Parser ini mengekstrak kolom dari pesan syslog DELL ECS, memetakannya ke UDM. Fungsi ini menangani jenis peristiwa UPDATE dan DELETE secara khusus, dengan mengekstrak informasi pengguna dan IP untuk peristiwa login/logout. Peristiwa lainnya dikategorikan sebagai GENERIC_EVENT. Proses ini menggunakan pola grok untuk mengurai pesan dan mengubah filter untuk mengisi kolom UDM, serta menghapus peristiwa yang tidak cocok dengan format yang diharapkan.
Sebelum memulai
Pastikan Anda memiliki instance Google Security Operations.
Pastikan Anda menggunakan Windows 2016 atau yang lebih baru, atau host Linux dengan systemd.
Jika berjalan di belakang proxy, pastikan port firewall terbuka.
Pastikan Anda memiliki akses istimewa ke Dell ECS.
Mendapatkan file autentikasi penyerapan Google SecOps
Login ke konsol Google SecOps.
Buka Setelan SIEM > Agen Pengumpulan.
Download File Autentikasi Penyerapan. Simpan file dengan aman di sistem tempat BindPlane Agent akan diinstal.
Mendapatkan ID pelanggan Google SecOps
Login ke konsol Google SecOps.
Buka Setelan SIEM > Profil.
Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.
Menginstal Agen Bindplane
Penginstalan Windows
Buka Command Prompt atau PowerShell sebagai administrator.
Mengonfigurasi Agen BindPlane untuk memproses Syslog dan mengirimkannya ke Google SecOps
Akses file konfigurasi:
Cari file config.yaml. Biasanya, file ini berada di direktori /etc/bindplane-agent/ di Linux atau di direktori penginstalan di Windows.
Buka file menggunakan editor teks (misalnya, nano, vi, atau Notepad).
Edit file config.yaml sebagai berikut:
receivers:tcplog:# Replace the below port <54525> and IP <0.0.0.0> with your specific valueslisten_address:"0.0.0.0:54525"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the creds location below according the placement of the credentials file you downloadedcreds:'{jsonfileforcreds}'# Replace <customer_id> below with your actual ID that you copiedcustomer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# You can apply ingestion labels below as preferredingestion_labels:log_type:SYSLOGnamespace:dell_ecsraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-tcplogexporters:-chronicle/chronicle_w_labels
Ganti port dan alamat IP sesuai kebutuhan di infrastruktur Anda.
Ganti <customer_id> dengan ID pelanggan yang sebenarnya.
Mulai ulang Bindplane Agent untuk menerapkan perubahan
Di Linux, untuk memulai ulang Agen Bindplane, jalankan perintah berikut:
sudosystemctlrestartbindplane-agent
Di Windows, untuk memulai ulang Bindplane Agent, Anda dapat menggunakan konsol Services atau memasukkan perintah berikut:
net stop BindPlaneAgent && net start BindPlaneAgent
Mengonfigurasi Dell ECS untuk Meneruskan Log ke Server Syslog
Login ke portal pengelolaan ECS menggunakan kredensial administratif.
Buka Setelan > Notifikasi Acara > Syslog.
Klik Server Baru.
Berikan detail berikut:
Protocol: pilih UDP atau TCP (pastikan protokolnya cocok dengan protokol yang dikonfigurasi di server Syslog).
Target: masukkan alamat IP atau Nama Domain yang Sepenuhnya Memenuhi Syarat (FQDN) server Syslog.
Port: masukkan nomor port.
Tingkat keparahan: pilih Informasi sebagai tingkat keparahan minimum log yang akan diteruskan.
Klik Simpan.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
data
read_only_udm.metadata.description
Jika eventType adalah UPDATE, deskripsi diekstrak dari kolom data menggunakan ekspresi reguler. Jika eventType adalah DELETE, deskripsi diekstrak dari kolom data menggunakan ekspresi reguler dan diproses lebih lanjut untuk mengekstrak ID pengguna.
data
read_only_udm.principal.ip
Jika eventType adalah UPDATE, alamat IP diekstrak dari kolom data menggunakan ekspresi reguler.
data
read_only_udm.target.resource.product_object_id
Jika eventType adalah DELETE, token URN diekstrak dari kolom data menggunakan ekspresi reguler.
data
read_only_udm.target.user.userid
Jika eventType adalah UPDATE, ID pengguna diekstrak dari kolom data menggunakan ekspresi reguler. Jika eventType adalah DELETE, ID pengguna akan diekstrak dari kolom deskripsi setelah pemrosesan awal kolom data.
eventType
read_only_udm.metadata.event_type
Jika eventType adalah UPDATE dan userid diekstrak, jenis peristiwa akan ditetapkan ke USER_LOGIN. Jika eventType adalah DELETE dan userid diekstrak, jenis peristiwa akan ditetapkan ke USER_LOGOUT. Jika tidak, jenis peristiwa akan ditetapkan ke GENERIC_EVENT.
eventType
read_only_udm.metadata.product_event_type
Nilai ini diperoleh dengan menggabungkan kolom serviceType dan eventType dari log mentah, yang diapit dalam tanda kurung siku dan dipisahkan oleh " - ".
hostname
read_only_udm.principal.asset.hostname
Nama host disalin dari kolom hostname.
hostname
read_only_udm.principal.hostname
Nama host disalin dari kolom hostname.
log_type
read_only_udm.metadata.log_type
Jenis log ditetapkan ke DELL_ECS. Mekanisme di-hardcode ke MECHANISM_UNSPECIFIED. Stempel waktu peristiwa disalin dari kolom timestamp entri log mentah. Nama produk di-hardcode menjadi ECS. Nama vendor di-hardcode menjadi DELL. Jika eventType adalah DELETE, jenis resource dikodekan secara permanen ke CREDENTIAL.
timestamp
read_only_udm.metadata.event_timestamp
Stempel waktu peristiwa diambil dari kolom timestamp entri log mentah.
timestamp
timestamp
Stempel waktu diuraikan dari kolom timestamp entri log mentah.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide details how to collect and parse Dell ECS logs for ingestion into Google SecOps, supporting \u003ccode\u003eUPDATE\u003c/code\u003e and \u003ccode\u003eDELETE\u003c/code\u003e event types and mapping them to the UDM.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves downloading a Google SecOps ingestion authentication file and customer ID, then installing and configuring the Bindplane Agent on either Windows or Linux to receive and forward the logs.\u003c/p\u003e\n"],["\u003cp\u003eDell ECS must be configured to forward logs to the Syslog server, specifying the protocol, target, port, and severity level of logs to be transmitted.\u003c/p\u003e\n"],["\u003cp\u003eThe UDM mapping table outlines how various fields from the Dell ECS logs, such as data, eventType, hostname, and timestamp, are translated into UDM fields within Google SecOps, categorizing events as \u003ccode\u003eUSER_LOGIN\u003c/code\u003e, \u003ccode\u003eUSER_LOGOUT\u003c/code\u003e, or \u003ccode\u003eGENERIC_EVENT\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe parser is newly created as of March 18, 2024 and this document is considered under the Pre-GA Offerings Terms.\u003c/p\u003e\n"]]],[],null,["# Collect Dell ECS logs\n=====================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis parser extracts fields from DELL ECS syslog messages, mapping them to the UDM. It handles **`UPDATE`** and **`DELETE`** event types specifically, extracting user and IP information for login/logout events. Other events are categorized as **`GENERIC_EVENT`**. It uses grok patterns to parse the message and mutate filters to populate UDM fields, dropping events that don't match the expected format.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to Dell ECS.\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane Agent will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall Bindplane Agent\n-----------------------\n\n### Windows Installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux Installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional Installation Resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure Bindplane Agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the configuration file:\n\n - Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n - Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the below port \u003c54525\u003e and IP \u003c0.0.0.0\u003e with your specific values\n listen_address: \"0.0.0.0:54525\" \n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the creds location below according the placement of the credentials file you downloaded\n creds: '{ json file for creds }'\n # Replace \u003ccustomer_id\u003e below with your actual ID that you copied\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # You can apply ingestion labels below as preferred\n ingestion_labels:\n log_type: SYSLOG\n namespace: dell_ecs\n raw_log_field: body\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/dell-ecs#get-auth-file) section.\n\nRestart Bindplane Agent to apply the changes\n--------------------------------------------\n\n- In Linux, to restart the Bindplane Agent, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- In Windows, to restart the Bindplane Agent, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Dell ECS to Forward Logs to the Syslog Server\n-------------------------------------------------------\n\n1. Sign in to the ECS management portal using administrative credentials.\n2. Go to **Settings \\\u003e Event Notifications \\\u003e Syslog**.\n3. Click **New Server**.\n4. Provide the following details:\n - **Protocol** : select either **UDP** or **TCP** (ensure it matches the protocol configured on the Syslog server).\n - **Target** : enter the **IP address** or **Fully Qualified Domain Name** (FQDN) of the Syslog server.\n - **Port** : enter the **port number**.\n - **Severity** : select **Informational** as the minimum severity level of logs to be forwarded.\n5. Click **Save**.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
