Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser dengan label penyerapan RSA_AUTH_MANAGER.
Mengonfigurasi RSA Authentication Manager
Login ke konsol RSA Authentication Manager Security menggunakan kredensial administrator.
Di menu Penyiapan, klik Setelan sistem.
Di jendela System settings, di bagian Basic settings, pilih Logging.
Di bagian Pilih instance, pilih jenis instance Utama yang dikonfigurasi di lingkungan Anda, lalu klik Berikutnya untuk melanjutkan.
Di bagian Konfigurasi setelan, konfigurasikan log untuk bagian berikut yang ditampilkan:
Tingkat log
Tujuan data log
Penyamaran data log
Di bagian Tingkat log, konfigurasikan log berikut:
Setel Trace log ke Fatal.
Tetapkan Log audit administratif ke Berhasil.
Tetapkan Runtime audit log ke Success.
Setel Log sistem ke Peringatan.
Di bagian Tujuan data log, untuk data tingkat log berikut, pilih
Simpan ke database internal dan syslog jarak jauh untuk nama host atau alamat IP berikut,
lalu masukkan alamat IP Google Security Operations:
Data log audit administratif
Data log audit runtime
Data log sistem
Pesan Syslog ditransmisikan melalui nomor port yang lebih tinggi untuk UDP.
Di bagian Penyamaran data log, di kolom Samarkan nomor seri token: jumlah digit nomor seri token yang akan ditampilkan, masukkan nilai maksimum, yang sama dengan jumlah digit yang
muncul di token yang tersedia, seperti 12.
Parser ini mengekstrak kolom dari log CSV RSA Authentication Manager, dengan menangani variasi dalam format log. Log ini menggunakan grok untuk mengurai baris log pada awalnya, lalu memanfaatkan pemfilteran CSV untuk mengekstrak setiap kolom, memetakannya ke nama standar seperti username, clientip, dan operation_status untuk kompatibilitas UDM.
Tabel pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
clientip
principal.asset.ip
Nilai column8 dari log mentah.
clientip
principal.ip
Nilai column8 dari log mentah.
column1
metadata.event_timestamp.seconds
Diuraikan dari kolom time (column1) dalam log mentah, menggunakan format "yyyy-MM-dd HH:mm:ss" dan "yyyy-MM-dd HH: mm:ss".
column12
security_result.action
Dipetakan berdasarkan kolom operation_status (column12). Nilai "SUCCESS" dan "ACCEPT" dipetakan ke ALLOW, "FAIL", "REJECT", "DROP", "DENY", "NOT_ALLOWED" dipetakan ke BLOCK, dan nilai lainnya dipetakan ke UNKNOWN_ACTION.
column18
principal.user.userid
Nilai column18 dari log mentah.
column19
principal.user.first_name
Nilai column19 dari log mentah.
column20
principal.user.last_name
Nilai column20 dari log mentah.
column25
principal.hostname
Nilai column25 dari log mentah.
column26
principal.asset.hostname
Nilai column26 dari log mentah.
column27
metadata.product_name
Nilai column27 dari log mentah.
column3
target.administrative_domain
Nilai column3 dari log mentah.
column32
principal.user.group_identifiers
Nilai column32 dari log mentah.
column5
security_result.severity
Dipetakan berdasarkan kolom severity (column5). Nilai "INFO", "INFORMATIONAL" dipetakan ke INFORMATIONAL, "WARN", "WARNING" dipetakan ke WARNING, "ERROR", "CRITICAL", "FATAL", "SEVERE", "EMERGENCY", "ALERT" dipetakan ke ERROR, "NOTICE", "DEBUG", "TRACE" dipetakan ke DEBUG, dan nilai lainnya dipetakan ke UNKNOWN_SEVERITY.
column8
target.asset.ip
Nilai column8 dari log mentah.
column8
target.ip
Nilai column8 dari log mentah.
event_name
security_result.rule_name
Nilai column10 dari log mentah.
host_name
intermediary.hostname
Diekstrak dari bagian <DATA> log mentah menggunakan pola grok.
process_data
principal.process.command_line
Diekstrak dari bagian <DATA> log mentah menggunakan pola grok.
summary
security_result.summary
Nilai column13 dari log mentah.
time_stamp
metadata.event_timestamp.seconds
Diekstrak dari bagian <DATA> log mentah menggunakan pola grok. Jika tidak ditemukan, stempel waktu akan diekstrak dari kolom timestamp dalam log mentah.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis document details the process of collecting RSA Authentication Manager logs using a Google Security Operations forwarder, supporting ingestion through the \u003ccode\u003eRSA_AUTH_MANAGER\u003c/code\u003e parser label.\u003c/p\u003e\n"],["\u003cp\u003eConfiguration steps for RSA Authentication Manager include adjusting log levels, setting data destinations to a remote syslog, and masking sensitive token serial numbers.\u003c/p\u003e\n"],["\u003cp\u003eSetting up a Google Security Operations forwarder involves creating a new forwarder, adding a collector configured for RSA logs via syslog, and specifying necessary connection parameters like protocol, address, and port.\u003c/p\u003e\n"],["\u003cp\u003eThe parser extracts fields from RSA Authentication Manager logs using grok patterns and CSV filtering, mapping them to UDM format fields like \u003ccode\u003eusername\u003c/code\u003e, \u003ccode\u003eclientip\u003c/code\u003e, and \u003ccode\u003eoperation_status\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe UDM mapping table outlines how specific log fields from RSA Authentication Manager are transformed into UDM fields within Google Security Operations, including data like timestamps, severity, and user details.\u003c/p\u003e\n"]]],[],null,["# Collect RSA Authentication Manager logs\n=======================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect RSA Authentication Manager logs by using a Google Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser which normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the `RSA_AUTH_MANAGER`\ningestion label.\n\nConfigure RSA Authentication Manager\n------------------------------------\n\n1. Sign in to the **RSA Authentication Manager Security** console using administrator credentials.\n2. In the **Setup** menu, click **System settings**.\n3. In the **System settings** window, in the **Basic settings** section, select **Logging**.\n4. In the **Select instance** section, select the **Primary** instance type configured in your environment, and then click **Next** to continue.\n5. In the **Configure settings** section, configure the logs for the following sections that are displayed:\n - **Log levels**\n - **Log data destination**\n - **Log data masking**\n6. In the **Log levels** section, configure the following logs:\n - Set **Trace log** to **Fatal**.\n - Set **Administrative audit log** to **Success**.\n - Set **Runtime audit log** to **Success**.\n - Set **System log** to **Warning**.\n7. In the **Log data destination** section, for the following log level data, select\n **Save to internal database and remote syslog for the following hostname or IP address**,\n and then enter the IP address of Google Security Operations:\n\n - **Administrative audit log data**\n - **Runtime audit log data**\n - **System log data**\n\n Syslog messages are transmitted over higher port number for UDP.\n8. In the **Log data masking** section, in the **Mask token serial number: number of digits of the token serial number to display** field, enter the maximum value, which is equal to the number of digits that\n appear in available tokens, such as 12.\n\n For more information, see [Log data masking](https://community.rsa.com/s/article/Mask-Token-Serial-Numbers-in-Logs-4b7e844c).\n9. Click **Save**.\n\nConfigure Google Security Operations forwarder and syslog to ingest RSA Authentication Manager logs\n---------------------------------------------------------------------------------------------------\n\n1. Select **SIEM Settings** \\\u003e **Forwarders**.\n2. Click **Add new forwarder**.\n3. In the **Forwarder name** field, enter a unique name for the forwarder.\n4. Click **Submit** and then click **Confirm** . The forwarder is added and the **Add collector configuration** window appears.\n5. In the **Collector name** field, type a unique name for the collector.\n6. Select **RSA** as the **Log type**.\n7. Select **Syslog** as the **Collector type**.\n8. Configure the following mandatory input parameters:\n - **Protocol**: specify the connection protocol the collector will use to listen for syslog data.\n - **Address**: specify the target IP address or hostname where the collector resides and listens for syslog data.\n - **Port**: specify the target port where the collector resides and listens for syslog data.\n9. Click **Submit**.\n\nFor more information about Google Security Operations forwarders, see [Google Security Operations forwarders documentation](/chronicle/docs/install/forwarder-management-configurations). For information about requirements for each forwarder type, see [Forwarder configuration by type](/chronicle/docs/install/forwarder-management-api). If you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/support).\n\nField mapping reference\n-----------------------\n\nThis parser extracts fields from RSA Authentication Manager CSV logs, handling variations in the log format. It uses grok to initially parse the log lines, then leverages CSV filtering to extract individual fields, mapping them to standardized names like `username`, `clientip`, and `operation_status` for UDM compatibility.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
