Coletar descobertas do Security Command Center

Neste documento, descrevemos como coletar registros do Security Command Center configurando o SCC e ingerindo descobertas no Google Security Operations. Este documento também lista os eventos compatíveis.

Para mais informações, consulte Ingestão de dados no Google Security Operations e Exportação de descobertas do Security Command Center para o Google Security Operations. Uma implantação típica consiste no Security Command Center e no feed do Google Security Operations configurados para enviar registros ao Google Security Operations. Cada implantação de cliente pode ser diferente e mais complexa.

A implantação contém os seguintes componentes:

• Google Cloud: o sistema a ser monitorado em que o Security Command Center está instalado.

• Descobertas do Event Threat Detection do Security Command Center: coleta informações da fonte de dados e gera descobertas.

• Google Security Operations: retém e analisa os registros do Security Command Center.

Um rótulo de ingestão identifica o analisador que normaliza dados de registro brutos para o formato UDM estruturado. As informações neste documento se aplicam ao analisador do Security Command Center com os seguintes rótulos de ingestão:

• GCP_SECURITYCENTER_ERROR

• GCP_SECURITYCENTER_MISCONFIGURATION

• GCP_SECURITYCENTER_OBSERVATION

• GCP_SECURITYCENTER_THREAT

• GCP_SECURITYCENTER_UNSPECIFIED

• GCP_SECURITYCENTER_VULNERABILITY

• GCP_SECURITYCENTER_POSTURE_VIOLATION

• GCP_SECURITYCENTER_TOXIC_COMBINATION

Configurar o Security Command Center e o Google Cloud para enviar descobertas ao Google Security Operations

• Ativar o Security Command Center.

• Verifique se todos os sistemas na implantação estão configurados no fuso horário UTC.

• Ative a ingestão de descobertas do Security Command Center.

Descobertas compatíveis do Event Threat Detection

Esta seção lista as descobertas compatíveis do Event Threat Detection. Para informações sobre as regras e descobertas do Event Threat Detection do Security Command Center, consulte Regras do Event Threat Detection.

Descobertas de GCP_SECURITYCENTER_ERROR compatíveis

Confira o mapeamento da UDM na tabela Referência de mapeamento de campos: ERRO.

Descobertas compatíveis do GCP_SECURITYCENTER_OBSERVATION

Você pode encontrar o mapeamento da UDM na tabela Referência de mapeamento de campos: OBSERVATION.

Descobertas GCP_SECURITYCENTER_UNSPECIFIED compatíveis

Você pode encontrar o mapeamento da UDM na tabela Referência de mapeamento de campos: UNSPECIFIED.

Descobertas compatíveis do GCP_SECURITYCENTER_VULNERABILITY

É possível encontrar o mapeamento da UDM na tabela Referência de mapeamento de campos: VULNERABILIDADE.

Descobertas de GCP_SECURITYCENTER_MISCONFIGURATION compatíveis

É possível encontrar o mapeamento da UDM na tabela Referência de mapeamento de campos: MISCONFIGURATION.

Descobertas compatíveis de GCP_SECURITYCENTER_POSTURE_VIOLATION

Você encontra o mapeamento da UDM na tabela Referência de mapeamento de campos: VIOLAÇÃO DE POSTURA.

Formatos de registros da Central de Segurança compatíveis

O analisador do Security Center é compatível com registros no formato JSON.

Registros de amostra da Central de Segurança compatíveis

• Registros de amostra do GCP_SECURITYCENTER_THREAT

  • JSON

  {
    "finding": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "resourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME",
      "state": "ACTIVE",
      "category": "Credential Access: External Member Added To Privileged Group",
      "sourceProperties": {
        "sourceId": {
          "organizationNumber": "ORGANIZATION_ID",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "technique": "persistence",
          "indicator": "audit_log",
          "ruleName": "external_member_added_to_privileged_group"
        },
        "detectionPriority": "HIGH",
        "affectedResources": [
          {
            "gcpResourceName": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "resourceContainer": "organizations/ORGANIZATION_ID",
              "timestamp": {
                "seconds": "1633622881",
                "nanos": 6.73869E8
              },
              "insertId": "INSERT_ID"
            }
          }
        ],
        "properties": {
          "externalMemberAddedToPrivilegedGroup": {
            "principalEmail": "abc@gmail.com",
            "groupName": "group:GROUP_NAME@ORGANIZATION_NAME",
            "externalMember": "user:abc@gamil.com",
            "sensitiveRoles": [
              {
                "resource": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
                "roleName": [
                  "ROLES"
                ]
              }
            ]
          }
        },
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "dummy display name",
            "url": " dummy.url.com"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "https://console.cloud.google.com/logs/query;query\\u003dtimestamp%3D%222022-10-01T16:08:01.673869Z%22%0AinsertId%3D%22INSERT_ID%22%0Aresource.labels.project_id%3D%22%22?project\\u003d"
            }
          ]
        }
      },
      "securityMarks": {
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
      },
      "eventTime": "2022-10-01T16:08:03.888Z",
      "createTime": "2022-10-01T16:08:04.516Z",
      "severity": "HIGH",
      "workflowState": "NEW",
      "canonicalName": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "findingClass": "THREAT"
    },
    "resource": {
      "name": "//cloudidentity.googleapis.com/groups/GROUP_NAME@ORGANIZATION_NAME"
    }
  }
  

• Exemplos de registros de GCP_SECURITYCENTER_MISCONFIGURATION

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "eventApps",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/1032183397765/sources/4563429019522465317/findings/fdb789f992c67f6386ec735aca337bab",
      "category": "API_KEY_APIS_UNRESTRICTED",
      "compliances": [
        {
          "standard": "cis",
          "version": "1.0",
          "ids": [
            "1.12"
          ]
        },
        {
          "standard": "cis",
          "version": "1.1",
          "ids": [
            "1.14"
          ]
        },
        {
          "standard": "cis",
          "version": "1.2",
          "ids": [
            "1.14"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test@domainname.com"
            }
          ]
        }
      },
      "createTime": "2022-12-01T15:16:21.119Z",
      "database": {},
      "description": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "eventTime": "2022-12-01T14:35:42.317Z",
      "exfiltration": {},
      "externalUri": "https://console.cloud.google.com/apis/credentials?project=eventapps-27705",
      "findingClass": "MISCONFIGURATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/security_health_advisor",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "severity": "MEDIUM",
      "sourceDisplayName": "Security Health Analytics",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "display_name": "dummy-display-name",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/1032183397765",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID",
      "parent_display_name": "domainname.com",
      "type": "google.cloud.resourcemanager.Project",
      "folders": []
    },
    "sourceProperties": {
      "Recommendation": "Go to https://console.cloud.google.com/apis/credentials?project=eventapps-27705. In the section \\"API keys,\\" for each API key, click the name of the key. It will display API Key properties on a new page. In the \\"Key restrictions\\" section, set API restrictions to \\"Restrict key.\\" Click the \\"Select APIs\\" drop-down menu to choose which APIs to allow. Click \\"Save.\\"
      "ExceptionInstructions": "Add the security mark \\"allow_api_key_apis_unrestricted\\" to the asset with a value of \\"true\\" to prevent this finding from being activated again.",
      "Explanation": "Unrestricted API keys are insecure because they can be retrieved on devices on which the key is stored or can be seen publicly, e.g., from within a browser. In accordance with the principle of least privileges, it is recommended to restrict the APIs that can be called using each API key to only those required by an application. For more information, see https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions",
      "ScannerName": "API_KEY_SCANNER",
      "ResourcePath": [
        "projects/eventapps-27705/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "cis": [
          {
            "version": "1.0",
            "ids": [
              "1.12"
            ]
          },
          {
            "version": "1.1",
            "ids": [
              "1.14"
            ]
          },
          {
            "version": "1.2",
            "ids": [
              "1.14"
            ]
          }
        ]
      },
      "ReactivationCount": 0
    }
  }
  

• Registros de exemplo do GCP_SECURITYCENTER_OBSERVATION

  • JSON

  {
    "findings": {
      "access": {
        "principalEmail": "dummy.user@dummy.com",
        "callerIp": "198.51.100.1",
        "callerIpGeo": {
          "regionCode": "SG"
        },
        "serviceName": "compute.googleapis.com",
        "methodName": "v1.compute.projects.setCommonInstanceMetadata",
        "principalSubject": "user:dummy.user@dummy.com"
      },
      "canonicalName": "projects/856289305908/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "Persistence: Project SSH Key Added",        
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy.user@dummy.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2022-11-10T18:33:07.631Z",
      "database": {},
      "eventTime": "2022-11-10T18:33:07.271Z",
      "exfiltration": {},
      "findingClass": "OBSERVATION",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/sensitive_actions",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {
        "primaryTactic": "PERSISTENCE",
        "primaryTechniques": [
          "ACCOUNT_MANIPULATION",
          "SSH_AUTHORIZED_KEYS"
        ]
      },
      "mute": "UNDEFINED",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID",
      "parentDisplayName": "Sensitive Actions Service",
      "resourceName": "//compute.googleapis.com/projects/spring-banner-350111",
      "severity": "LOW",
      "sourceDisplayName": "Sensitive Actions Service",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/spring-banner-350111",
      "display_name": "spring-banner-350111",
      "project_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "project_display_name": "dummy-project",
      "parent_name": "//cloudresourcemanager.googleapis.com/projects/856289305908",
      "parent_display_name": "spring-banner-350111",
      "type": "google.compute.Project",
      "folders": []
    },
    "sourceProperties": {
      "sourceId": {
        "projectNumber": "856289305908",
        "customerOrganizationNumber": "ORGANIZATION_ID"
      },
      "detectionCategory": {
        "ruleName": "sensitive_action",
        "subRuleName": "add_ssh_key"
      },
      "detectionPriority": "LOW",
      "affectedResources": [
        {
          "gcpResourceName": "//compute.googleapis.com/projects/spring-banner-350111"
        },
        {
          "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/856289305908"
        }
      ],
      "evidence": [
        {
          "sourceLogId": {
            "projectId": "spring-banner-350111",
            "resourceContainer": "projects/spring-banner-350111",
            "timestamp": {
              "seconds": "1668105185",
              "nanos": 642158000
            },
            "insertId": "v2stobd9ihi"
          }
        }
      ],
      "properties": {},
      "findingId": "findingId",
      "contextUris": {
        "mitreUri": {
          "displayName": "MITRE Link",
          "url": "dummy.domain.com"
        }
      }
    }
  }
  

• Exemplos de registros do GCP_SECURITYCENTER_VULNERABILITY

  • JSON

  {
    "findings": {
      "access": {},
      "assetDisplayName": "Sample-00000",
      "assetId": "organizations/ORGANIZATION_ID/assets/ASSET_ID",
      "canonicalName": "projects/PROJECT_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "CLEAR_TEXT_PASSWORD",
      "compliances": [
        {
          "standard": "owasp",
          "version": "2017",
          "ids": [
            "A3"
          ]
        },
        {
          "standard": "owasp",
          "version": "2021",
          "ids": [
            "A02"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "dummy@sample.com"
            }
          ]
        }
      },
      "createTime": "2022-11-24T09:28:52.589Z",
      "database": {},
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "eventTime": "2022-11-24T04:56:26Z",
      "exfiltration": {},
      "externalUri": "https://sample.dummy.com/",
      "findingClass": "VULNERABILITY",
      "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/css",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "UNDEFINED",
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
      "parentDisplayName": "Web Security Scanner",
      "resourceName": "//dummy.sample.com",
      "severity": "MEDIUM",
      "sourceDisplayName": "Web Security Scanner",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//cloudresourcemanager.googleapis.com",
      "display_name": "dummy_name",
      "project_name": "//cloudresourcemanager.googleapis.com",
      "project_display_name": "dummy_name",
      "parent_name": "//dummy.sample.com",
      "parent_display_name": "Sample-Dev-Project",
      "type": "sample.cloud.dummy.Project",
      "folders": [
        {
          "resourceFolderDisplayName": "Sample-Dev-Project",
          "resourceFolder": "//cloudresourcemanager.googleapis.com/"
        }
      ]
    },
    "sourceProperties": {
      "severity": "MEDIUM",
      "fuzzedUrl": "dummy.domain.com",
      "form": {
        "actionUri": "dummy.domain.com",
        "fields": [
          "os_username",
          "os_password",
          "",
          "os_cookie",
          "os_destination",
          "user_role",
          "atl_token",
          "login"
        ]
      },
      "name": "projects/PROJECT_ID/scanConfigs/SCAN_CONFIG_ID/scanRuns/SCAN_RUN_ID/findings/FINDING_ID",
      "description": "An application appears to be transmitting a password field in clear text. An attacker can eavesdrop network traffic and sniff the password field.",
      "reproductionUrl": "http://198.51.100.1:0000/login.jsp?searchString=",
      "httpMethod": "GET",
      "finalUrl": "http://0.0.0.0:0000/sample.dummy=",
      "ResourcePath": [
        "projects/sample-dummy/",
        "folders/FOLDER_ID/",
        "organizations/ORGANIZATION_ID/"
      ],
      "compliance_standards": {
        "owasp": [
          {
            "version": "2017",
            "ids": [
              "A3"
            ]
          },
          {
            "version": "2021",
            "ids": [
              "A02"
            ]
          }
        ]
      }
    }
  }
  

• Registros de amostra de GCP_SECURITYCENTER_ERROR

  • JSON

  {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/742742027423",
    "state": "ACTIVE",
    "category": "KTD_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "2022-11-23T16:36:03.458107Z",
    "createTime": "2022-11-01T07:36:37.078Z",
    "severity": "CRITICAL",
    "canonicalName": "projects/742742027423/sources/SOURCE_ID/findings/FINDING_ID",
    "mute": "UNDEFINED",
    "findingClass": "SCC_ERROR",
    "access": {
      "callerIpGeo": {}
    },
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      },
      "technical": {
        "contacts": [
          {
            "email": "test.user@domain.com"
          }
        ]
      }
    },
    "parentDisplayName": "Security Command Center",
    "description": "Either all or some Container Threat Detection findings aren\\u0027t being sent to Security Command Center. A service account is missing permissions required for Container Threat Detection.",
    "iamBindings": [
      {
        "member": "test.user@domain.com"
      }
    ],
    "nextSteps": "Restore the required IAM roles on the Container Threat Detection service account. \\n1. Go to [IAM](/iam-admin/iam) \\n2. Select the service account: \\"test.user@domain.com\\" \\n   - If you don\\u0027t see the service account listed, click  **Add** at the top of the page and enter it as a new principal \\n3. Apply the following role:* \\n    1. Container Threat Detection Service Agent \\n4. Click **Save**. \\n \\n*If you use custom roles, apply these missing permissions: \\n - container.clusterRoleBindings.create,container.clusterRoleBindings.delete,container.clusterRoleBindings.update,container.clusterRoles.create,container.clusterRoles.delete,container.clusterRoles.escalate,container.clusterRoles.update,container.customResourceDefinitions.create,container.customResourceDefinitions.delete,container.customResourceDefinitions.update,container.daemonSets.create,container.daemonSets.delete,container.daemonSets.update,container.daemonSets.updateStatus,container.networkPolicies.update,container.pods.attach,container.pods.create,container.pods.delete,container.pods.exec,container.pods.getLogs,container.pods.portForward,container.pods.update,container.roleBindings.create,container.roleBindings.delete,container.roleBindings.update,container.roles.bind,container.roles.create,container.roles.delete,container.roles.escalate,container.roles.update,container.secrets.create,container.secrets.list,container.secrets.delete,container.secrets.update,container.serviceAccounts.create,container.serviceAccounts.delete,container.serviceAccounts.update"
  }
  

• Registros de amostra GCP_SECURITYCENTER_UNSPECIFIED

  • JSON

  {
    "findings": {
      "access": {},
      "canonicalName": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "category": "OPEN_FIREWALL",
      "compliances": [
        {
          "standard": "pci",
          "ids": [
            "1.2.1"
          ]
        }
      ],
      "contacts": {
        "security": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        },
        "technical": {
          "contacts": [
            {
              "email": "test.user@dummy.xyz"
            }
          ]
        }
      },
      "createTime": "2021-07-20T08:33:25.343Z",
      "database": {},
      "eventTime": "2022-07-19T07:44:38.374Z",
      "exfiltration": {},
      "externalUri": "dummy.domain.com",
      "indicator": {},
      "kernelRootkit": {},
      "kubernetes": {},
      "mitreAttack": {},
      "mute": "MUTED",
      "muteInitiator": "Muted by test.user@dummy.xyz",
      "muteUpdateTime": "2022-03-08T05:41:06.507Z",
      "name": "organizations/595779152576/sources/SOURCE_ID/findings/FINDING_ID",
      "parent": "organizations/595779152576/sources/SOURCE_ID"
      "parentDisplayName": "Security Health Analytics",
      "resourceName": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "severity": "HIGH",
      "sourceDisplayName": "Sanity_grc",
      "state": "ACTIVE",
      "vulnerability": {},
      "workflowState": "NEW"
    },
    "resource": {
      "name": "//compute.googleapis.com/projects/calcium-vial-280707/global/firewalls/3199326669616479704",
      "display_name": "",
      "project_name": "",
      "project_display_name": "",
      "parent_name": "",
      "parent_display_name": "",
      "type": "",
      "folders": []
    },
    "sourceProperties": {
      "ScannerName": "FIREWALL_SCANNER",
      "ResourcePath": [
        "projects/calcium-vial-280707/",
        "organizations/ORGANIZATION_ID/"
      ],
      "ReactivationCount": 0,
      "AllowedIpRange": "All",
      "ExternallyAccessibleProtocolsAndPorts": [
        {
          "IPProtocol": "tcp",
          "ports": [
            "80"
          ]
        }
      ]
    }
  }
  
  

Referência de mapeamento de campos

Nesta seção, explicamos como o analisador do Google Security Operations mapeia os campos de registro do Security Command Center para os campos do modelo de dados unificado (UDM) do Google Security Operations nos conjuntos de dados.

Referência de mapeamento de campos: campos de registro brutos para campos do UDM

A tabela a seguir lista os campos de registro e os mapeamentos da UDM correspondentes para as descobertas do Event Threat Detection do Security Command Center.

Referência de mapeamento de campo: identificador de evento para tipo de evento

As tabelas a seguir contêm tipos de eventos e campos do UDM para o Security Command Center: classes de descobertas VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED e POSTURE_VIOLATION.

Categoria VULNERABILITY para tipo de evento UDM

A tabela a seguir lista a categoria VULNERABILITY e os tipos de eventos da UDM correspondentes.

Categoria MISCONFIGURATION para tipo de evento UDM

A tabela a seguir lista a categoria "MISCONFIGURATION" e os tipos de eventos da UDM correspondentes.

Categoria OBSERVATION para tipo de evento da UDM

A tabela a seguir lista a categoria "OBSERVATION" e os tipos de eventos da UDM correspondentes.

Categoria ERROR para tipo de evento UDM

A tabela a seguir lista a categoria "ERROR" e os tipos de eventos da UDM correspondentes.

Categoria UNSPECIFIED para tipo de evento da UDM

A tabela a seguir lista a categoria UNSPECIFIED e os tipos de eventos da UDM correspondentes.

Categoria POSTURE_VIOLATION para o tipo de evento UDM

A tabela a seguir lista a categoria POSTURE_VIOLATION e os tipos de eventos da UDM correspondentes.

Referência de mapeamento de campo: VULNERABILIDADE

A tabela a seguir lista os campos de registro da categoria VULNERABILITY e os campos da UDM correspondentes.

Referência de mapeamento de campo: MISCONFIGURATION

A tabela a seguir lista os campos de registro da categoria MISCONFIGURATION e os campos correspondentes da UDM.

Referência de mapeamento de campo: OBSERVATION

A tabela a seguir lista os campos de registro da categoria "OBSERVAÇÃO" e os campos correspondentes da UDM.

Referência de mapeamento de campo: ERROR

A tabela a seguir lista os campos de registro da categoria ERROR e os campos correspondentes da UDM.

Referência de mapeamento de campo: UNSPECIFIED

A tabela a seguir lista os campos de registro da categoria UNSPECIFIED e os campos correspondentes da UDM.

Referência de mapeamento de campo: POSTURE_VIOLATION

A tabela a seguir lista os campos de registro da categoria POSTURE_VIOLATION e os campos correspondentes da UDM.

Common Fields: SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION

A tabela a seguir lista os campos comuns das categorias SECURITY COMMAND CENTER - VULNERABILITY, MISCONFIGURATION, OBSERVATION, ERROR, UNSPECIFIED, POSTURE_VIOLATION, TOXIC_COMBINATION e os campos correspondentes do UDM.

A seguir

• Ingestão de dados no Google Security Operations

Precisa de mais ajuda? Receba respostas de membros da comunidade e profissionais do Google SecOps.