Dokumen ini menjelaskan cara menyerap log Jfrog Artifactory ke Google Security Operations menggunakan Bindplane. Parser menangani dua format log JFrog Artifactory yang berbeda. Fitur ini menggunakan pola grok untuk mengidentifikasi dan mengekstrak kolom dari setiap format. Kemudian, kolom tersebut dipetakan ke UDM, menangani payload JSON dalam salah satu format, dan menghapus log yang tidak cocok dengan salah satu format.
Sebelum memulai
Pastikan Anda memiliki instance Google SecOps.
Pastikan Anda menggunakan Windows 2016 atau yang lebih baru, atau host Linux dengan systemd.
Jika berjalan di belakang proxy, pastikan port firewall terbuka.
Pastikan Anda memiliki akses istimewa ke instance Jfrog Artifactory.
Mendapatkan file autentikasi penyerapan Google SecOps
Login ke konsol Google SecOps.
Buka Setelan SIEM > Agen Pengumpulan.
Download File Autentikasi Penyerapan. Simpan file dengan aman di sistem tempat BindPlane akan diinstal.
Mendapatkan ID pelanggan Google SecOps
Login ke konsol Google SecOps.
Buka Setelan SIEM > Profil.
Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.
Menginstal agen Bindplane
Penginstalan Windows
Buka Command Prompt atau PowerShell sebagai administrator.
Mengonfigurasi agen BindPlane untuk menyerap Syslog dan mengirimkannya ke Google SecOps
Akses file konfigurasi:
Cari file config.yaml. Biasanya, file ini berada di direktori /etc/bindplane-agent/ di Linux atau di direktori penginstalan di Windows.
Buka file menggunakan editor teks (misalnya, nano, vi, atau Notepad).
Edit file config.yaml sebagai berikut:
```yamlreceivers:udplog:# Replace the port and IP address as requiredlisten_address:"0.0.0.0:514"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the path to the credentials file you downloaded in Step 1creds:'/path/to/ingestion-authentication-file.json'# Replace with your actual customer ID from Step 2customer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# Add optional ingestion labels for better organizationingestion_labels:log_type:'JFROG_ARTIFACTORY'raw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-udplogexporters:-chronicle/chronicle_w_labels```
Ganti port dan alamat IP sesuai kebutuhan di infrastruktur Anda.
Ganti <customer_id> dengan ID pelanggan yang sebenarnya.
Simpan file dengan mengklik tombol ESC (escape) di keyboard Anda dan mengetik :wq.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
tindakan
read_only_udm.metadata.product_event_type
Nilai action dari log mentah dikonversi menjadi huruf kecil dan dipetakan.
datetime
read_only_udm.metadata.event_timestamp
Kolom datetime log mentah diuraikan dan dikonversi menjadi stempel waktu.
hostname
read_only_udm.principal.hostname
Dipetakan langsung dari kolom hostname log mentah.
id
read_only_udm.metadata.product_log_id
Dipetakan langsung dari kolom id log mentah (dari payload JSON).
ip
read_only_udm.principal.ip
Dipetakan langsung dari kolom ip log mentah. Dikodekan secara permanen ke "USER_RESOURCE_ACCESS". Dikodekan secara permanen ke "JFROG_ARTIFACTORY". Dikodekan secara permanen ke "Artifactory". Dikodekan secara permanen ke "JFROG".
pemilik
read_only_udm.principal.user.userid
Dipetakan jika username tidak ada dalam log mentah (dari payload JSON).
repo_name
read_only_udm.target.resource.name
Dipetakan langsung dari kolom repo_name log mentah.
repo_type
read_only_udm.target.resource.resource_subtype
Dipetakan langsung dari kolom repo_type log mentah.
cakupan
read_only_udm.target.resource.name
Dipetakan langsung dari kolom scope log mentah (dari payload JSON).
cakupan
read_only_udm.target.resource.resource_subtype
Di-hardcode ke "scope" jika scope ada dalam log mentah.
sequenceId
read_only_udm.metadata.product_log_id
Tanda kutip dihapus dari kolom sequenceId, lalu dipetakan.
subjek
read_only_udm.about.labels.key
Dikodekan secara permanen ke "subject" jika subject ada di log mentah.
subjek
read_only_udm.about.labels.value
Dipetakan langsung dari kolom subject log mentah (dari payload JSON).
jenis
read_only_udm.metadata.product_event_type
Dipetakan langsung dari kolom type log mentah (dari payload JSON).
pengguna
read_only_udm.principal.user.userid
Dipetakan langsung dari kolom user log mentah.
nama pengguna
read_only_udm.principal.user.userid
Dipetakan langsung dari kolom username log mentah (dari payload JSON).
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide provides instructions for collecting JFrog Artifactory logs and ingesting them into Google SecOps via a webhook feed, supporting two distinct log formats.\u003c/p\u003e\n"],["\u003cp\u003eSetting up the integration involves configuring a webhook feed within Google SecOps, including generating a secret key and setting up an endpoint URL, then creating an API key in the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eWithin JFrog Artifactory, users must create a webhook, specifying the Google SecOps endpoint URL and relevant events to trigger the sending of log data.\u003c/p\u003e\n"],["\u003cp\u003eThe parser uses grok patterns to identify and extract data from JFrog Artifactory logs, mapping the extracted data to the Unified Data Model (UDM), as detailed in the provided UDM Mapping Table.\u003c/p\u003e\n"],["\u003cp\u003eThis feature is pre-GA and will have changes that might not be backwards compatible with older versions, and has limited support, per the provided service terms.\u003c/p\u003e\n"]]],[],null,["# Collect JFrog Artifactory logs\n==============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest Jfrog Artifactory logs to Google Security Operations using Bindplane. The parser handles two different JFrog Artifactory log formats. It uses grok patterns to identify and extract fields from each format. It then maps those fields to the UDM, handling JSON payloads within one of the formats and dropping logs that don't match either format.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google SecOps instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to Jfrog Artifactory instance.\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall the Bindplane agent\n---------------------------\n\n### Windows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional installation resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure the Bindplane agent to ingest Syslog and send to Google SecOps\n------------------------------------------------------------------------\n\n1. Access the configuration file:\n\n 1. Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n 2. Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n ```yaml\n receivers:\n udplog:\n # Replace the port and IP address as required\n listen_address: \"0.0.0.0:514\"\n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the path to the credentials file you downloaded in Step 1\n creds: '/path/to/ingestion-authentication-file.json'\n # Replace with your actual customer ID from Step 2\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # Add optional ingestion labels for better organization\n ingestion_labels:\n log_type: 'JFROG_ARTIFACTORY'\n raw_log_field: body\n\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - udplog\n exporters:\n - chronicle/chronicle_w_labels\n ```\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/jfrog-artifactory#get-auth-file) section.\n\nRestart the Bindplane agent to apply the changes\n------------------------------------------------\n\n- To restart the Bindplane agent in Linux, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- To restart the Bindplane agent in Windows, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Jfrog Artifactory Syslog\n----------------------------------\n\n1. Connect to the **Jfrog Artifactory** instance.\n2. Edit the file `$JFROG_HOME/artifactory/var/etc/artifactory/logback.xml` using vi:\n\n vi $JFROG_HOME/artifactory/var/etc/artifactory/logback.xml\n\n3. Add the following syslog appender to the file:\n\n \u003cappender name=\"SYSLOG\" class= \"ch.qos.logback.classic.net.SyslogAppender\"\u003e\n \u003csyslogHost\u003eBindplane-Agent-IP\u003c/syslogHost\u003e\n \u003cfacility\u003eSYSLOG\u003c/facility\u003e\n \u003csuffixPattern\u003e[%thread] %logger %msg\u003c/suffixPattern\u003e\n \u003c/appender\u003e\n\n - Replace `Bindplane-Agent-IP` in syslogHost, with the actual IP address configured for the Bindplane agent.\n4. Add additional configuration data to the file:\n\n \u003croot\u003e\n \u003c level value=\"debug\"/\u003e\n \u003cappender-ref ref=\"CONSOLE\"/\u003e\n \u003cappender-ref ref=\"FILE\"/\u003e\n \u003cappender-ref ref=\"SYSLOG\"/\u003e\n \u003c/root\u003e\n\n5. Save the file by clicking the `ESC` (escape) button on your keyboard and typing `:wq`.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
