Raccogliere i risultati di Security Command Center

Questo documento descrive come raccogliere i log di Security Command Center configurando Security Command Center e importando i risultati in Google Security Operations. Questo documento elenca anche gli eventi supportati.

Per ulteriori informazioni, consulta Importazione dei dati in Google Security Operations ed Esportazione dei risultati di Security Command Center in Google Security Operations. Un deployment tipico è costituito da Security Command Center e dal feed Google Security Operations configurato per inviare i log a Google Security Operations. Ogni implementazione del cliente potrebbe essere diversa e più complessa.

Il deployment contiene i seguenti componenti:

• Google Cloud: il sistema da monitorare in cui è installato Security Command Center.

• Risultati di Event Threat Detection di Security Command Center: raccoglie informazioni dall'origine dati e genera risultati.

• Google Security Operations: conserva e analizza i log di Security Command Center.

Un'etichetta di importazione identifica il parser che normalizza i dati dei log non elaborati in formato UDM strutturato. Le informazioni contenute in questo documento si applicano al parser Security Command Center con le seguenti etichette di importazione:

• GCP_SECURITYCENTER_ERROR

• GCP_SECURITYCENTER_MISCONFIGURATION

• GCP_SECURITYCENTER_OBSERVATION

• GCP_SECURITYCENTER_THREAT

• GCP_SECURITYCENTER_UNSPECIFIED

• GCP_SECURITYCENTER_VULNERABILITY

• GCP_SECURITYCENTER_POSTURE_VIOLATION

• GCP_SECURITYCENTER_TOXIC_COMBINATION

Configura Security Command Center e Google Cloud per inviare i risultati a Google Security Operations

• Attiva Security Command Center.

• Assicurati che tutti i sistemi nel deployment siano configurati nel fuso orario UTC.

• Abilita l'importazione dei risultati di Security Command Center.

Risultati di Event Threat Detection supportati

Questa sezione elenca i risultati supportati di Event Threat Detection. Per informazioni sulle regole e sui risultati di Event Threat Detection di Security Command Center, consulta Regole di Event Threat Detection.

Risultati GCP_SECURITYCENTER_ERROR supportati

Puoi trovare la mappatura UDM nella tabella Riferimento alla mappatura dei campi: ERRORE.

Risultati di GCP_SECURITYCENTER_OBSERVATION supportati

Puoi trovare la mappatura UDM nella tabella Riferimento alla mappatura dei campi: OBSERVATION.

Risultati GCP_SECURITYCENTER_UNSPECIFIED supportati

Puoi trovare la mappatura UDM nella tabella Riferimento alla mappatura dei campi: UNSPECIFIED.

Risultati GCP_SECURITYCENTER_VULNERABILITY supportati

Puoi trovare la mappatura UDM nella tabella Riferimento alla mappatura dei campi: VULNERABILITÀ.

Risultati GCP_SECURITYCENTER_MISCONFIGURATION supportati

Puoi trovare la mappatura UDM nella tabella Riferimento alla mappatura dei campi: CONFIGURAZIONE ERRATA.

Risultati GCP_SECURITYCENTER_POSTURE_VIOLATION supportati

Puoi trovare la mappatura UDM nella tabella Riferimento alla mappatura dei campi: POSTURE VIOLATION.

Formati dei log del Centro sicurezza supportati

Il parser di Security Center supporta i log in formato JSON.

Log di esempio del Centro sicurezza supportati

• Log di esempio GCP_SECURITYCENTER_THREAT

  • JSON

  {
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME",
      "state": "ACTIVE",
      "category": "Credential Access: External Member Added To Privileged Group",
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "technique": "persistence",
          "indicator": "audit_log",
          "ruleName": "external_member_added_to_privileged_group"
        },
        "detectionPriority": "HIGH",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1633622881",
                "nanos": 6.73869E8
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {
          "externalMemberAddedToPrivilegedGroup": {
            "principalEmail": "abc@gmail.com",
            "groupName": "group:GROUP_NAME@ORGANIZATION_NAME",
            "externalMember": "user:abc@gamil.com",
            "sensitiveRoles": [
              {
                "resource": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
                "roleName": [
                  "ROLES"
                ]
              }
            ]
          }
        },
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "dummy display name",
            "url": " dummy.url.com"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query\\u003dtimestamp%3D%222022-10-01T16:08:01.673869Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project\\u003d"
            }
          ]
        }
      },
      "securityMarks": {
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
      },
      "eventTime": "2022-10-01T16:08:03.888Z",
      "createTime": "2022-10-01T16:08:04.516Z",
      "severity": "HIGH",
      "workflowState": "NEW",
      "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "findingClass": "THREAT"
    },
    "resource": {
      "name": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
    }
  }
  

• Log di esempio GCP_SECURITYCENTER_MISCONFIGURATION

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "eventApps",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/1032183397765/sources/4563429019522465317/findings/fdb789f992c67f6386ec735aca337bab",
      "category": "API_KEY_APIS_UNRESTRICTED",
      "compliances": [
        {
          "standard": "cis",
          "version": "1.0",
          "ids": [
            "1.12"
          ]
        },
        {
          "standard": "cis",
          "version": "1.1",
          "ids": [
            "1.14"
          ]
        },
        {
          "standard": "cis",
          "version": "1.2",
          "ids": [
            "1.14"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        }
      },
      "createTime": "2022-12-01T15:16:21.119Z",
      "database": {},
      "description": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "eventTime": "2022-12-01T14:35:42.317Z",
      "exfiltration": {},
      "externalUri": "https://console.cloud.google.com/apis/credentials?project=eventapps-27705",
      "findingClass": "MISCONFIGURATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/security_health_advisor",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "severity": "MEDIUM",
      "sourceDisplayName": "Security Health Analytics",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "display_name": "dummy-display-name",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
      "parent_display_name": "domainname.com",
      "type": "google.cloud.resourcemanager.Project",
      "folders": []
    },
    "sourceProperties": {
      "Recommendation": "Go to https://console.cloud.google.com/apis/credentials?project=eventapps-27705. In the section \\"API keys,\\" for each API key, click the name of the key. It will display API Key properties on a new page. In the \\"Key restrictions\\" section, set API restrictions to \\"Restrict key.\\" Click the \\"Select APIs\\" drop-down menu to choose which APIs to allow. Click \\"Save.\\"
      "ExceptionInstructions": "Add the security mark \\"allow_api_key_apis_unrestricted\\" to the asset with a value of \\"true\\" to prevent this finding from being activated again.",
      "Explanation": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "ScannerName": "API_KEY_SCANNER",
      "ResourcePath": [
        "projects/eventapps-27705/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "cis": [
          {
            "version": "1.0",
            "ids": [
              "1.12"
            ]
          },
          {
            "version": "1.1",
            "ids": [
              "1.14"
            ]
          },
          {
            "version": "1.2",
            "ids": [
              "1.14"
            ]
          }
        ]
      },
      "ReactivationCount": 0
    }
  }
  

• Log di esempio GCP_SECURITYCENTER_OBSERVATION

  • JSON

  {
    "findings": {
      "access": {
        "principalEmail": "dummy.user@dummy.com",
        "callerIp": "198.51.100.1",
        "callerIpGeo": {
          "regionCode": "SG"
        },
        "serviceName": "compute.googleapis.com",
        "methodName": "v1.compute.projects.setCommonInstanceMetadata",
        "principalSubject": "user:dummy.user@dummy.com"
      },
      "canonicalName": "projects/856289305908/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "Persistence: Project SSH Key Added",        
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy.user@dummy.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2022-11-10T18:33:07.631Z",
      "database": {},
      "eventTime": "2022-11-10T18:33:07.271Z",
      "exfiltration": {},
      "findingClass": "OBSERVATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {
        "primaryTactic": "PERSISTENCE",
        "primaryTechniques": [
          "ACCOUNT_MANIPULATION",
          "SSH_AUTHORIZED_KEYS"
        ]
      },
      "mute": "UNDEFINED",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID",
      "parentDisplayName": "Sensitive Actions Service",
      "resourceName": "//compute.googleapis.com/projects/spring-banner-350111",
      "severity": "LOW",
      "sourceDisplayName": "Sensitive Actions Service",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/spring-banner-350111",
      "display_name": "spring-banner-350111",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "parent_display_name": "spring-banner-350111",
      "type": "google.compute.Project",
      "folders": []
    },
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "856289305908",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "ruleName": "sensitive_action",
        "subRuleName": "add_ssh_key"
      },
      "detectionPriority": "LOW",
      "affectedResources": [
        {
          "gcpResourceName": "//compute.googleapis.com/projects/spring-banner-350111"
        },
        {
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/856289305908"
        }
      ],
      "evidence": [
        {
          "sourceLogId": {
            "projectId": "spring-banner-350111",
            "resourceContainer": "projects/spring-banner-350111",
            "timestamp": {
              "seconds": "1668105185",
              "nanos": 642158000
            },
            "insertId": "v2stobd9ihi"
          }
        }
      ],
      "properties": {},
      "findingId": "findingId",
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "dummy.domain.com"
        }
      }
    }
  }
  

• Log di esempio GCP_SECURITYCENTER_VULNERABILITY

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "Sample-00000",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/PROJECT_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "CLEAR_TEXT_PASSWORD",
      "compliances": [
        {
          "standard": "owasp",
          "version": "2017",
          "ids": [
            "A3"
          ]
        },
        {
          "standard": "owasp",
          "version": "2021",
          "ids": [
            "A02"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        }
      },
      "createTime": "2022-11-24T09:28:52.589Z",
      "database": {},
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "eventTime": "2022-11-24T04:56:26Z",
      "exfiltration": {},
      "externalUri": "https://sample.dummy.com/",
      "findingClass": "VULNERABILITY",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/css",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Web Security Scanner",
      "resourceName": "//dummy.sample.com",
      "severity": "MEDIUM",
      "sourceDisplayName": "Web Security Scanner",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com",
      "display_name": "dummy_name",
      "project_name": "//cloudresourcemanager.googleapis.com",
      "project_display_name": "dummy_name",
      "parent_name": "//dummy.sample.com",
      "parent_display_name": "Sample-Dev-Project",
      "type": "sample.cloud.dummy.Project",
      "folders": [
        {
          "resourceFolderDisplayName": "Sample-Dev-Project",
          "resourceFolder": "//cloudresourcemanager.googleapis.com/"
        }
      ]
    },
    "sourceProperties": {
      "severity": "MEDIUM",
      "fuzzedUrl": "dummy.domain.com",
      "form": {
        "actionUri": "dummy.domain.com",
        "fields": [
          "os_username",
          "os_password",
          "",
          "os_cookie",
          "os_destination",
          "user_role",
          "atl_token",
          "login"
        ]
      },
      "name": "projects/PROJECT_ID/scanConfigs/SCAN_CONFIG_ID/scanRuns/SCAN_RUN_ID/findings/FINDING_ID",
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "reproductionUrl": "http://198.51.100.1:0000/login.jsp?searchString=",
      "httpMethod": "GET",
      "finalUrl": "http://0.0.0.0:0000/sample.dummy=",
      "ResourcePath": [
        "projects/sample-dummy/",
        "folders/FOLDER_ID/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "owasp": [
          {
            "version": "2017",
            "ids": [
              "A3"
            ]
          },
          {
            "version": "2021",
            "ids": [
              "A02"
            ]
          }
        ]
      }
    }
  }
  

• Log di esempio GCP_SECURITYCENTER_ERROR

  • JSON

  {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/742742027423",
    "state": "ACTIVE",
    "category": "KTD_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2022-11-23T16:36:03.458107Z",
    "createTime": "2022-11-01T07:36:37.078Z",
    "severity": "CRITICAL",
    "canonicalName": "projects/742742027423/sources/SOURCE_ID/findings/FINDING_ID",
    "mute": "UNDEFINED",
    "findingClass": "SCC_ERROR",
    "access": {
      "callerIpGeo": {}
    },
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      },
      "technical": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      }
    },
    "parentDisplayName": "Security Command Center",
    "description": "Either all or some Container Threat Detection findings aren\\u0027t being sent to Security Command Center. A service account is missing permissions required for Container Threat Detection.",
    "iamBindings": [
      {
        "member": "test.user@domain.com"
      }
    ],
    "nextSteps": "Restore the required IAM roles on the Container Threat Detection service account. \\n1. Go to [IAM](/iam-admin/iam) \\n2. Select the service account: \\"test.user@domain.com\\" \\n   - If you don\\u0027t see the service account listed, click  **Add** at the top of the page and enter it as a new principal \\n3. Apply the following role:* \\n    1. Container Threat Detection Service Agent \\n4. Click **Save**. \\n \\n*If you use custom roles, apply these missing permissions: \\n - container.clusterRoleBindings.create,container.clusterRoleBindings.delete,container.clusterRoleBindings.update,container.clusterRoles.create,container.clusterRoles.delete,container.clusterRoles.escalate,container.clusterRoles.update,container.customResourceDefinitions.create,container.customResourceDefinitions.delete,container.customResourceDefinitions.update,container.daemonSets.create,container.daemonSets.delete,container.daemonSets.update,container.daemonSets.updateStatus,container.networkPolicies.update,container.pods.attach,container.pods.create,container.pods.delete,container.pods.exec,container.pods.getLogs,container.pods.portForward,container.pods.update,container.roleBindings.create,container.roleBindings.delete,container.roleBindings.update,container.roles.bind,container.roles.create,container.roles.delete,container.roles.escalate,container.roles.update,container.secrets.create,container.secrets.list,container.secrets.delete,container.secrets.update,container.serviceAccounts.create,container.serviceAccounts.delete,container.serviceAccounts.update"
  }
  

• Log di esempio GCP_SECURITYCENTER_UNSPECIFIED

  • JSON

  {
    "findings": {
      "access": {},
      "canonicalName": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "OPEN_FIREWALL",
      "compliances": [
        {
          "standard": "pci",
          "ids": [
            "1.2.1"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2021-07-20T08:33:25.343Z",
      "database": {},
      "eventTime": "2022-07-19T07:44:38.374Z",
      "exfiltration": {},
      "externalUri": "dummy.domain.com",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "MUTED",
      "muteInitiator": "Muted by test.user@dummy.xyz",
      "muteUpdateTime": "2022-03-08T05:41:06.507Z",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID"
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "severity": "HIGH",
      "sourceDisplayName": "Sanity_grc",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "display_name": "",
      "project_name": "",
      "project_display_name": "",
      "parent_name": "",
      "parent_display_name": "",
      "type": "",
      "folders": []
    },
    "sourceProperties": {
      "ScannerName": "FIREWALL_SCANNER",
      "ResourcePath": [
        "projects/calcium-vial-280707/",
        "organizations/ORGANIZATION_ID/"
      ],
      "ReactivationCount": 0,
      "AllowedIpRange": "All",
      "ExternallyAccessibleProtocolsAndPorts": [
        {
          "IPProtocol": "tcp",
          "ports": [
            "80"
          ]
        }
      ]
    }
  }
  
  

Riferimento alla mappatura dei campi

Questa sezione spiega come il parser di Google Security Operations mappa i campi dei log di Security Command Center ai campi del modello UDM (Unified Data Model) di Google Security Operations per i set di dati.

Riferimento per la mappatura dei campi: campi di log non elaborati e campi UDM

La tabella seguente elenca i campi dei log e i mapping UDM corrispondenti per i risultati di Event Threat Detection di Security Command Center.

Riferimento alla mappatura dei campi: identificatore evento e tipo di evento

Le seguenti tabelle contengono i tipi di eventi UDM e il mapping dei campi UDM per le classi di risultati di Security Command Center: VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION.

Categoria VULNERABILITY al tipo di evento UDM

La tabella seguente elenca la categoria VULNERABILITY e i relativi tipi di eventi UDM.

Categoria ERRORE DI CONFIGURAZIONE al tipo di evento UDM

La tabella seguente elenca la categoria MISCONFIGURATION e i relativi tipi di eventi UDM.

Categoria OSSERVAZIONE al tipo di evento UDM

La tabella seguente elenca la categoria OSSERVAZIONE e i relativi tipi di eventi UDM.

Categoria ERROR al tipo di evento UDM

La tabella seguente elenca la categoria ERROR e i relativi tipi di eventi UDM.

Categoria UNSPECIFIED al tipo di evento UDM

La tabella seguente elenca la categoria UNSPECIFIED e i relativi tipi di eventi UDM.

Categoria POSTURE_VIOLATION al tipo di evento UDM

La tabella seguente elenca la categoria POSTURE_VIOLATION e i relativi tipi di eventi UDM.

Riferimento per la mappatura dei campi: VULNERABILITÀ

La tabella seguente elenca i campi di log della categoria VULNERABILITY e i relativi campi UDM.

Riferimento mappatura campi: MISCONFIGURATION

La tabella seguente elenca i campi di log della categoria MISCONFIGURATION e i relativi campi UDM.

Riferimento per la mappatura dei campi: OBSERVATION

La tabella seguente elenca i campi di log della categoria OBSERVATION e i campi UDM corrispondenti.

Riferimento mappatura campi: ERRORE

La tabella seguente elenca i campi di log della categoria ERROR e i campi UDM corrispondenti.

Riferimento mappatura campi: NON SPECIFICATO

La tabella seguente elenca i campi log della categoria UNSPECIFIED e i campi UDM corrispondenti.

Riferimento mappatura campi: POSTURE_VIOLATION

La tabella seguente elenca i campi di log della categoria POSTURE_VIOLATION e i relativi campi UDM.

Common Fields: SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION

La seguente tabella elenca i campi comuni delle categorie SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION e i relativi campi UDM.

Passaggi successivi

• Importazione dei dati in Google Security Operations

Hai bisogno di ulteriore assistenza? Ricevi risposte dai membri della community e dai professionisti di Google SecOps.