Recolha resultados do Security Command Center

Este documento descreve como pode recolher registos do Security Command Center configurando o Security Command Center e carregando as deteções para o Google Security Operations. Este documento também lista os eventos suportados.

Para mais informações, consulte os artigos Ingestão de dados no Google Security Operations e Exportar resultados do Security Command Center para o Google Security Operations. Uma implementação típica consiste no Security Command Center e no feed do Google Security Operations configurado para enviar registos para o Google Security Operations. Cada implementação do cliente pode ser diferente e mais complexa.

A implementação contém os seguintes componentes:

• Google Cloud: o sistema a ser monitorizado no qual o Security Command Center está instalado.

• Resultados da deteção de ameaças de eventos do Security Command Center: recolhe informações da origem de dados e gera resultados.

• Google Security Operations: retém e analisa os registos do Security Command Center.

Uma etiqueta de carregamento identifica o analisador que normaliza os dados de registo não processados para o formato UDM estruturado. As informações neste documento aplicam-se ao analisador do Security Command Center com as seguintes etiquetas de carregamento:

• GCP_SECURITYCENTER_ERROR

• GCP_SECURITYCENTER_MISCONFIGURATION

• GCP_SECURITYCENTER_OBSERVATION

• GCP_SECURITYCENTER_THREAT

• GCP_SECURITYCENTER_UNSPECIFIED

• GCP_SECURITYCENTER_VULNERABILITY

• GCP_SECURITYCENTER_POSTURE_VIOLATION

• GCP_SECURITYCENTER_TOXIC_COMBINATION

Configure o Security Command Center e Google Cloud para enviar resultados para o Google Security Operations

• Ative o Security Command Center.

• Certifique-se de que todos os sistemas na implementação estão configurados no fuso horário UTC.

• Ative o carregamento de conclusões do Security Command Center.

Resultados da Deteção de ameaças de eventos suportados

Esta secção lista as conclusões da Deteção de ameaças de eventos suportadas. Para obter informações sobre as regras e as conclusões da Deteção de ameaças de eventos do Security Command Center, consulte o artigo Regras de Deteção de ameaças de eventos.

Resultados de GCP_SECURITYCENTER_ERROR suportados

Pode encontrar o mapeamento de UDM na tabela Referência de mapeamento de campos: ERRO.

Resultados suportados de GCP_SECURITYCENTER_OBSERVATION

Pode encontrar o mapeamento de UDM na tabela Referência de mapeamento de campos: OBSERVATION.

Resultados GCP_SECURITYCENTER_UNSPECIFIED suportados

Pode encontrar o mapeamento de UDM na tabela Referência de mapeamento de campos: UNSPECIFIED.

Resultados suportados de GCP_SECURITYCENTER_VULNERABILITY

Pode encontrar o mapeamento da UDM na tabela Referência de mapeamento de campos: VULNERABILIDADE.

Resultados de GCP_SECURITYCENTER_MISCONFIGURATION suportados

Pode encontrar o mapeamento de UDM na tabela Referência de mapeamento de campos: MISCONFIGURATION.

Resultados de GCP_SECURITYCENTER_POSTURE_VIOLATION suportados

Pode encontrar o mapeamento de UDM na tabela Referência de mapeamento de campos: VIOLAÇÃO DE POSTURA.

Formatos de registo do centro de segurança suportados

O analisador do Centro de segurança suporta registos no formato JSON.

Registos de exemplo do centro de segurança suportados

• Registos de exemplo de GCP_SECURITYCENTER_THREAT

  • JSON

  {
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME",
      "state": "ACTIVE",
      "category": "Credential Access: External Member Added To Privileged Group",
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "technique": "persistence",
          "indicator": "audit_log",
          "ruleName": "external_member_added_to_privileged_group"
        },
        "detectionPriority": "HIGH",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1633622881",
                "nanos": 6.73869E8
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {
          "externalMemberAddedToPrivilegedGroup": {
            "principalEmail": "abc@gmail.com",
            "groupName": "group:GROUP_NAME@ORGANIZATION_NAME",
            "externalMember": "user:abc@gamil.com",
            "sensitiveRoles": [
              {
                "resource": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
                "roleName": [
                  "ROLES"
                ]
              }
            ]
          }
        },
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "dummy display name",
            "url": " dummy.url.com"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query\\u003dtimestamp%3D%222022-10-01T16:08:01.673869Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project\\u003d"
            }
          ]
        }
      },
      "securityMarks": {
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
      },
      "eventTime": "2022-10-01T16:08:03.888Z",
      "createTime": "2022-10-01T16:08:04.516Z",
      "severity": "HIGH",
      "workflowState": "NEW",
      "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "findingClass": "THREAT"
    },
    "resource": {
      "name": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
    }
  }
  

• Exemplos de registos de GCP_SECURITYCENTER_MISCONFIGURATION

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "eventApps",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/1032183397765/sources/4563429019522465317/findings/fdb789f992c67f6386ec735aca337bab",
      "category": "API_KEY_APIS_UNRESTRICTED",
      "compliances": [
        {
          "standard": "cis",
          "version": "1.0",
          "ids": [
            "1.12"
          ]
        },
        {
          "standard": "cis",
          "version": "1.1",
          "ids": [
            "1.14"
          ]
        },
        {
          "standard": "cis",
          "version": "1.2",
          "ids": [
            "1.14"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        }
      },
      "createTime": "2022-12-01T15:16:21.119Z",
      "database": {},
      "description": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "eventTime": "2022-12-01T14:35:42.317Z",
      "exfiltration": {},
      "externalUri": "https://console.cloud.google.com/apis/credentials?project=eventapps-27705",
      "findingClass": "MISCONFIGURATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/security_health_advisor",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "severity": "MEDIUM",
      "sourceDisplayName": "Security Health Analytics",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "display_name": "dummy-display-name",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
      "parent_display_name": "domainname.com",
      "type": "google.cloud.resourcemanager.Project",
      "folders": []
    },
    "sourceProperties": {
      "Recommendation": "Go to https://console.cloud.google.com/apis/credentials?project=eventapps-27705. In the section \\"API keys,\\" for each API key, click the name of the key. It will display API Key properties on a new page. In the \\"Key restrictions\\" section, set API restrictions to \\"Restrict key.\\" Click the \\"Select APIs\\" drop-down menu to choose which APIs to allow. Click \\"Save.\\"
      "ExceptionInstructions": "Add the security mark \\"allow_api_key_apis_unrestricted\\" to the asset with a value of \\"true\\" to prevent this finding from being activated again.",
      "Explanation": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "ScannerName": "API_KEY_SCANNER",
      "ResourcePath": [
        "projects/eventapps-27705/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "cis": [
          {
            "version": "1.0",
            "ids": [
              "1.12"
            ]
          },
          {
            "version": "1.1",
            "ids": [
              "1.14"
            ]
          },
          {
            "version": "1.2",
            "ids": [
              "1.14"
            ]
          }
        ]
      },
      "ReactivationCount": 0
    }
  }
  

• Registos de exemplo de GCP_SECURITYCENTER_OBSERVATION

  • JSON

  {
    "findings": {
      "access": {
        "principalEmail": "dummy.user@dummy.com",
        "callerIp": "198.51.100.1",
        "callerIpGeo": {
          "regionCode": "SG"
        },
        "serviceName": "compute.googleapis.com",
        "methodName": "v1.compute.projects.setCommonInstanceMetadata",
        "principalSubject": "user:dummy.user@dummy.com"
      },
      "canonicalName": "projects/856289305908/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "Persistence: Project SSH Key Added",        
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy.user@dummy.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2022-11-10T18:33:07.631Z",
      "database": {},
      "eventTime": "2022-11-10T18:33:07.271Z",
      "exfiltration": {},
      "findingClass": "OBSERVATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {
        "primaryTactic": "PERSISTENCE",
        "primaryTechniques": [
          "ACCOUNT_MANIPULATION",
          "SSH_AUTHORIZED_KEYS"
        ]
      },
      "mute": "UNDEFINED",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID",
      "parentDisplayName": "Sensitive Actions Service",
      "resourceName": "//compute.googleapis.com/projects/spring-banner-350111",
      "severity": "LOW",
      "sourceDisplayName": "Sensitive Actions Service",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/spring-banner-350111",
      "display_name": "spring-banner-350111",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "parent_display_name": "spring-banner-350111",
      "type": "google.compute.Project",
      "folders": []
    },
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "856289305908",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "ruleName": "sensitive_action",
        "subRuleName": "add_ssh_key"
      },
      "detectionPriority": "LOW",
      "affectedResources": [
        {
          "gcpResourceName": "//compute.googleapis.com/projects/spring-banner-350111"
        },
        {
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/856289305908"
        }
      ],
      "evidence": [
        {
          "sourceLogId": {
            "projectId": "spring-banner-350111",
            "resourceContainer": "projects/spring-banner-350111",
            "timestamp": {
              "seconds": "1668105185",
              "nanos": 642158000
            },
            "insertId": "v2stobd9ihi"
          }
        }
      ],
      "properties": {},
      "findingId": "findingId",
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "dummy.domain.com"
        }
      }
    }
  }
  

• Exemplos de registos de GCP_SECURITYCENTER_VULNERABILITY

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "Sample-00000",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/PROJECT_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "CLEAR_TEXT_PASSWORD",
      "compliances": [
        {
          "standard": "owasp",
          "version": "2017",
          "ids": [
            "A3"
          ]
        },
        {
          "standard": "owasp",
          "version": "2021",
          "ids": [
            "A02"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        }
      },
      "createTime": "2022-11-24T09:28:52.589Z",
      "database": {},
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "eventTime": "2022-11-24T04:56:26Z",
      "exfiltration": {},
      "externalUri": "https://sample.dummy.com/",
      "findingClass": "VULNERABILITY",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/css",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Web Security Scanner",
      "resourceName": "//dummy.sample.com",
      "severity": "MEDIUM",
      "sourceDisplayName": "Web Security Scanner",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com",
      "display_name": "dummy_name",
      "project_name": "//cloudresourcemanager.googleapis.com",
      "project_display_name": "dummy_name",
      "parent_name": "//dummy.sample.com",
      "parent_display_name": "Sample-Dev-Project",
      "type": "sample.cloud.dummy.Project",
      "folders": [
        {
          "resourceFolderDisplayName": "Sample-Dev-Project",
          "resourceFolder": "//cloudresourcemanager.googleapis.com/"
        }
      ]
    },
    "sourceProperties": {
      "severity": "MEDIUM",
      "fuzzedUrl": "dummy.domain.com",
      "form": {
        "actionUri": "dummy.domain.com",
        "fields": [
          "os_username",
          "os_password",
          "",
          "os_cookie",
          "os_destination",
          "user_role",
          "atl_token",
          "login"
        ]
      },
      "name": "projects/PROJECT_ID/scanConfigs/SCAN_CONFIG_ID/scanRuns/SCAN_RUN_ID/findings/FINDING_ID",
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "reproductionUrl": "http://198.51.100.1:0000/login.jsp?searchString=",
      "httpMethod": "GET",
      "finalUrl": "http://0.0.0.0:0000/sample.dummy=",
      "ResourcePath": [
        "projects/sample-dummy/",
        "folders/FOLDER_ID/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "owasp": [
          {
            "version": "2017",
            "ids": [
              "A3"
            ]
          },
          {
            "version": "2021",
            "ids": [
              "A02"
            ]
          }
        ]
      }
    }
  }
  

• Registos de exemplo de GCP_SECURITYCENTER_ERROR

  • JSON

  {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/742742027423",
    "state": "ACTIVE",
    "category": "KTD_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2022-11-23T16:36:03.458107Z",
    "createTime": "2022-11-01T07:36:37.078Z",
    "severity": "CRITICAL",
    "canonicalName": "projects/742742027423/sources/SOURCE_ID/findings/FINDING_ID",
    "mute": "UNDEFINED",
    "findingClass": "SCC_ERROR",
    "access": {
      "callerIpGeo": {}
    },
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      },
      "technical": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      }
    },
    "parentDisplayName": "Security Command Center",
    "description": "Either all or some Container Threat Detection findings aren\\u0027t being sent to Security Command Center. A service account is missing permissions required for Container Threat Detection.",
    "iamBindings": [
      {
        "member": "test.user@domain.com"
      }
    ],
    "nextSteps": "Restore the required IAM roles on the Container Threat Detection service account. \\n1. Go to [IAM](/iam-admin/iam) \\n2. Select the service account: \\"test.user@domain.com\\" \\n   - If you don\\u0027t see the service account listed, click  **Add** at the top of the page and enter it as a new principal \\n3. Apply the following role:* \\n    1. Container Threat Detection Service Agent \\n4. Click **Save**. \\n \\n*If you use custom roles, apply these missing permissions: \\n - container.clusterRoleBindings.create,container.clusterRoleBindings.delete,container.clusterRoleBindings.update,container.clusterRoles.create,container.clusterRoles.delete,container.clusterRoles.escalate,container.clusterRoles.update,container.customResourceDefinitions.create,container.customResourceDefinitions.delete,container.customResourceDefinitions.update,container.daemonSets.create,container.daemonSets.delete,container.daemonSets.update,container.daemonSets.updateStatus,container.networkPolicies.update,container.pods.attach,container.pods.create,container.pods.delete,container.pods.exec,container.pods.getLogs,container.pods.portForward,container.pods.update,container.roleBindings.create,container.roleBindings.delete,container.roleBindings.update,container.roles.bind,container.roles.create,container.roles.delete,container.roles.escalate,container.roles.update,container.secrets.create,container.secrets.list,container.secrets.delete,container.secrets.update,container.serviceAccounts.create,container.serviceAccounts.delete,container.serviceAccounts.update"
  }
  

• GCP_SECURITYCENTER_UNSPECIFIED sample logs

  • JSON

  {
    "findings": {
      "access": {},
      "canonicalName": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "OPEN_FIREWALL",
      "compliances": [
        {
          "standard": "pci",
          "ids": [
            "1.2.1"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2021-07-20T08:33:25.343Z",
      "database": {},
      "eventTime": "2022-07-19T07:44:38.374Z",
      "exfiltration": {},
      "externalUri": "dummy.domain.com",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "MUTED",
      "muteInitiator": "Muted by test.user@dummy.xyz",
      "muteUpdateTime": "2022-03-08T05:41:06.507Z",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID"
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "severity": "HIGH",
      "sourceDisplayName": "Sanity_grc",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "display_name": "",
      "project_name": "",
      "project_display_name": "",
      "parent_name": "",
      "parent_display_name": "",
      "type": "",
      "folders": []
    },
    "sourceProperties": {
      "ScannerName": "FIREWALL_SCANNER",
      "ResourcePath": [
        "projects/calcium-vial-280707/",
        "organizations/ORGANIZATION_ID/"
      ],
      "ReactivationCount": 0,
      "AllowedIpRange": "All",
      "ExternallyAccessibleProtocolsAndPorts": [
        {
          "IPProtocol": "tcp",
          "ports": [
            "80"
          ]
        }
      ]
    }
  }
  
  

Referência de mapeamento de campos

Esta secção explica como o analisador do Google Security Operations mapeia os campos de registo do Security Command Center para os campos do modelo de dados unificado (UDM) do Google Security Operations para os conjuntos de dados.

Referência de mapeamento de campos: campos de registos não processados para campos de UDM

A tabela seguinte apresenta os campos de registo e os mapeamentos da UDM correspondentes para as conclusões da Deteção de ameaças de eventos do Security Command Center.

Referência de mapeamento de campos: identificador do evento para tipo de evento

As tabelas seguintes contêm tipos de eventos UDM e mapeamento de campos UDM para o Security Command Center: classes de deteção VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED e POSTURE_VIOLATION.

Categoria VULNERABILITY para o tipo de evento UDM

A tabela seguinte apresenta a categoria VULNERABILITY e os respetivos tipos de eventos UDM correspondentes.

Categoria MISCONFIGURATION para o tipo de evento UDM

A tabela seguinte apresenta a categoria MISCONFIGURATION e os respetivos tipos de eventos da UDM.

Categoria OBSERVATION para tipo de evento UDM

A tabela seguinte apresenta a categoria OBSERVATION e os respetivos tipos de eventos do UDM.

Categoria de ERRO para o tipo de evento UDM

A tabela seguinte apresenta a categoria ERROR e os respetivos tipos de eventos da UDM.

Categoria UNSPECIFIED para o tipo de evento UDM

A tabela seguinte apresenta a categoria UNSPECIFIED e os respetivos tipos de eventos da UDM.

Categoria POSTURE_VIOLATION para o tipo de evento UDM

A tabela seguinte apresenta a categoria POSTURE_VIOLATION e os respetivos tipos de eventos UDM.

Referência de mapeamento de campos: VULNERABILITY

A tabela seguinte apresenta os campos de registo da categoria VULNERABILITY e os respetivos campos da UDM.

Referência de mapeamento de campos: MISCONFIGURATION

A tabela seguinte apresenta os campos de registo da categoria MISCONFIGURATION e os respetivos campos UDM.

Referência de mapeamento de campos: OBSERVATION

A tabela seguinte apresenta os campos de registo da categoria OBSERVATION e os respetivos campos UDM correspondentes.

Referência do mapeamento de campos: ERROR

A tabela seguinte apresenta os campos de registo da categoria ERROR e os respetivos campos UDM.

Referência de mapeamento de campos: UNSPECIFIED

A tabela seguinte apresenta os campos de registo da categoria UNSPECIFIED e os respetivos campos da UDM.

Referência de mapeamento de campos: POSTURE_VIOLATION

A tabela seguinte apresenta os campos de registo da categoria POSTURE_VIOLATION e os respetivos campos da UDM.

Campos comuns: SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION

A tabela seguinte apresenta os campos comuns das categorias SECURITY COMMAND CENTER: VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION e TOXIC_COMBINATION, e os respetivos campos UDM.

O que se segue?

• Carregamento de dados para o Google Security Operations

Precisa de mais ajuda? Receba respostas de membros da comunidade e profissionais da Google SecOps.