicalName": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "OPEN_FIREWALL",
      "compliances": [
        {
          "standard": "pci",
          "ids": [
            "1.2.1"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2021-07-20T08:33:25.343Z",
      "database": {},
      "eventTime": "2022-07-19T07:44:38.374Z",
      "exfiltration": {},
      "externalUri": "dummy.domain.com",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "MUTED",
      "muteInitiator": "Muted by test.user@dummy.xyz",
      "muteUpdateTime": "2022-03-08T05:41:06.507Z",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID"
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "severity": "HIGH",
      "sourceDisplayName": "Sanity_grc",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "display_name": "",
      "project_name": "",
      "project_display_name": "",
      "parent_name": "",
      "parent_display_name": "",
      "type": "",
      "folders": []
    },
    "sourceProperties": {
      "ScannerName": "FIREWALL_SCANNER",
      "ResourcePath": [
        "projects/calcium-vial-280707/",
        "organizations/ORGANIZATION_ID/"
      ],
      "ReactivationCount": 0,
      "AllowedIpRange": "All",
      "ExternallyAccessibleProtocolsAndPorts": [
        {
          "IPProtocol": "tcp",
          "ports": [
            "80"
          ]
        }
      ]
    }
  }
  
  

Referensi pemetaan kolom

Bagian ini menjelaskan cara parser Google Security Operations memetakan kolom log Security Command Center ke kolom Model Data Terpadu (UDM) Google Security Operations untuk set data.

Referensi pemetaan kolom: kolom log mentah ke kolom UDM

Tabel berikut mencantumkan kolom log dan pemetaan UDM yang sesuai untuk temuan Deteksi Ancaman Peristiwa Security Command Center.

Referensi pemetaan kolom: ID peristiwa ke jenis peristiwa

Tabel berikut berisi jenis peristiwa UDM dan pemetaan kolom UDM untuk kelas temuan Security Command Center - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION.

Kategori VULNERABILITY ke jenis peristiwa UDM

Tabel berikut mencantumkan kategori VULNERABILITY dan jenis peristiwa UDM yang sesuai.

Kategori MISCONFIGURATION ke jenis peristiwa UDM

Tabel berikut mencantumkan kategori SALAH KONFIGURASI dan jenis peristiwa UDM yang sesuai.

Kategori OBSERVATION ke jenis peristiwa UDM

Tabel berikut mencantumkan kategori OBSERVATION dan jenis peristiwa UDM yang sesuai.

Kategori ERROR ke jenis peristiwa UDM

Tabel berikut mencantumkan kategori ERROR dan jenis peristiwa UDM yang sesuai.

Kategori UNSPECIFIED ke jenis peristiwa UDM

Tabel berikut mencantumkan kategori UNSPECIFIED dan jenis peristiwa UDM yang sesuai.

Kategori POSTURE_VIOLATION ke jenis peristiwa UDM

Tabel berikut mencantumkan kategori POSTURE_VIOLATION dan jenis peristiwa UDM yang sesuai.

Referensi pemetaan kolom: VULNERABILITAS

Tabel berikut mencantumkan kolom log kategori VULNERABILITY dan kolom UDM yang sesuai.

Referensi pemetaan kolom: SALAH KONFIGURASI

Tabel berikut mencantumkan kolom log kategori MISCONFIGURATION dan kolom UDM yang sesuai.

Referensi pemetaan kolom: OBSERVATION

Tabel berikut mencantumkan kolom log kategori OBSERVATION dan kolom UDM yang sesuai.

Referensi pemetaan kolom: ERROR

Tabel berikut mencantumkan kolom log kategori ERROR dan kolom UDM yang sesuai.

Referensi pemetaan kolom: UNSPECIFIED

Tabel berikut mencantumkan kolom log kategori UNSPECIFIED dan kolom UDM yang sesuai.

Referensi pemetaan kolom: POSTURE_VIOLATION

Tabel berikut mencantumkan kolom log kategori POSTURE_VIOLATION dan kolom UDM yang sesuai.

Kolom Umum: SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION

Tabel berikut mencantumkan kolom umum kategori SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION dan kolom UDM yang sesuai.

Langkah berikutnya

• Penyerapan data ke Google Security Operations

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.