Este documento descreve como coletar os registros do NetApp ONTAP usando o Syslog. O analisador extrai campos de mensagens do syslog usando expressões regulares. Em seguida, ele mapeia os campos extraídos para os campos correspondentes do UDM (Modelo de Dados Unificado), convertendo os dados de registro brutos em um formato estruturado para análise de segurança.
Antes de começar
Verifique se você tem uma instância do Google Security Operations.
Use o Windows 2016 ou uma versão mais recente ou um host Linux com systemd.
Se você estiver executando por trás de um proxy, verifique se as portas do firewall estão abertas.
Verifique se você tem acesso administrativo ao cluster do NetApp ONTAP.
Verifique se o ONTAP pode se comunicar com o servidor Syslog (Bindplane).
Receber o arquivo de autenticação de ingestão do Google SecOps
Faça login no console do Google SecOps.
Acesse Configurações do SIEM > Agentes de coleta.
Baixe o arquivo de autenticação de ingestão. Salve o arquivo com segurança no sistema em que o agente do Bindplane será instalado.
Receber o ID do cliente do Google SecOps
Faça login no console do Google SecOps.
Acesse Configurações do SIEM > Perfil.
Copie e salve o ID do cliente na seção Detalhes da organização.
Instalar o agente do BindPlane
Instalação do Windows
Abra o Prompt de Comando ou o PowerShell como administrador.
Configurar o agente do BindPlane para ingerir Syslog e enviar ao Google SecOps
Acesse o arquivo de configuração:
Localize o arquivo config.yaml. Normalmente, ele fica no diretório /etc/bindplane-agent/ no Linux ou no diretório de instalação no Windows.
Abra o arquivo usando um editor de texto (por exemplo, nano, vi ou Bloco de Notas).
Edite o arquivo config.yaml da seguinte forma:
receivers:udplog:# Replace the below port <54525> and IP <0.0.0.0> with your specific valueslisten_address:"0.0.0.0:54525"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the creds location below according the placement of the credentials file you downloadedcreds:'{jsonfileforcreds}'# Replace <customer_id> below with your actual ID that you copiedcustomer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# You can apply ingestion labels below as preferredingestion_labels:log_type:SYSLOGnamespace:netapp_ontapraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-udplogexporters:-chronicle/chronicle_w_labels
Substitua a porta e o endereço IP conforme necessário na sua infraestrutura.
Extraído da mensagem de registro usando um padrão grok. Presente apenas quando a descrição é "Saindo" ou "Fazendo login".
intermediary_host
intermediary.hostname
Extraído da mensagem de registro usando um padrão grok.
nmsdk_language
security_result.detection_fields.value
Extraído da mensagem de registro usando um padrão grok. Esse valor é adicionado como um "value" a um objeto detection_fields com "key" = "nmsdk_language".
nmsdk_platform
security_result.detection_fields.value
Extraído da mensagem de registro usando um padrão grok. Esse valor é adicionado como um "value" a um objeto "detection_fields" com "key" = "nmsdk_platform".
nmsdk_version
security_result.detection_fields.value
Extraído da mensagem de registro usando um padrão grok. Esse valor é adicionado como um "value" a um objeto detection_fields com "key" = "nmsdk_version".
netapp_version
security_result.detection_fields.value
Extraído da mensagem de registro usando um padrão grok. Esse valor é adicionado como um "value" a um objeto "detection_fields" com "key" = "netapp_version".
product_event_type
metadata.product_event_type
Extraído da mensagem de registro usando um padrão grok.
security_result.summary
security_result.summary
Extraído da mensagem de registro usando um padrão grok.
gravidade,
security_result.severity
Definido como "INFORMATIONAL" se a gravidade for "info" (não diferencia maiúsculas de minúsculas).
src_ip
principal.ip
Extraído da mensagem de registro usando um padrão grok.
src_port
principal.port
Extraído da mensagem de registro usando um padrão grok.
status
security_result.summary
Extraído da mensagem de registro usando um padrão grok.
ts
metadata.event_timestamp.seconds
Extraído da mensagem de registro usando um padrão grok e convertido em um carimbo de data/hora.
url
target.url
Extraído da mensagem de registro usando um padrão grok.
usuário
target.user.userid
Extraído da mensagem de registro usando um padrão grok.
extensions.auth.type
Definido como "AUTHTYPE_UNSPECIFIED" se a descrição for "Saindo" ou "Fazendo login".
metadata.event_type
Definido como "USER_LOGIN" se a descrição for "Fazendo login".
metadata.event_type
Definido como "USER_LOGOUT" se a descrição for "Sair".
metadata.event_type
Definido como "SCAN_UNCATEGORIZED" se a descrição não for "Fazendo login" ou "Fazendo logout".
metadata.log_type
Defina como "NETAPP_ONTAP".
metadata.product_name
Defina como "NETAPP_ONTAP".
metadata.vendor_name
Defina como "NETAPP_ONTAP".
target.platform
Defina como "WINDOWS" se nmsdk_platform contiver "windows" (sem diferenciação de maiúsculas e minúsculas).
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThis guide explains how to collect NetApp ONTAP logs via Syslog and integrate them with Google Security Operations (SecOps) for security analysis.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves installing and configuring the Bindplane Agent to ingest Syslog data, and setting up a Syslog destination within the ONTAP cluster.\u003c/p\u003e\n"],["\u003cp\u003eCollected logs are parsed, and fields are extracted using regular expressions before being mapped to Unified Data Model (UDM) fields for structured security analysis.\u003c/p\u003e\n"],["\u003cp\u003eSpecific steps include downloading an ingestion authentication file and customer ID from the SecOps console, alongside instructions to install the agent on Windows or Linux.\u003c/p\u003e\n"],["\u003cp\u003eThe guide also provides instructions on setting up event filters within ONTAP to capture various types of logs, including authentication events and security-related fields.\u003c/p\u003e\n"]]],[],null,["# Collect NetApp ONTAP logs\n=========================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the NetApp ONTAP logs through Syslog. The parser extracts fields from syslog messages using regular expressions. It then maps the extracted fields to the corresponding UDM (Unified Data Model) fields, effectively converting raw log data into a structured format for security analysis.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have administrative access to NetApp ONTAP cluster.\n- Ensure that ONTAP can communicate with the Syslog server (Bindplane).\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane Agent will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall Bindplane Agent\n-----------------------\n\n### Windows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux Installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional Installation Resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure BindPlane Agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the configuration file:\n\n - Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n - Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n udplog:\n # Replace the below port \u003c54525\u003e and IP \u003c0.0.0.0\u003e with your specific values\n listen_address: \"0.0.0.0:54525\" \n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the creds location below according the placement of the credentials file you downloaded\n creds: '{ json file for creds }'\n # Replace \u003ccustomer_id\u003e below with your actual ID that you copied\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # You can apply ingestion labels below as preferred\n ingestion_labels:\n log_type: SYSLOG\n namespace: netapp_ontap\n raw_log_field: body\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - udplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/netapp-ontap#get-auth-file) section.\n\nRestart Bindplane Agent to apply the changes\n--------------------------------------------\n\n- In Linux, to restart the Bindplane Agent, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- In Windows, to restart the Bindplane Agent, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure a Syslog Destination in ONTAP\n---------------------------------------\n\n1. Access the ONTAP Cluster using SSH, and replace `\u003contap-cluster-ip\u003e` with the management IP of your ONTAP cluster:\n\n ssh admin@\u003contap-cluster-ip\u003e\n\n2. Check **existing** event **filters and notifications**:\n\n event filter show\n event notification show\n\n3. Create a **Syslog Destination** , replace `\u003csyslog-server-ip\u003e` and `\u003csyslog-server-port\u003e` with your Syslog server details (Bindplane):\n\n event notification destination create -name syslog-ems -syslog \u003csyslog-server-ip\u003e -syslog-port \u003csyslog-server-port\u003e -syslog-transport udp-unencrypted\n\n4. Other options for -syslog-transport:\n\n - udp-unencrypted (default)\n - tcp-unencrypted\n - tcp-encrypted (for TLS).\n5. **Verify** the Syslog **Destination**:\n\n event notification destination show\n\nConfigure Existing Event Filters\n--------------------------------\n\n- Link **default filters** to the Syslog destination:\n\n event notification create -filter-name no-info-debug-events -destinations syslog-ems\n event notification create -filter-name default-trap-events -destinations syslog-ems\n\nOptional: Create and configure custom filters\n---------------------------------------------\n\n1. Authentication Events Filter (Logins/Logouts): Captures logs where description matches \"Logging in\" or \"Logging out\":\n\n event filter create -filter-name auth_events\n event filter rule add -filter-name auth_events -type include -message-name *login* -severity info\n event filter rule add -filter-name auth_events -type include -message-name *logout* -severity info\n\n2. Security Detection Fields Filter: Captures logs related to nmsdk_language, nmsdk_platform, nmsdk_version, and netapp_version:\n\n event filter create -filter-name security_fields\n event filter rule add -filter-name security_fields -type include -message-name *nmsdk_language* -severity info\n event filter rule add -filter-name security_fields -type include -message-name *nmsdk_platform* -severity info\n event filter rule add -filter-name security_fields -type include -message-name *nmsdk_version* -severity info\n event filter rule add -filter-name security_fields -type include -message-name *netapp_version* -severity info\n\n3. Severity-Based Logs Filter: Captures logs where severity is informational:\n\n event filter create -filter-name severity_info\n event filter rule add -filter-name severity_info -type include -message-name * -severity info\n\n4. Network Activity Filter: Captures logs with src_ip and src_port:\n\n event filter create -filter-name network_activity\n event filter rule add -filter-name network_activity -type include -message-name *src_ip* -severity info\n event filter rule add -filter-name network_activity -type include -message-name *src_port* -severity info\n\n5. URL Target Logs Filter: Captures logs with URL information:\n\n event filter create -filter-name url_target\n event filter rule add -filter-name url_target -type include -message-name *url* -severity info\n\n6. Apply Each Filter to the Syslog Destination:\n\n event notification create -filter-name auth_events -destinations syslog-ems\n event notification create -filter-name security_fields -destinations syslog-ems\n event notification create -filter-name severity_info -destinations syslog-ems\n event notification create -filter-name network_activity -destinations syslog-ems\n event notification create -filter-name url_target -destinations syslog-ems\n\n7. Verify Notifications:\n\n event notification show\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
