Parser ini mengekstrak informasi utama seperti stempel waktu, ID pengguna, IP sumber, tindakan, dan ID objek dari log berformat JSON dan SYSLOG. Parser ini menggunakan pola grok untuk mencocokkan berbagai format pesan log, menangani variasi dalam struktur, dan mengisi model data terpadu (UDM) dengan kolom yang diekstrak. Parser juga mengategorikan peristiwa berdasarkan keberadaan informasi pengguna atau IP.
Sebelum memulai
Pastikan Anda memenuhi prasyarat berikut:
Instance Google SecOps.
Akses istimewa ke Google Cloud IAM.
Akses istimewa ke Google Cloud Storage.
Akses istimewa ke Jenkins.
Membuat Google Cloud Bucket Storage
Buka Cloud Storage.
Buat bucket baru. Pilih nama unik dan region yang sesuai.
Pastikan bucket memiliki kontrol akses yang tepat (misalnya, hanya akun layanan yang diberi otorisasi yang dapat menulis ke bucket).
Buat Google Cloud Akun layanan
Buka IAM & Admin>Service Accounts.
Buat akun layanan baru. Beri nama deskriptif (misalnya, jenkins-logs).
Beri akun layanan peran Storage Object Creator di bucket GCS yang Anda buat pada langkah sebelumnya.
Instal plugin dan mulai ulang Jenkins jika diperlukan.
Menginstal Plugin Kredensial OAuth Google di Jenkins
Buka Manage Jenkins>Plugins.
Pilih Plugin yang tersedia
Telusuri plugin Google OAuth Credentials.
Instal plugin dan mulai ulang Jenkins jika diperlukan.
Mengonfigurasi Jenkins untuk melakukan autentikasi dengan Google Cloud
Buka Manage Jenkins>Credentials>System.
Klik
add
Add Credentials.
Kind: pilih Google Service Account from private key.
Nama project: tetapkan nama untuk kredensial.
Upload file kunci JSON yang Anda peroleh selama Google Cloud Pembuatan akun layanan.
Klik Buat.
Mengonfigurasi log Jenkins untuk mengupload Google SecOps
Dalam konfigurasi tugas Jenkins, tambahkan Google Storage Build Log Upload di tindakan pasca-build, dengan parameter berikut:
Google Credentials: Nama kredensial Google yang Anda buat di langkah sebelumnya.
Nama Log: Nama file untuk menyimpan log build Jenkins, di jalur penyimpanan yang ditentukan.
Lokasi Penyimpanan: Nama bucket tempat Anda ingin mengupload log. Bucket harus dapat diakses oleh akun layanan yang Anda buat.
Uji upload log.
Menyiapkan feed
Untuk mengonfigurasi feed, ikuti langkah-langkah berikut:
Buka Setelan SIEM>Feed.
Klik Tambahkan Feed Baru.
Di halaman berikutnya, klik Konfigurasi satu feed.
Di kolom Nama feed, masukkan nama untuk feed; misalnya, Log Jenkins.
Pilih Google Cloud Storage V2 sebagai Source type.
Pilih Jenkins sebagai Jenis log.
Klik Dapatkan Akun Layanan sebagai Akun Layanan Chronicle.
Tentukan nilai untuk parameter input berikut:
URI Bucket Penyimpanan:URL bucket penyimpanan Google Cloud dalam format gs://my-bucket/<value>.
Opsi penghapusan sumber: pilih opsi penghapusan sesuai preferensi Anda.
Klik Buat Feed.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
act
security_result.action_details
Diekstrak dari kolom msg1 atau msg2. Mewakili tindakan yang dilakukan. Spasi kosong di awal dihapus.
data
principal.user.userid ATAU principal.ip ATAU metadata.description
Jika data cocok dengan pola alamat IP, data tersebut dipetakan ke principal.ip. Jika cocok dengan pola nama pengguna, maka akan dipetakan ke principal.user.userid. Jika tidak, akan dipetakan ke metadata.description.
msg1
target.asset.product_object_id ATAU security_result.action_details
Digunakan untuk mengekstrak object dan act. Jika ada /, / tersebut akan dibagi menjadi object dan act. Jika ada », » tersebut akan dibagi menjadi object dan act. Jika tidak, / tersebut akan diperlakukan sebagai act dan mungkin diuraikan lebih lanjut.
msg2
metadata.description ATAU security_result.action_details
Jika ada, awalnya dipetakan ke metadata.description. Jika berisi "completed:", nilai setelahnya akan diekstrak dan dipetakan ke security_result.action_details.
object
target.asset.product_object_id
Diekstrak dari msg1. Mewakili objek yang ditindaklanjuti.
object_id
target.resource.attribute.labels.value
Diekstrak dari object jika ada /. Mewakili ID objek yang lebih spesifik. Kunci di-hardcode sebagai "Nama Plugin".
src_ip
principal.ip
Diekstrak dari pesan atau data. Mewakili alamat IP sumber.
pengguna
principal.user.userid
Diekstrak dari pesan atau data. Mewakili pengguna yang terkait dengan acara.
metadata.event_timestamp
Disalin dari kolom @timestamp kalkulasi.
metadata.event_type
Ditentukan oleh logika parser. Disetel ke USER_UNCATEGORIZED jika user ada, STATUS_UNCATEGORIZED jika src_ip ada, dan GENERIC_EVENT jika tidak.
metadata.product_name
Hardcode sebagai Jenkins.
metadata.product_version
Hardcode sebagai Jenkins.
metadata.vendor_name
Hardcode sebagai JENKINS.
metadata.event_timestamp
Dibuat dari kolom year, month, day, time, dan ampm.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide explains how to collect Jenkins logs and send them to Google SecOps for analysis, using a parser to extract key data from JSON and SYSLOG formats.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves creating a Google Cloud Storage bucket and service account, installing the Google Cloud Storage and OAuth Credentials plugins in Jenkins, and configuring Jenkins to authenticate with Google Cloud.\u003c/p\u003e\n"],["\u003cp\u003eJenkins logs are uploaded to a specified storage location through the configuration of post-build actions and setting Google Cloud as a destination.\u003c/p\u003e\n"],["\u003cp\u003eA feed in Google SecOps is configured to ingest the uploaded Jenkins logs, specifying the source type, log type, and storage bucket URI, along with other parameters for data handling.\u003c/p\u003e\n"],["\u003cp\u003eThe parser will map the Jenkins logs data into the unified data model (UDM), specifying the mapping between the fields in Jenkins logs and UDM fields.\u003c/p\u003e\n"]]],[],null,["# Collect Jenkins logs\n====================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nOverview\n--------\n\nThis parser extracts key information such as timestamps, user IDs, source IPs, actions, and object IDs from JSON and SYSLOG formatted logs. It uses grok patterns to match various log message formats, handling variations in structure, and populates a unified data model (UDM) with the extracted fields. The parser also categorizes events based on the presence of user or IP information.\n\nBefore you begin\n----------------\n\nEnsure that you have the following prerequisites:\n\n- Google SecOps instance.\n- Privileged access to Google Cloud IAM.\n- Privileged access to Google Cloud Storage.\n- Privileged access to Jenkins.\n\nCreate a Google Cloud Storage Bucket\n------------------------------------\n\n1. Go to **Cloud Storage**.\n2. Create a new bucket. Choose a unique name and appropriate region.\n3. Ensure the bucket has proper access controls (for example, only authorized service accounts can write to it).\n\nCreate a Google Cloud Service account\n-------------------------------------\n\n1. Go to **IAM \\& Admin** \\\u003e **Service Accounts**.\n2. Create a new service account. Give it a descriptive name (for example, **jenkins-logs**).\n3. Grant the service account the **Storage Object Creator** role on the GCS bucket you created in the previous step.\n4. Create an SSH key for your service account: [Create and delete service account keys](/iam/docs/keys-create-delete).\n5. Download a JSON key file for the service account.\n\n | **Note:** Keep this file secure. You will need it for the **Google OAuth Credentials** plugin to create credentials.\n\nInstall Google Cloud Storage plugin in Jenkins\n----------------------------------------------\n\n1. Go to **Manage Jenkins** \\\u003e **Plugins**.\n2. Select **Available plugins**.\n3. Search for the **Google Cloud Storage** plugin.\n4. Install the plugin and restart Jenkins if required.\n\nInstall Google OAuth Credentials Plugin in Jenkins\n--------------------------------------------------\n\n1. Go to **Manage Jenkins** \\\u003e **Plugins**.\n2. Select **Available plugins**\n3. Search for the **Google OAuth Credentials** plugin.\n4. Install the plugin and restart Jenkins if required.\n\nConfigure Jenkins to authenticate with Google Cloud\n---------------------------------------------------\n\n1. Go to **Manage Jenkins** \\\u003e **Credentials** \\\u003e **System**.\n\n | **Note:** You can use **Global Credentials** or add a new domain (recommended).\n2. Click add **Add Credentials**.\n\n3. **Kind** : select **Google Service Account from private key**.\n\n4. **Project name**: set a name for the credentials.\n\n5. Upload the JSON key file you obtained during the Google Cloud Service account creation.\n\n6. Click **Create**.\n\nConfigure Jenkins logs to upload Google SecOps\n----------------------------------------------\n\n1. In the Jenkins job configuration, add **Google Storage Build Log Upload** in post-build actions, with the following parameters:\n - **Google Credentials**: The name of your Google credentials you created in the previous step.\n - **Log Name**: The name of the file to store the Jenkins build log, under the specified storage path.\n - **Storage Location**: The name of the bucket where you want to upload your logs. The bucket must be accessible to the service account you created.\n2. Test the log upload.\n\nSet up feeds\n------------\n\nTo configure a feed, follow these steps:\n\n1. Go to **SIEM Settings** \\\u003e **Feeds**.\n2. Click **Add New Feed**.\n3. On the next page, click **Configure a single feed**.\n4. In the **Feed name** field, enter a name for the feed; for example, **Jenkins Logs**.\n5. Select **Google Cloud Storage V2** as the **Source type**.\n6. Select **Jenkins** as the **Log type**.\n7. Click **Get Service Account** as the **Chronicle Service Account**.\n8. Specify values for the following input parameters:\n\n - **Storage Bucket URI** : Google Cloud storage bucket URL in **`gs://my-bucket/\u003cvalue\u003e`** format.\n - **Source deletion options**: select deletion option according to your preference.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account. \\* **Maximum File Age**: Includes files modified in the last number of days. Default is 180 days.\n9. Click **Create Feed**.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
