Recoger registros de Okta
Disponible en:
SecOps de Google
SIEM
En este documento se explica cómo ingerir registros de Okta en Google Security Operations mediante la API de Okta. El analizador extrae los registros del sistema y gestiona tanto eventos individuales como eventos por lotes en una matriz JSON. Normaliza los datos en el formato UDM, asigna los campos de Okta a sus equivalentes en UDM, enriquece los datos con agentes de usuario analizados, información geográfica y detalles de autenticación, y genera eventos de resultados de seguridad basados en los resultados y la información de riesgo.
Antes de empezar
- Instancia de Google SecOps
- Acceso privilegiado a Okta
Cómo configurar Okta
Para configurar el inicio de sesión único de Okta, sigue estos pasos:
Crear un usuario administrador de Okta con privilegios de solo lectura
- Inicia sesión en la consola de administración de Okta.
Crea un usuario estándar.
- Ve a Directorio > Personas.
- Haz clic en Añadir persona y rellena los campos obligatorios.
Selecciona Seguridad > Administradores.
Haz clic en Añadir administrador.
En el campo Asignación de administrador por administrador, busca el usuario estándar.
En la sección roles, selecciona Administrador de solo lectura en la lista.
Cierra la sesión de la cuenta de administrador.
Obtener una clave de API
- Inicia sesión en la consola de administración de Okta con el usuario administrador de solo lectura.
- Ve a Seguridad > API > Tokens.
- Haz clic en Crear token.
- Asigna un nombre descriptivo al token.
- Proporciona la zona IP en la que se usará la API (puedes seleccionar cualquier IP si no lo tienes claro).
- Haz clic en Crear token.
- Copia la clave de API.
- Haz clic en Aceptar.
Configurar feeds
Hay dos puntos de entrada diferentes para configurar feeds en la plataforma Google SecOps:
- Configuración de SIEM > Feeds > Añadir nuevo feed
- Centro de contenido > Paquetes de contenido > Empezar
Cómo configurar el feed de Okta
Para configurar este tipo de registro, sigue estos pasos:
- Haz clic en el paquete Okta.
- Busca el tipo de registro Okta.
Especifique los valores de los siguientes campos:
- Tipo de fuente: API de terceros (opción recomendada)
- Encabezado HTTP de autenticación: introduce la clave de API de Okta con el siguiente formato:
Authorization:<API_KEY>. - Nombre de host de la API: especifica el nombre de dominio de tu host de Okta (por ejemplo,
<your-domain>.okta.com). - Espacio de nombres de recursos: el espacio de nombres de recursos.
- Etiquetas de ingestión: la etiqueta aplicada a los eventos de este feed.
Opciones avanzadas
- Nombre del feed: un valor rellenado automáticamente que identifica el feed.
- Espacio de nombres de recursos: espacio de nombres asociado al feed.
- Etiquetas de ingestión: etiquetas aplicadas a todos los eventos de este feed.
Haga clic en Crear feed.
Para obtener más información sobre cómo configurar varios feeds para diferentes tipos de registros en esta familia de productos, consulta el artículo Configurar feeds por producto.
Tabla de asignación de UDM
| Campo de registro | Asignación de UDM | Observación |
|---|---|---|
actor.displayName |
principal.resource.attribute.labels |
|
assigned_group[] |
security_result.detection_fields |
|
created |
target.resource.attribute.labels |
|
credentials.oauthClient.autoKeyRotation |
security_result.detection_fields |
|
credentials.oauthClient.pkce_required |
security_result.detection_fields |
|
credentials.oauthClient.token_endpoint_auth_method |
security_result.detection_fields |
|
credentials.signing.kid |
security_result.detection_fields |
|
credentials.userNameTemplate.pushStatus |
security_result.detection_fields |
|
credentials.userNameTemplate.template |
metadata.product_event_type |
|
credentials.userNameTemplate.type |
security_result.detection_fields |
|
id |
principal.user.userid |
|
label |
target.resource.attribute.labels |
|
lastUpdated |
target.resource.attribute.labels |
|
orn |
target.resource.attribute.labels |
|
settings.implicitAssignment |
security_result.detection_fields |
|
settings.manualProvisioning |
security_result.detection_fields |
|
settings.notifications.vpn.network.connection |
security_result.detection_fields |
|
settings.notifications.vpn.network.helpUrl |
security_result.detection_fields |
|
settings.notifications.vpn.network.message |
security_result.detection_fields |
|
settings.oauthClient.application_type |
security_result.detection_fields |
|
settings.oauthClient.client_uri |
security_result.detection_fields |
|
settings.oauthClient.consent_method |
security_result.detection_fields |
|
settings.oauthClient.dpop_bound_access_tokens |
security_result.detection_fields |
|
settings.oauthClient.grant_types[] |
security_result.detection_fields |
|
settings.oauthClient.idp_initiated_login.mode |
security_result.detection_fields |
|
settings.oauthClient.initiate_login_uri |
security_result.detection_fields |
|
settings.oauthClient.issuer_mode |
security_result.detection_fields |
|
settings.oauthClient.logo_uri |
security_result.detection_fields |
|
settings.oauthClient.pkce_required |
security_result.detection_fields |
|
settings.oauthClient.redirect_uris[] |
security_result.detection_fields |
|
settings.oauthClient.response_types[] |
security_result.detection_fields |
|
settings.oauthClient.token_endpoint_auth_method |
security_result.detection_fields |
|
settings.oauthClient.wildcard_redirect |
security_result.detection_fields |
|
settings.signOn.acsUrl |
security_result.detection_fields |
|
settings.signOn.assertionSigned |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].filterType |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].filterValue |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].name |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].namespace |
security_result.detection_fields |
|
settings.signOn.attributeStatements[0].type |
security_result.detection_fields |
|
settings.signOn.audience |
security_result.detection_fields |
|
settings.signOn.authnContextClassRef |
security_result.detection_fields |
|
settings.signOn.defaultRelayState |
security_result.detection_fields |
|
settings.signOn.destination |
security_result.detection_fields |
|
settings.signOn.digestAlgorithm |
security_result.detection_fields |
|
settings.signOn.idpIssuer |
security_result.detection_fields |
|
settings.signOn.recipient |
security_result.detection_fields |
|
settings.signOn.responseSigned |
security_result.detection_fields |
|
settings.signOn.signatureAlgorithm |
security_result.detection_fields |
|
settings.signOn.subjectNameIdFormat |
security_result.detection_fields |
|
settings.signOn.subjectNameIdTemplate |
security_result.detection_fields |
|
signOnMode |
security_result.detection_fields |
|
status |
security_result.detection_fields |
|
visibility.appLinks.oidc_client_link |
security_result.detection_fields |
|
visibility.autoSubmitToolbar |
security_result.detection_fields |
|
visibility.hide.iOS |
security_result.detection_fields |
|
visibility.hide.web |
security_result.detection_fields |
|
| N/A | metadata.vendor_name |
Su valor debe ser Okta. |
| N/A | metadata.product_name |
Su valor debe ser Okta. |
| N/A | extensions.auth.type |
Su valor debe ser SSO. |
Tabla de asignación de matrices
En la siguiente tabla se muestra la asignación de elementos de matriz de Okta a campos de UDM repetidos.
| Array de registros | Matriz de eventos | Observación |
|---|---|---|
actor.alternateId |
TBD |
|
actor.displayName |
principal.user.user_display_name |
Cuando eventType es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
actor.displayName |
principal.user.user_display_name |
Cuando eventType no es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
actor.type |
principal.user.attribute.roles.name |
Cuando eventType es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
actor.type |
principal.user.attribute.roles.name |
Cuando eventType no es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
anonymous |
security_result.detection_fields |
|
authenticationContext.externalSessionId |
network.parent_session_id |
|
client.device |
principal.asset.type |
Compatible con: LINUX, WINDOWS, MAC, IOS, ANDROID y CHROME_OS |
client.device |
additional.fields |
Event_type |
client.geographicalContext.city |
principal.location.city |
|
client.geographicalContext.country |
principal.location.country_or_region |
|
client.geographicalContext.geolocation.lat |
principal.location.region_latitude |
|
client.geographicalContext.geolocation.lon |
principal.location.region_longitude |
|
client.geographicalContext.postalCode |
additional.fields |
|
client.geographicalContext.postalCode |
target.resource.attribute.labels |
|
client.ipAddress |
principal.ip |
|
client.userAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
client.userAgent.browser |
target.resource.attribute.labels |
|
client.userAgent.os |
principal.platform |
|
client.userAgent.os |
principal.platform |
|
client.userAgent.rawUserAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
client.zone |
additional.fields |
Event_type |
debugContext.debugData.behaviors.New City |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Country |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Device |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New Geo-Location |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New IP |
security_result.detection_fields |
|
debugContext.debugData.behaviors.New State |
security_result.detection_fields |
|
debugContext.debugData.behaviors.Velocity |
security_result.detection_fields |
|
debugContext.debugData.clientAddress |
principal.ipprincipal.asset.ip |
|
debugContext.debugData.dtHash |
security_result.detection_fields |
|
debugContext.debugData.factor |
security_result.detection_fields |
|
debugContext.debugData.factorIntent |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors |
security_result.description |
|
debugContext.debugData.logOnlySecurityData.behaviors.New City |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Country |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Device |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New Geo-Location |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New IP |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.New State |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.behaviors.Velocity |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.detection_fields |
|
debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.description |
|
debugContext.debugData.logOnlySecurityData.risk.level |
security_result.severity_details |
|
debugContext.debugData.logOnlySecurityData.url |
target.url |
|
debugContext.debugData.privilegeGranted[] |
target.user.attribute.roles.nametarget.user.attribute.roles.description |
|
debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
debugContext.debugData.requestUri |
extensions.auth.auth_details |
|
debugContext.debugData.requestUri |
target.url |
|
debugContext.debugData.risk |
security_result.detection_fields |
Motivos asignados a security_result.detection_fields. |
debugContext.debugData.suspiciousActivityEventId |
security_result.detection_fields |
|
debugContext.debugData.suspiciousActivityEventType |
security_result.detection_fields |
|
debugContext.debugData.threatDetections |
security_result.detection_fields |
|
debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
debugContext.debugData.tunnels[].anonymous |
security_result.detection_fields |
|
debugContext.debugData.tunnels[].operator |
security_result.detection_fields |
|
debugContext.debugData.tunnels[].type |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.anonymous |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.operator |
security_result.detection_fields |
|
debugContext.debugData.tunnels.n.type |
security_result.detection_fields |
|
detail.actor.id |
principal.user.product_object_id |
Cuando eventType es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
detail.actor.id |
principal.user.product_object_id |
Cuando eventType no es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
detail.authenticationContext.externalSessionId |
network.parent_session_id |
|
detail.client.ipChain.0.ipclient.ipAddress |
principal.ipprincipal.asset.ip |
|
detail.debugContext.debugData.dtHash |
security_result.detection_fields |
|
detail.debugContext.debugData.factor |
security_result.detection_fields |
|
detail.debugContext.debugData.factorIntent |
security_result.detection_fields |
|
detail.debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
detail.debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
detail.debugContext.debugData.requestUri |
target.url |
|
detail.eventType |
metadata.product_event_type |
|
detail.outcome.reason |
security_result.category_details |
|
detail.outcome.result |
security_result.action |
|
detail.request.ipChain.0.geographicalContext.city |
principal.location.city |
|
detail.request.ipChain.0.geographicalContext.country |
principal.location.country_or_region |
|
detail.request.ipChain.0.geographicalContext.state |
principal.location.state |
|
detail.severity |
security_result.severity |
|
detail.target.0.alternateId |
Consulta la observación. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
detail.target.0.displayName |
target.applicationtarget.resource.name |
|
detail.target.0.displayName |
target.user.user_display_name |
|
detail.target.0.detailEntry.policyType} |
target.resource_ancestors.attribute.labels |
|
detail.target.0.id |
target.resource.product_object_id |
|
detail.target.0.id |
target.resource_ancestors.product_object_id |
|
detail.target.0.type |
target.resource.resource_subtype |
|
detail.target.0.type |
target.resource_ancestors.resource_subtype |
|
detail.uuid |
metadata.product_log_id |
|
displayMessage |
security_result.summary |
|
extensions.auth.type |
SSO |
Event_type |
extensions.auth.type |
SSO |
Cuando msg.target.type es cualquier otro caso que no sea AppInstance, PolicyEntity, PolicyRule o User. |
eventType |
metadata.product_event_type |
|
eventTypedetail.eventType |
metadata.product_event_type |
|
json_array.n.actor.id |
principal.user.product_object_id |
|
mapped data.fields to fields |
||
metadata.product_name |
Okta |
Event_type |
metadata.vendor_name |
Okta |
Event_type |
msg.actor.alternateId |
Consulta la observación. | Si el análisis falla, se asigna a principal.user.userid. De lo contrario, se asigna el nombre de usuario a principal.user.userido el nombre de usuario@dominio a principal.user.email_addresses. |
msg.actor.displayName |
principal.user.user_display_name |
|
msg.actor.type |
principal.user.attribute.roles.name |
|
msg.authenticationContext.authenticationProvider |
security_result.detection_fields |
Event_type |
msg.authenticationContext.credentialProvider |
security_result.detection_fields |
Event_type |
msg.authenticationContext.externalSessionId |
network.parent_session_id |
|
msg.client.device |
principal.asset.type |
Admite los siguientes tipos: MOBILE, WORKSTATION, LAPTOP, IOT, NETWORK_ATTACHED_STORAGE, PRINTER, SCANNER, SERVER y TAPE_LIBRARY. |
msg.client.geographicalContext.city |
principal.location.city |
|
msg.client.geographicalContext.country |
principal.location.country_or_region |
|
msg.client.geographicalContext.geolocation.lat |
principal.location.region_latitude |
|
msg.client.geographicalContext.geolocation.lon |
principal.location.region_longitude |
|
msg.client.geographicalContext.postalCode |
additional.fields |
|
msg.client.geographicalContext.state |
principal.location.state |
|
msg.client.ipAddress |
principal.ip |
|
msg.client.userAgent.browser |
target.resource.attribute.labels |
|
msg.client.userAgent.os |
principal.platform |
Compatible con: LINUX, WINDOWS, MAC, IOS, ANDROID y CHROME_OS |
msg.client.userAgent.rawUserAgent |
network.http.user_agentnetwork.http.parsed_user_agent |
|
msg.debugContext.debugData.dtHash |
security_result.detection_fields |
|
msg.debugContext.debugData.factor |
security_result.detection_fields |
|
msg.debugContext.debugData.factorIntent |
security_result.detection_fields |
|
msg.debugContext.debugData.logOnlySecurityData.behaviors |
security_result.description |
|
msg.debugContext.debugData.logOnlySecurityData.risk.reasons |
security_result.detection_fields |
|
msg.debugContext.debugData.logOnlySecurityData.url |
target.url |
|
msg.debugContext.debugData.pushOnlyResponseType |
security_result.detection_fields |
|
msg.debugContext.debugData.pushWithNumberChallengeResponseType |
security_result.detection_fields |
|
msg.debugContext.debugData.requestUri |
extensions.auth.auth_details |
|
msg.debugContext.debugData.threatSuspected |
security_result.detection_fieldssecurity_result.threat_status |
|
msg.displayMessage |
security_result.summary |
|
msg.eventType |
metadata.product_event_type |
|
msg.legacyEventType |
security_result.detection_fields |
|
msg.outcome.reason |
security_result.category_details |
|
msg.outcome.result |
security_result.action |
|
msg.published |
metadata.event_timestamp |
|
msg.request.ipChain.n.geographicalContext.city |
intermediary[n].location.city |
|
msg.request.ipChain.n.geographicalContext.country |
intermediary[n].location.country_or_region |
|
msg.request.ipChain.n.geographicalContext.geolocation.lat |
intermediary[n].location.region_latitude |
|
msg.request.ipChain.n.geographicalContext.geolocation.lon |
intermediary[n].location.region_longitude |
|
msg.request.ipChain.n.geographicalContext.state |
intermediary[n].location.state |
|
msg.request.ipChain.n.ip |
intermediary[n].ip |
|
msg.securityContext.asNumber |
security_result.detection_fields |
|
msg.securityContext.asOrg |
security_result.detection_fields |
|
msg.securityContext.domain |
security_result.detection_fields |
|
msg.securityContext.isProxy |
security_result.detection_fields |
|
msg.securityContext.isp |
security_result.detection_fields |
|
msg.severity |
security_result.severity |
|
msg.target.alternateId (when msg.target.type == User) |
target.user.email_addresses |
Cuando msg.target.type = User. Sin embargo, si el análisis falla, se asigna a target.user.userido, de lo contrario, target_user_name se asigna a target.user.userid. |
msg.target.detailEntry.policyType |
target.resource_ancestors.attribute.labels |
Cuando msg.target.type = PolicyEntity. |
msg.target.detailEntry.signOnModeType |
security_result.detection_fields |
Cuando msg.target.type es cualquier otro caso que no sea AppInstance, PolicyEntity, PolicyRule o User. |
msg.target.displayName |
additional.fields |
|
msg.target.displayName |
about.resource.name |
Cuando msg.target.type es cualquier otro caso que no sea AppInstance, PolicyEntity, PolicyRule o User. |
msg.target.displayName |
principal.user.user_display_name |
Cuando msg.target.type = User. |
msg.target.displayName |
target.application |
Cuando msg.target.type = AppInstance. |
msg.target.displayName |
target.resource.name |
Cuando msg.target.type = AppInstance. |
msg.target.displayName |
target.resource.name |
Cuando msg.target.type = PolicyRule. |
msg.target.displayName |
target.resource_ancestors.name |
Cuando msg.target.type = PolicyEntity. |
msg.target.id |
about.resource.product_object_id |
Cuando msg.target.type es cualquier otro caso que no sea AppInstance, PolicyEntity, PolicyRule o User. |
msg.target.id |
target.resource.product_object_id |
Cuando msg.target.type = AppInstance. |
msg.target.id |
target.resource.product_object_id |
Cuando msg.target.type = PolicyRule. |
msg.target.id |
target.resource_ancestors.product_object_id |
Cuando msg.target.type = PolicyEntity. |
msg.target.id |
target.user.product_object_id |
Cuando msg.target.type = User. |
msg.target.type |
about.resource.resource_subtype |
Cuando msg.target.type es cualquier otro caso que no sea AppInstance, PolicyEntity, PolicyRule o User. |
msg.target.type |
target.resource.resource_subtype |
Cuando msg.target.type = AppInstance. |
msg.target.type |
target.resource.resource_subtype |
Cuando msg.target.type = PolicyRule. |
msg.target.type |
target.resource_ancestors.resource_subtype |
Cuando msg.target.type = PolicyEntity. |
msg.target.type |
target.user.attribute.roles.name |
Cuando msg.target.type = User. |
msg.transaction.id |
network.session_id |
|
msg.transaction.type |
additional.fields |
Event_type |
msg.uuid |
metadata.product_log_id |
|
operator |
security_result.detection_fields |
|
outcome.reasondetail.outcome.reason |
security_result.category_details |
|
outcome.resultdetail.outcome.result |
security_result.action |
|
profile.displayName |
principal.user.user_display_name |
|
profile.email |
principal.user.email_addresses |
|
profile.login |
principal.user.userid |
nombre de usuario => principal.user.userid |
published |
metadata.event_timestamp |
|
published |
metadata.event_timestamp |
|
request.ipChain.0.geographicalContext.citydetail.request.ipChain.0.geographicalContext.city |
principal.location.city |
|
request.ipChain.0.geographicalContext.countrydetail.request.ipChain.0.geographicalContext.country |
principal.location.country_or_region |
|
request.ipChain.0.geographicalContext.statedetail.request.ipChain.0.geographicalContext.state |
principal.location.state |
|
request.ipChain.0.ip |
principal.ipprincipal.asset.ip |
|
request.ipChain.1.geographicalContext.city |
intermediary.location.city |
|
request.ipChain.1.geographicalContext.country |
intermediary.location.country_or_region |
|
request.ipChain.1.geographicalContext.state |
intermediary.location.state |
|
securityContext.asNumber |
security_result.detection_fields |
|
securityContext.asOrg |
security_result.detection_fields |
|
securityContext.domain |
security_result.detection_fields |
|
securityContext.isProxy |
security_result.detection_fields |
|
securityContext.isProxy |
security_result.detection_fieldsadditional.fields |
|
securityContext.isp |
security_result.detection_fields |
|
severitydetail.severity |
security_result.severity |
|
target[].alternateId |
target.resource.attribute.labels |
|
target[].detailEntry.methodTypeUsed |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.methodUsedVerifiedProperties |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.policyRuleFactorMode |
security_result.detection_fields |
|
target[].detailEntry.policyType |
target.resource_ancestors.attribute.labels |
|
target[].detailEntry.signOnModeType |
security_result.detection_fields |
|
target[].displayName |
additional.fields |
|
target[].displayName |
target.applicationtarget.resource.name |
|
target[].displayName |
target.resource.name |
|
target[].displayName |
target.resource_ancestors.name |
|
target[].id |
target.resource.product_object_id |
|
target[].id |
target.resource_ancestors.product_object_id |
|
target[].type |
target.resource.resource_subtype |
|
target[].type |
target.resource_ancestors.resource_subtype |
|
target.0.alternateId |
Consulta la observación. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
target.0.detailEntry.clientAppId |
target.asset_id |
|
target.0.displayNamedetail.target.0.displayName |
target.user.user_display_name |
|
target.0.displayName/target.1.displayName |
target.user.group_identifiers |
|
target.0.id |
target.user.product_object_id |
|
target.0.typedetail.target.0.type |
target.user.attribute.roles.name |
|
target.1.alternateId |
Consulta la observación. | tgtuser_id => target.user.userid%{tgtusername}@%{tgtdomain} => target.user.email_addresses |
target.1.detailEntry.clientAppId |
target.asset_id |
|
target.1.displayName |
target.user.user_display_name |
|
target.1.id |
target.user.product_object_id |
|
target.1.type |
target.user.attribute.roles.name |
|
transaction.id |
network.session_id |
|
type |
security_result.detection_fields |
|
user_agent.browser |
target.resource.attribute.labels |
|
user_email |
principal.user.email_addresses |
Cuando eventType es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
user_email |
principal.user.email_addresses |
Cuando eventType no es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
user_id |
principal.user.userid |
Cuando eventType es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
user_id |
principal.user.userid |
Cuando eventType no es application.user_membership.update, policy.rule.update o user.authentication.auth_via_radius. |
uuid |
metadata.product_log_id |
|
uuid |
metadata.product_log_id |
Referencia de delta de asignación de UDM
El 26 de agosto del 2025, Google SecOps lanzó una nueva versión del analizador de Okta, que incluye cambios significativos en la asignación de campos de registro de Okta a campos de UDM y en la asignación de tipos de eventos.
Delta de asignación de campos de registro
En la siguiente tabla se muestra la diferencia de asignación de los campos de registro de Okta a UDM expuestos antes del 26 de agosto del 2025 y posteriormente (se indican en las columnas Asignación antigua y Asignación actual, respectivamente).
| Campo de registro | Asignación antigua | Asignación actual |
|---|---|---|
client.geographicalContext.geolocation.lat |
target.location.region_latitude |
principal.location.region_coordinates.latitude |
client.geographicalContext.geolocation.lon |
target.location.region_longitude |
principal.location.region_coordinates.longitude |
created |
target.resource.attribute.labels |
metadata.event_timestamp |
debugContext.debugData.authnRequestId |
additional.fields |
security_result.detection_fields |
debugContext.debugData.factorType |
additional.fields |
security_result.detection_fields |
debugContext.debugData.traceId |
additional.fields |
security_result.detection_fields |
debugContext.debugData.tunnels.anonymous |
security_result.detection_fields |
network.proxy_info.anonymous |
lastUpdated |
target.resource.attribute.labels |
target.resource.attribute.last_update_time |
platform cuando la plataforma es iOS |
principal.platform = MAC |
principal.platform = IOS |
securityContext.asOrg |
security_result.detection_fields |
network.organization_name |
securityContext.isProxy |
additional.fields |
network.is_proxy |
target.detailEntry.methodTypeUsed |
target.resource.attribute.labels |
security_result.detection_fields |
target.detailEntry.methodUsedVerifiedProperties |
target.resource.attribute.labels |
security_result.detection_fields |
Delta de asignación de tipos de eventos
Varios eventos que antes se clasificaban como genéricos ahora se clasifican correctamente con tipos de eventos significativos.
En la siguiente tabla se muestra la diferencia en la gestión de los tipos de eventos de Okta antes del 26 de agosto del 2025 y después (se indican en las columnas Tipo de evento antiguo y Tipo de evento actual, respectivamente).
| eventType del registro | Old event_type | Current event_type |
|---|---|---|
app.oauth2.as.authorize |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.code |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.implicit.access_token |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.as.authorize.implicit.id_token |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.authorize.code |
USER_UNCATEGORIZED |
USER_LOGIN |
app.oauth2.token.grant |
USER_UNCATEGORIZED |
USER_LOGIN |
application.user_membership.remove |
USER_UNCATEGORIZED |
USER_CHANGE_PERMISSIONS |
application.user_membership.update |
STATUS_UPDATE |
USER_CHANGE_PERMISSIONS |
user.authentication.auth_via_AD_agent |
STATUS_UPDATE |
USER_UNCATEGORIZED |
user.authentication.slo |
USER_UNCATEGORIZED |
USER_LOGOUT |
¿Necesitas más ayuda? Recibe respuestas de los miembros de la comunidad y de los profesionales de Google SecOps.