Dokumen ini menjelaskan cara menyerap log Kaseya Datto File Protection ke
Google Security Operations menggunakan Bindplane. Parser mengekstrak kolom dari pesan syslog Datto S4P4 menggunakan pola grok, memetakannya ke Model Data Terpadu (UDM), dan mengategorikan peristiwa berdasarkan tingkat keparahan syslog. Secara khusus,
agen ini menangani data berformat CEF dalam pesan syslog, mengekstrak kolom utama seperti
vendor, produk, versi, dan detail peristiwa untuk pengayaan dan klasifikasi.
Sebelum memulai
Pastikan Anda memenuhi prasyarat berikut:
Instance Google SecOps
Windows 2016 atau yang lebih baru, atau host Linux dengan systemd.
Jika dijalankan di belakang proxy, port firewall terbuka
Akses istimewa ke Datto Siris atau Alto
Mendapatkan file autentikasi penyerapan Google SecOps
Login ke konsol Google SecOps.
Buka Setelan SIEM > Agen Pengumpulan.
Download File Autentikasi Penyerapan. Simpan file dengan aman di sistem tempat BindPlane akan diinstal.
Mendapatkan ID pelanggan Google SecOps
Login ke konsol Google SecOps.
Buka Setelan SIEM > Profil.
Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.
Menginstal agen Bindplane
Penginstalan Windows
Buka Command Prompt atau PowerShell sebagai administrator.
Mengonfigurasi agen BindPlane untuk menyerap Syslog dan mengirimkannya ke Google SecOps
Akses file konfigurasi:
Cari file config.yaml. Biasanya, file ini berada di direktori /etc/bindplane-agent/ di Linux atau di direktori penginstalan di Windows.
Buka file menggunakan editor teks (misalnya, nano, vi, atau Notepad).
Edit file config.yaml sebagai berikut:
receivers:tcplog:# Replace the port and IP address as requiredlisten_address:"0.0.0.0:514"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the path to the credentials file you downloaded in Step 1creds_file_path:'/path/to/ingestion-authentication-file.json'# Replace with your actual customer ID from Step 2customer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# Add optional ingestion labels for better organizationingestion_labels:log_type:'DATTO_FILE_PROTECTION'raw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-tcplogexporters:-chronicle/chronicle_w_labels
Ganti port dan alamat IP sesuai kebutuhan di infrastruktur Anda.
Ganti <customer_id> dengan ID pelanggan yang sebenarnya.
Mulai ulang agen Bindplane untuk menerapkan perubahan
Untuk memulai ulang agen Bindplane di Linux, jalankan perintah berikut:
sudosystemctlrestartbindplane-agent
Untuk memulai ulang agen Bindplane di Windows, Anda dapat menggunakan konsol Services
atau memasukkan perintah berikut:
net stop BindPlaneAgent && net start BindPlaneAgent
Mengonfigurasi Syslog untuk Datto Siris dan Alto
Login ke Konsol Web Datto.
Buka Konfigurasi > Setelan Perangkat > Logging Jarak Jauh.
Aktifkan Logging Jarak Jauh.
Berikan detail konfigurasi berikut:
Pastikan Bindplane Agent dikonfigurasi untuk memproses port 514 melalui koneksi TCP.
Alamat IP: Masukkan alamat IP agen Bindplane.
Klik Terapkan.
Tabel pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
act
security_result.category_details
Nilai act dari kolom ekstensi log mentah.
desc
metadata.description
Nilai kolom description yang diekstrak dari kolom desc menggunakan grok.
dvc
target.ip
Nilai dvc dari kolom ekstensi log mentah.
extensions
security_result.category_details, target.ip
Diuraikan menggunakan filter kv untuk mengekstrak act dan dvc yang kemudian dipetakan ke kolom UDM.
hostname
principal.hostname
Nama host yang diekstrak dari pesan log mentah.
log_id
metadata.product_log_id
ID log yang diekstrak dari pesan log mentah.
prod_dvc_version
metadata.product_version
Versi produk yang diekstrak dari kolom desc log mentah. Nilai yang sama dengan principal.hostname. Disetel ke STATUS_UPDATE jika hostname atau dvc ada dalam log mentah, jika tidak "GENERIC_EVENT". Nilai yang di-hardcode \n\n\0017 saat kolom extensions ada di log mentah. Stempel waktu yang diekstrak dari pesan log mentah. Nilai yang sama dengan edr.raw_event_name. Nilai yang dikodekan secara permanen DATTO_FILE_PROTECTION. Nilai yang dikodekan secara permanen S4P4. Nilai yang dikodekan secara permanen Datto. Diperoleh dari syslog_severity_code. Jika < 3, tingkat keparahan adalah RENDAH. Jika > 2 dan < 6, tingkat keparahan adalah SEDANG. Jika > 5, tingkat keparahan adalah TINGGI.
timestamp
metadata.event_timestamp
Stempel waktu yang diekstrak dari pesan log mentah.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Collect Kaseya Datto File Protection logs\n=========================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest Kaseya Datto File Protection logs to\nGoogle Security Operations using Bindplane. The parser extracts fields from\nDatto S4P4 syslog messages using grok patterns, maps them to the Unified Data\nModel (UDM), and categorizes events based on syslog severity. It specifically\nhandles CEF formatted data within the syslog message, extracting key fields like\nvendor, product, version, and event details for enrichment and classification.\n\nBefore you begin\n----------------\n\nMake sure you have the following prerequisites:\n\n- Google SecOps instance\n- Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open\n- Privileged access to Datto Siris or Alto\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall the Bindplane agent\n---------------------------\n\n### Windows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional installation resources\n\nFor additional installation options, consult the [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure Bindplane agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the configuration file:\n - Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n - Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the port and IP address as required\n listen_address: \"0.0.0.0:514\"\n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the path to the credentials file you downloaded in Step 1\n creds_file_path: '/path/to/ingestion-authentication-file.json'\n # Replace with your actual customer ID from Step 2\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # Add optional ingestion labels for better organization\n ingestion_labels:\n log_type: 'DATTO_FILE_PROTECTION'\n raw_log_field: body\n\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/kaseya-datto-file-protection#get-auth-file) section.\n\nRestart the Bindplane agent to apply the changes\n------------------------------------------------\n\n- To restart the Bindplane agent in Linux, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- To restart the Bindplane agent in Windows, you can either use the **Services**\n console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Syslog for Datto Siris and Alto\n-----------------------------------------\n\n1. Sign in to the **Datto** Web Console.\n2. Go to **Configure \\\u003e Device Settings \\\u003e Remote Logging**.\n3. Enable **Remote Logging**.\n4. Provide the following configuration details:\n - Make sure the **Bindplane Agent** is configured to listen on **port 514** over the **TCP** connection.\n - **IP Address**: Enter the Bindplane agent IP address.\n5. Click **Apply**.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
