Recopilar registros de Splunk CIM
En este documento se describe cómo puede recoger registros del modelo de información común (CIM) de Splunk configurando Splunk y un reenviador de Google Security Operations. En este documento también se indican los tipos de registros y las versiones de Splunk compatibles.
Para obtener más información, consulta Ingestión de datos en Google Security Operations.
Información general
En el siguiente diagrama de arquitectura de implementación se muestra cómo se configuran los agentes de Splunk para enviar registros a Google Security Operations. Cada implementación de cliente puede ser diferente de esta representación y puede ser más compleja.
En el diagrama de arquitectura se muestran los siguientes componentes:
Fuente de datos: el sistema que se va a monitorizar en el que está instalado Splunk.
Splunk: recoge información de la fuente de datos y la reenvía al reenviador de Google Security Operations.
Reenviador de Google Security Operations: un componente de software ligero que se implementa en la red del cliente para reenviar los registros a Google Security Operations.
Google Security Operations: conserva y analiza los registros del servidor de la flota.
Una etiqueta de ingestión identifica el analizador que normaliza los datos de registro sin procesar en formato UDM estructurado. La información de este documento se aplica al analizador con la etiqueta de ingestión SPLUNK.
Antes de empezar
Usa la versión 5.0 de Splunk, que es compatible con el analizador de Google Security Operations.
Asegúrate de que todos los sistemas de la arquitectura de implementación estén configurados en la zona horaria UTC.
Configurar un agente de Splunk y un reenviador de Google Security Operations
Instala un agente compatible con CIM desde Splunkbase.
Configura el reenviador de Google Security Operations para enviar los registros al sistema de Google Security Operations. A continuación, se muestra un ejemplo de configuración de un reenviador de Google Security Operations:
- splunk: common: enabled: true data_type: SPLUNK batch_n_seconds: 10 batch_n_bytes: 819200 url: <SPLUNK_URL> query_cim: true is_ignore_cert: true query_string: datamodel Network_Traffic All_Traffic flat
Consideraciones para escribir consultas de búsqueda de Splunk
Splunk tiene su propio lenguaje de búsqueda, que es similar a SQL. Asegúrate de usar la sintaxis correcta en tu consulta de búsqueda. Ten en cuenta las siguientes características de búsqueda al crear una consulta:
Carácter de escape
Si un valor de cadena contiene comillas dobles ", utiliza barras inversas para escapar las comillas. De lo contrario, la búsqueda interpretará mal el final del valor de la cadena.
Por ejemplo, para buscar una cadena WHERE _raw="The user "vpatel" isn't authenticated.",
debes usar la secuencia \" para buscar una comilla doble literal.
Escribe la cadena de búsqueda con el siguiente formato:
WHERE _raw="The user \"vpatel\" isn't authenticated."
Para buscar una barra invertida \ , usa la secuencia \\.
Por ejemplo, si hay una cadena como C:\user\abc, debe escribirse como C:\\user\\abc.
Búsqueda con sintaxis incorrecta
Si una sección de la consulta no es válida, no se evalúa toda la consulta y aparece un mensaje de error.
Veamos un ejemplo en el que falta la opción de modo de búsqueda en la consulta:
multisearch [|datamodel Network_Traffic All_Traffic] [|datamodel Network_Sessions All_Sessions flat]
En este ejemplo, falta la opción de modo de búsqueda en la consulta. Esto provoca el siguiente error:
Error in 'multisearch' command: Multisearch sub searches might only contain purely streaming operations. The search job has failed due to an error.
Compatibilidad con varios modelos de datos
Splunk admite una única consulta de gran tamaño que abarca modelos de datos. La siguiente consulta de búsqueda extrae datos de varios modelos de datos:
multisearch [|datamodel Network_Traffic All_Traffic flat] [|datamodel Network_Sessions All_Sessions flat]
Estos son los componentes de esta consulta que abarca modelos de datos:
Multisearch: la consulta debe empezar por la palabra multisearch. Una consulta de un modelo de datos debe incluirse entre corchetes [ ] y empezar por el carácter de barra vertical |.
Network_Traffic: nombre del modelo de datos.
All_Traffic: conjunto de datos del modelo de datos Network_Traffic.
flat: modo de búsqueda. Las otras opciones son search y acceleration_search.
Recomendamos usar la siguiente consulta de Splunk para buscar en varios modelos de datos:
multisearch [|datamodel Network_Traffic All_Traffic flat] [|datamodel Network_Sessions All_Sessions flat]
Tipos de registros y modelos de datos admitidos
| Modelo de datos de Splunk | Compatible |
|---|---|
| Alertas | Sí |
| Estado de la aplicación (obsoleto) | No |
| Autenticación | Sí |
| Certificados | Sí |
| Cambiar | Sí |
| Análisis de cambios (obsoleto) | No |
| Acceso a los datos | Sí |
| Bases de datos | Sí |
| Prevención de la pérdida de datos | Sí |
| Correo electrónico | Sí |
| Endpoint | Sí |
| Firmas de eventos | Sí |
| Mensajes entre procesos | Sí |
| Detección de intrusiones | Sí |
| Inventario | Sí |
| Máquinas virtuales Java (JVM) | Sí |
| Malware | Sí |
| Resolución de red (DNS) | Sí |
| Sesiones de networking | Sí |
| Tráfico de red | Sí |
| Rendimiento | Sí |
| Registros de auditoría de Splunk | Sí |
| Gestión de incidencias | Sí |
| Novedades | Sí |
| Vulnerabilidades | Sí |
| Web | Sí |
Formatos de registro de CIM de Splunk admitidos
El analizador CIM de Splunk admite registros en formato JSON.
Registros de ejemplo de CIM de Splunk admitidos
JSON
{ "Channel": "Microsoft-Windows-Sysmon/Operational", "Computer": "dhcp-ad01.testdhcp2.local", "EventChannel": "Microsoft-Windows-Sysmon/Operational", "EventCode": "5", "EventData_Xml": "<Data Name='RuleName'>-<\\/Data><Data Name='UtcTime'>2021-10-22 06:38:15.540<\\/Data><Data Name='ProcessGuid'>{8AE2CCCF-5C56-6172-84FE-000000001500}<\\/Data><Data Name='ProcessId'>5616<\\/Data><Data Name='Image'>C:\\\\Program Files\\\\Splunk\\\\bin\\\\splunk-optimize.exe<\\/Data>", "EventDescription": "Process terminated", "EventID": "5", "EventRecordID": "157268", "Guid": "'{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'", "Image": "C:\\\\Program Files\\\\Splunk\\\\bin\\\\splunk-optimize.exe", "Keywords": "0x8000000000000000", "Level": "4", "Name": "'Microsoft-Windows-Sysmon'", "Opcode": "0", "ProcessGuid": "{8AE2CCCF-5C56-6172-84FE-000000001500}", "ProcessID": "'2888'", "ProcessId": "5616", "RecordID": "157268", "RecordNumber": "157268", "RuleName": "-", "SecurityID": "S-1-5-18", "SystemTime": "'2021-10-22T06:38:15.548776000Z'", "System_Props_Xml": "<Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>5<\\/EventID><Version>3<\\/Version><Level>4<\\/Level><Task>5<\\/Task><Opcode>0<\\/Opcode><Keywords>0x8000000000000000<\\/Keywords><TimeCreated SystemTime='2021-10-22T06:38:15.548776000Z'/><EventRecordID>157268<\\/EventRecordID><Correlation/><Execution ProcessID='2888' ThreadID='3648'/><Channel>Microsoft-Windows-Sysmon/Operational<\\/Channel><Computer>dhcp-ad01.testdhcp2.local<\\/Computer><Security UserID='S-1-5-18'/>", "Task": "5", "ThreadID": "'3648'", "TimeCreated": "2021-10-22T06:38:15.548776000Z", "UserID": "'S-1-5-18'", "UtcTime": "2021-10-22 06:38:15.540", "Version": "3", "_raw": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>5<\\/EventID><Version>3<\\/Version><Level>4<\\/Level><Task>5<\\/Task><Opcode>0<\\/Opcode><Keywords>0x8000000000000000<\\/Keywords><TimeCreated SystemTime='2021-10-22T06:38:15.548776000Z'/><EventRecordID>157268<\\/EventRecordID><Correlation/><Execution ProcessID='2888' ThreadID='3648'/><Channel>Microsoft-Windows-Sysmon/Operational<\\/Channel><Computer>dhcp-ad01.testdhcp2.local<\\/Computer><Security UserID='S-1-5-18'/><\\/System><EventData><Data Name='RuleName'>-<\\/Data><Data Name='UtcTime'>2021-10-22 06:38:15.540<\\/Data><Data Name='ProcessGuid'>{8AE2CCCF-5C56-6172-84FE-000000001500}<\\/Data><Data Name='ProcessId'>5616<\\/Data><Data Name='Image'>C:\\\\Program Files\\\\Splunk\\\\bin\\\\splunk-optimize.exe<\\/Data><\\/EventData><\\/Event>", "_time": "2021-10-22T12:08:15.540+0530", "action": "blocked", "date_hour": "6", "date_mday": "22", "date_minute": "38", "date_month": "october", "date_second": "15", "date_wday": "friday", "date_year": "2021", "date_zone": "0", "dest": "dummy.domain.com", "dvc_nt_host": "DHCP-AD01", "event_id": "157268", "eventtype": [ "endpoint_services_processes", "ms-sysmon-process", "windows_event_signature" ], "host": "DHCP-AD01", "id": "157268", "index": "main", "linecount": "1", "os": "Microsoft Windows", "process": "C:\\\\Program Files\\\\Splunk\\\\bin\\\\splunk-optimize.exe", "process_exec": "splunk-optimize.exe", "process_guid": "{8AE2CCCF:5C56:6172:84FE-000000001500}", "process_id": "5616", "process_name": "splunk-optimize.exe", "process_path": "C:\\\\Program Files\\\\Splunk\\\\bin\\\\splunk-optimize.exe", "punct": "<_='://../////'><><_='--'_='{----}'/><><\\/><><\\/><><", "signature": "Process terminated", "signature_id": "5", "source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "sourcetype": "XmlWinEventLog", "splunk_server": "dhcp-ad01", "tag": [ "process", "report", "track_event_signatures" ], "tag2001:db8::eventtype": [ "process", "report", "track_event_signatures" ], "timeendpos": "671", "timestartpos": "648", "user_id": "'dummy-user-id'", "vendor_product": "Microsoft Sysmon" }
Referencia de asignación de campos
En esta sección se explica cómo asigna el analizador de Google Security Operations los campos de registro de Splunk a los campos del modelo de datos unificado (UDM) de Google Security Operations para los conjuntos de datos. Para obtener más información, consulta el documento de Splunk sobre la versión 5.0.1.
Alertas
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Alerts:
| Campo de registro | Asignación de UDM |
|---|---|
| aplicación | observer.application |
| description | security_result.description |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_type | target.resource.resource_type |
| id | metadata.product_log_id |
| mitre_technique_id | security_result.detection_fields.labels.key/value |
| gravedad | security_result.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | security_result.rule_name |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_type | principal.resource.resource_type |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| tipo | security_result.alert_state |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_name | principal.user.userid |
| user_priority | principal.user.attribute.label.key/value |
| vendor_account | about.labels.key/value (obsoleto) additional.fields |
| vendor_region | about.location.country_or_region |
Autenticación
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de autenticación de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| aplicación | target.application |
| authentication_method | about.labels.key/value (obsoleto) additional.fields |
| authentication_service | extension.auth.auth_details |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_nt_domain | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| reason | security_result.summary |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_nt_domain | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_user | principal.user.user_display_name |
| src_user_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_user_category | principal.labels.key/value (obsoleto) additional.fields |
| src_user_id | principal.user.userid |
| src_user_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_user_role | principal.user.attribute.roles.name (repetido) |
| src_user_type | principal.user.attribute.roles.type |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_agent | network.http.user_agent |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_id | principal.user.userid |
| user_priority | principal.user.attribute.label.key/value |
| user_role | principal.user.attribute.roles.name (repetido) |
| user_type | principal.user.attribute.roles.type |
| vendor_account | about.labels.key/value (obsoleto) additional.fields |
All_Certificates
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Certificates de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_port | target.port |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_port | principal.port |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| transporte | network.ip_protocol |
SSL
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos SSL de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| ssl_end_time | network.tls.server.certificate.not_after |
| ssl_engine | about.labels.key/value (obsoleto) additional.fields |
| ssl_hash | about.labels.key/value (obsoleto) additional.fields |
| ssl_is_valid | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer | network.tls.server.certificate.issuer |
| ssl_issuer_common_name | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_email | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_email_domain | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_locality | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_organization | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_state | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_street | about.labels.key/value (obsoleto) additional.fields |
| ssl_issuer_unit | about.labels.key/value (obsoleto) additional.fields |
| ssl_name | about.labels.key/value (obsoleto) additional.fields |
| ssl_policies | about.labels.key/value (obsoleto) additional.fields |
| ssl_publickey | about.labels.key/value (obsoleto) additional.fields |
| ssl_publickey_algorithm | about.labels.key/value (obsoleto) additional.fields |
| ssl_serial | network.tls.server.certificate.serial |
| ssl_session_id | network.session_id |
| ssl_signature_algorithm | about.labels.key/value (obsoleto) additional.fields |
| ssl_start_time | network.tls.server.certificate.not_before |
| ssl_subject | network.tls.server.certificate.subject |
| ssl_subject_common_name | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_email | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_email_domain | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_locality | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_organization | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_state | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_street | about.labels.key/value (obsoleto) additional.fields |
| ssl_subject_unit | about.labels.key/value (obsoleto) additional.fields |
| ssl_validity_window | about.labels.key/value (obsoleto) additional.fields |
| ssl_version | network.tls.server.certificate.version |
All_Changes
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Changes de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| change_type | security_result.category_details |
| comando | principal.process.command_line |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dvc | principal.asset.hostname, principal.asset.ip |
| objeto | target.resource.name |
| object_attrs | about.labels.key/value (obsoleto) additional.fields |
| object_category | about.labels.key/value (obsoleto) additional.fields |
| object_id | target.user.product_object_id |
| object_path | target.file.full_path |
| result | metadata.description |
| result_id | metadata.product_event_type |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | target.user.userid |
| user_agent | network.http.user_agent |
| user_name | principal.user.user_display_name, target.labels.key/value |
| user_type | principal.user.attribute.roles.type, target.user.attribute.roles.type |
| vendor_account | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| vendor_region | about.location.country_or_region |
Account_Management
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Account_Management de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest_nt_domain | target.administrative_domain |
| src_nt_domain | principal.administrative_domain |
| src_user | principal.user.userid |
| src_user_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_user_category | principal.labels.key/value (obsoleto) additional.fields |
| src_user_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_user_name | principal.labels.key/value (obsoleto) additional.fields |
| src_user_type | principal.user.attribute.roles.type |
Instance_Changes
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Instance_Changes de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| image_id | principal.asset_id |
| instance_type | about.labels.key/value (obsoleto) additional.fields |
network_Changes
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos network_Changes de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest_ip_range | target.labels.key/value (obsoleto) additional.fields |
| dest_port_range | target.labels.key/value (obsoleto) additional.fields |
| direction | network.direction |
| protocolo | network.ip_protocol |
| rule_action | security_result.action_details security_result.action |
| src_ip_range | principal.labels.key/value (obsoleto) additional.fields |
| src_port_range | principal.labels.key/value (obsoleto) additional.fields |
Data_Access
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Data_Access de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| aplicación | target.application |
| app_id | metadata.product_log_id |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_name | target.administrative_domain |
| dest_url | target.url |
| dvc | principal.asset.hostname, principal.asset.ip |
| correo electrónico | principal.user.email_addresses |
| objeto | target.resource.name |
| object_category | about.labels.key/value (obsoleto) additional.fields |
| object_id | target.user.product_object_id |
| object_path | target.file.full_path |
| object_size | target.file.size |
| propietario | about.labels.key/value (obsoleto) additional.fields |
| owner_email | about.labels.key/value (obsoleto) additional.fields |
| owner_id | principal.user.userid |
| parent_object | target.resource.parent |
| parent_object_id | about.labels.key/value (obsoleto) additional.fields |
| parent_object_category | about.labels.key/value (obsoleto) additional.fields |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| tenant_id | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_agent | network.http.user_agent |
| user_group | principal.user.group_identifiers(repeated) |
| user_role | principal.user.attribute.roles.name (repetido) |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| vendor_product_id | about.labels.key/value (obsoleto) additional.fields |
All_Databases
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Databases de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| objeto | target.resource.name |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Database_Instance
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Database_Instance de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| instance_name | target.resource.attributes.key/value |
| instance_version | target.resource.attributes.key/value |
| process_limit | about.labels.key/value (obsoleto) additional.fields |
| session_limit | about.labels.key/value (obsoleto) additional.fields |
Database_Query
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Database_Query de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| query | about.labels.key/value (obsoleto) additional.fields |
| query_id | about.labels.key/value (obsoleto) additional.fields |
| query_time | about.labels.key/value (obsoleto) additional.fields |
| records_affected | about.labels.key/value (obsoleto) additional.fields |
Instance_Stats
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Instance_Stats de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| disponibilidad | about.labels.key/value (obsoleto) additional.fields |
| avg_executions | about.labels.key/value (obsoleto) additional.fields |
| dump_area_used | about.labels.key/value (obsoleto) additional.fields |
| instance_reads | about.labels.key/value (obsoleto) additional.fields |
| instance_writes | about.labels.key/value (obsoleto) additional.fields |
| number_of_users | about.labels.key/value (obsoleto) additional.fields |
| procesos | about.labels.key/value (obsoleto) additional.fields |
| sessions | about.labels.key/value (obsoleto) additional.fields |
| sga_buffer_cache_size | about.labels.key/value (obsoleto) additional.fields |
| sga_buffer_hit_limit | about.labels.key/value (obsoleto) additional.fields |
| sga_data_dict_hit_ratio | about.labels.key/value (obsoleto) additional.fields |
| sga_fixed_area_size | about.labels.key/value (obsoleto) additional.fields |
| sga_free_memory | about.labels.key/value (obsoleto) additional.fields |
| sga_library_cache_size | about.labels.key/value (obsoleto) additional.fields |
| sga_redo_log_buffer_size | about.labels.key/value (obsoleto) additional.fields |
| sga_shared_pool_size | about.labels.key/value (obsoleto) additional.fields |
| sga_sql_area_size | about.labels.key/value (obsoleto) additional.fields |
| start_time | about.labels.key/value (obsoleto) additional.fields |
| tablespace_used | about.labels.key/value (obsoleto) additional.fields |
Session_Info
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Session_Info de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| buffer_cache_hit_ratio | about.labels.key/value (obsoleto) additional.fields |
| confirmaciones | about.labels.key/value (obsoleto) additional.fields |
| cpu_used | about.labels.key/value (obsoleto) additional.fields |
| cursor | about.labels.key/value (obsoleto) additional.fields |
| elapsed_time | about.labels.key/value (obsoleto) additional.fields |
| logical_reads | about.labels.key/value (obsoleto) additional.fields |
| máquina | about.hostname |
| memory_sorts | about.labels.key/value (obsoleto) additional.fields |
| physical_reads | about.labels.key/value (obsoleto) additional.fields |
| seconds_in_wait | about.labels.key/value (obsoleto) additional.fields |
| session_id | network.session_id |
| session_status | about.labels.key/value (obsoleto) additional.fields |
| table_scans | about.labels.key/value (obsoleto) additional.fields |
| wait_state | about.labels.key/value (obsoleto) additional.fields |
| wait_time | about.labels.key/value (obsoleto) additional.fields |
Lock_Info
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Lock_Info de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| last_call_minute | about.labels.key/value (obsoleto) additional.fields |
| lock_mode | about.labels.key/value (obsoleto) additional.fields |
| lock_session_id | about.labels.key/value (obsoleto) additional.fields |
| logon_time | about.labels.key/value (obsoleto) additional.fields |
| obj_name | about.labels.key/value (obsoleto) additional.fields |
| os_pid | target.process.pid |
| serial_num | target.resource.product_object_id |
Espacio de tabla
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Tablespace de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| free_bytes | about.file.size |
| tablespace_name | about.resource.name |
| tablespace_reads | about.labels.key/value (obsoleto) additional.fields |
| tablespace_status | about.labels.key/value (obsoleto) additional.fields |
| tablespace_writes | about.labels.key/value (obsoleto) additional.fields |
Query_Stats
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Query_Stats de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| indexes_hit | about.labels.key/value (obsoleto) additional.fields |
| query_plan_hit | about.labels.key/value (obsoleto) additional.fields |
| stored_procedures_called | about.labels.key/value (obsoleto) additional.fields |
| tables_hit | about.labels.key/value (obsoleto) additional.fields |
DLP_Incidents
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos DLP_Incidents de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| aplicación | target.application |
| categoría | security_result.category_details |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_zone | target.location.country_or_origin |
| dlp_type | about.labels.key/value (obsoleto) additional.fields |
| dvc | principal.asset.hostname, principal.asset.ip |
| dvc_bunit | about.labels.key/value (obsoleto) additional.fields |
| dvc_category | about.labels.key/value (obsoleto) additional.fields |
| dvc_priority | about.labels.key/value (obsoleto) additional.fields |
| dvc_zone | principal.asset.location.country_or_region |
| objeto | target.resource.name |
| object_category | about.labels.key/value (obsoleto) additional.fields |
| object_path | target.file.full_path |
| gravedad | security_result.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_user | principal.user.user_display_name |
| src_user_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_user_category | principal.labels.key/value (obsoleto) additional.fields |
| src_user_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_zone | principal.location.country_or_origin |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
All_Email
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Email de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| delay | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| file_hash | about.file.sha256, about.file.md5, about.file.sha1 |
| file_name | about.labels.key/value (obsoleto) additional.fields |
| file_size | about.file.size |
| internal_message_id | metadata.product_log_id |
| message_id | network.email.mail_id |
| message_info | about.labels.key/value (obsoleto) additional.fields |
| orig_dest | target.labels.key/value (obsoleto) additional.fields |
| orig_recipient | about.labels.key/value (obsoleto) additional.fields |
| orig_src | network.email.from |
| process | principal.process.command_line |
| process_id | principal.process.pid |
| protocolo | network.application_protocol |
| destinatario | network.email.to |
| recipient_count | about.labels.key/value (obsoleto) additional.fields |
| recipient_domain | about.labels.key/value (obsoleto) additional.fields |
| recipient_status | about.labels.key/value (obsoleto) additional.fields |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| retries | about.labels.key/value (obsoleto) additional.fields |
| return_addr | about.labels.key/value (obsoleto) additional.fields |
| size | about.labels.key/value (obsoleto) additional.fields |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_user | principal.user.email_addresses |
| src_user_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_user_category | principal.labels.key/value (obsoleto) additional.fields |
| src_user_domain | principal.administrative_domain |
| src_user_priority | principal.labels.key/value (obsoleto) additional.fields |
| status_code | about.labels.key/value (obsoleto) additional.fields |
| subject | network.email.subject(repeated) |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| url | about.url |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| xdelay | about.labels.key/value (obsoleto) additional.fields |
| xref | about.labels.key/value (obsoleto) additional.fields |
Filtrado
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes para el filtrado del conjunto de datos de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| filter_action | about.labels.key/value (obsoleto) additional.fields |
| filter_score | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_extra | about.labels.key/value (obsoleto) additional.fields |
| signature_id | metadata.product_event_type |
Puertos
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Ports de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| creation_time | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_port | target.port |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| dest_should_timesync | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| process_guid | principal.process.product_specific_process_id |
| process_id | principal.process.pid |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_port | principal.port |
| src_requires_av | principal.labels.key/value (obsoleto) additional.fields |
| src_should_timesync | principal.labels.key/value (obsoleto) additional.fields |
| src_should_update | principal.labels.key/value (obsoleto) additional.fields |
| estado | about.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| transporte | network.ip_protocol |
| transport_dest_port | target.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
Procesos
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Processes de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| cpu_load_percent | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_is_expected | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| dest_should_timesync | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| mem_used | about.labels.key/value (obsoleto) additional.fields |
| original_file_name | src.file.full_path |
| os | principal.asset.platform_software.platform_version |
| parent_process | about.labels.key/value (obsoleto) additional.fields |
| parent_process_exec | about.labels.key/value (obsoleto) additional.fields |
| parent_process_id | principal.process.parent_process.parent_pid |
| parent_process_guid | principal.process.parent_process.product_specific_process_id |
| parent_process_name | about.labels.key/value (obsoleto) additional.fields |
| parent_process_path | principal.process.parent_process.command_line |
| process | about.labels.key/value (obsoleto) additional.fields |
| process_current_directory | about.labels.key/value (obsoleto) additional.fields |
| process_exec | about.labels.key/value (obsoleto) additional.fields |
| process_hash | principal.process.file.sha256/principal.process.file.md5/principal..process.file.sha1 |
| process_guid | principal.process.product_specific_process_id |
| process_id | principal.process.pid |
| process_integrity_level | security_result.severity |
| process_name | principal.process.command_line |
| process_path | principal.process.file.full_path |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_id | principal.user.userid |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Servicios
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes de los servicios del conjunto de datos de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| description | security_result.description |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_is_expected | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| dest_should_timesync | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| process_guid | principal.process.product_specific_process_id |
| process_id | principal.process.pid |
| servicio | target.application |
| service_dll | about.labels.key/value (obsoleto) additional.fields |
| service_dll_path | about.file.full_path |
| service_dll_hash | about.labels.key/value (obsoleto) additional.fields |
| service_dll_signature_exists | about.labels.key/value (obsoleto) additional.fields |
| service_dll_signature_verified | about.labels.key/value (obsoleto) additional.fields |
| service_exec | target.process.file.full_path |
| service_hash | about.labels.key/value (obsoleto) additional.fields |
| service_id | about.labels.key/value (obsoleto) additional.fields |
| service_name | about.labels.key/value (obsoleto) additional.fields |
| service_path | about.labels.key/value (obsoleto) additional.fields |
| service_signature_exists | about.labels.key/value (obsoleto) additional.fields |
| service_signature_verified | about.labels.key/value (obsoleto) additional.fields |
| start_mode | about.labels.key/value (obsoleto) additional.fields |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Sistema de archivos
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Filesystem de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| dest_should_timesync | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| file_access_time | about.labels.key/value (obsoleto) additional.fields |
| file_create_time | target.asset.attribute.creation_time |
| file_hash | target.file.sha256, target.file.md5, target.file.sha1 |
| file_modify_time | about.labels.key/value (obsoleto) additional.fields |
| file_name | about.labels.key/value (obsoleto) additional.fields |
| file_path | target.file.full_path |
| file_acl | about.labels.key/value (obsoleto) additional.fields |
| file_size | target.file.size |
| process_guid | principal.process.product_specific_process_id |
| process_id | principal.process.pid |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Registro
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Registry:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| dest_should_timesync | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| process_guid | principal.process.product_specific_process_id |
| process_id | principal.process.pid |
| registry_hive | about.labels.key/value (obsoleto) additional.fields |
| registry_path | about.labels.key/value (obsoleto) additional.fields |
| registry_key_name | target.registry.registry_key |
| registry_value_data | target.registry.registry_value_data |
| registry_value_name | target.registry.registry_value_name |
| registry_value_text | about.labels.key/value (obsoleto) additional.fields |
| registry_value_type | about.labels.key/value (obsoleto) additional.fields |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Firmas
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Signatures de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
Signatures_vendor_product
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Signatures_vendor_product:
| Campo de registro | Asignación de UDM |
|---|---|
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
All_Interprocess_Messaging
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Interprocess_Messaging de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| punto final | about.labels.key/value (obsoleto) additional.fields |
| endpoint_version | about.labels.key/value (obsoleto) additional.fields |
| mensaje | about.labels.key/value (obsoleto) additional.fields |
| message_consumed_time | about.labels.key/value (obsoleto) additional.fields |
| message_correlation_id | about.labels.key/value (obsoleto) additional.fields |
| message_delivered_time | about.labels.key/value (obsoleto) additional.fields |
| message_delivery_mode | about.labels.key/value (obsoleto) additional.fields |
| message_expiration_time | about.labels.key/value (obsoleto) additional.fields |
| message_id | metadata.product.log_id |
| message_priority | about.labels.key/value (obsoleto) additional.fields |
| message_properties | about.labels.key/value (obsoleto) additional.fields |
| message_received_time | about.labels.key/value (obsoleto) additional.fields |
| message_redelivered | about.labels.key/value (obsoleto) additional.fields |
| message_reply_dest | target.labels.key/value (obsoleto) additional.fields |
| message_type | about.labels.key/value (obsoleto) additional.fields |
| Parámetros | about.labels.key/value (obsoleto) additional.fields |
| carga útil | about.labels.key/value (obsoleto) additional.fields |
| payload_type | about.labels.key/value (obsoleto) additional.fields |
| request_payload | about.labels.key/value (obsoleto) additional.fields |
| request_payload_type | about.labels.key/value (obsoleto) additional.fields |
| request_sent_time | about.labels.key/value (obsoleto) additional.fields |
| response_code | network.http.response_code |
| response_payload_type | about.labels.key/value (obsoleto) additional.fields |
| response_received_time | about.labels.key/value (obsoleto) additional.fields |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| return_message | about.labels.key/value (obsoleto) additional.fields |
| rpc_protocol | network.application_protocol |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
IDS_Attacks
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos IDS_Attacks de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| categoría | security_result.category_details |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dvc | principal.asset.hostname, principal.asset.ip |
| dvc_bunit | about.labels.key/value (obsoleto) additional.fields |
| dvc_category | about.labels.key/value (obsoleto) additional.fields |
| dvc_priority | about.labels.key/value (obsoleto) additional.fields |
| file_hash | target.file.sha256, target.file.md5, target.file.sha1 |
| file_name | about.labels.key/value (obsoleto) additional.fields |
| file_path | target.file.full_path |
| ids_type | about.labels.key/value (obsoleto) additional.fields |
| gravedad | security_result.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_port | principal.port |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| transporte | network.ip_protocol |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
DS_Attacks
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos DS_Attacks de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest_port | target.port |
All_Inventory
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Inventory de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| description | security_result.description |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| habilitada | about.labels.key/value (obsoleto) additional.fields |
| familia | about.labels.key/value (obsoleto) additional.fields |
| hypervisor_id | about.labels.key/value (obsoleto) additional.fields |
| serial | principal.asset.hardware.serial_number |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| version | about.labels.key/value (obsoleto) additional.fields |
CPU
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de CPU de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| cpu_cores | principal.asset.hardware.cpu_number_cores |
| cpu_count | about.labels.key/value (obsoleto) additional.fields |
| cpu_mhz | principal.asset.hardware.cpu_clock_speed |
| cpu_load_mhz | principal.asset.hardware.cpu_clock_speed |
| cpu_load_percent | about.labels.key/value (obsoleto) additional.fields |
| cpu_time | about.labels.key/value (obsoleto) additional.fields |
| cpu_user_percent | about.labels.key/value (obsoleto) additional.fields |
Memoria
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Memory:
| Campo de registro | Asignación de UDM |
|---|---|
| mem | principal.asset.hardware.ram |
| heap_committed | about.labels.key/value (obsoleto) additional.fields |
| heap_initial | about.labels.key/value (obsoleto) additional.fields |
| heap_max | about.labels.key/value (obsoleto) additional.fields |
| heap_used | about.labels.key/value (obsoleto) additional.fields |
| non_heap_committed | about.labels.key/value (obsoleto) additional.fields |
| non_heap_initial | about.labels.key/value (obsoleto) additional.fields |
| non_heap_max | about.labels.key/value (obsoleto) additional.fields |
| non_heap_used | about.labels.key/value (obsoleto) additional.fields |
| objects_pending | about.labels.key/value (obsoleto) additional.fields |
| mem | principal.asset.hardware.ram |
| mem_committed | about.labels.key/value (obsoleto) additional.fields |
| mem_free | about.labels.key/value (obsoleto) additional.fields |
| mem_used | about.labels.key/value (obsoleto) additional.fields |
| intercambiar | about.labels.key/value (obsoleto) additional.fields |
| swap_free | about.labels.key/value (obsoleto) additional.fields |
| swap_used | about.labels.key/value (obsoleto) additional.fields |
red
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes de la red del conjunto de datos de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest_ip | target.ip |
| dns | about.labels.key/value (obsoleto) additional.fields |
| inline_nat | about.labels.key/value (obsoleto) additional.fields |
| interfaz | about.labels.key/value (obsoleto) additional.fields |
| ip | principal.asset.ip |
| lb_method | about.labels.key/value (obsoleto) additional.fields |
| mac | principal.asset.mac |
| name | principal.resource.name |
| nodo | about.labels.key/value (obsoleto) additional.fields |
| node_port | target.port |
| src_ip | principal.ip |
| vip_port | about.labels.key/value (obsoleto) additional.fields |
| rendimiento | about.labels.key/value (obsoleto) additional.fields |
| thruput_max | about.labels.key/value (obsoleto) additional.fields |
SO
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes al conjunto de datos OS de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| os | principal.asset.platform_software.platform_version |
| committed_memory | about.labels.key/value (obsoleto) additional.fields |
| cpu_time | about.labels.key/value (obsoleto) additional.fields |
| free_physical_memory | about.labels.key/value (obsoleto) additional.fields |
| free_swap | about.labels.key/value (obsoleto) additional.fields |
| max_file_descriptors | about.labels.key/value (obsoleto) additional.fields |
| open_file_descriptors | about.labels.key/value (obsoleto) additional.fields |
| os | principal.asset.platform_software.platform_version |
| os_architecture | about.labels.key/value (obsoleto) additional.fields |
| os_version | about.labels.key/value (obsoleto) additional.fields |
| physical_memory | about.labels.key/value (obsoleto) additional.fields |
| swap_space | about.labels.key/value (obsoleto) additional.fields |
| system_load | about.labels.key/value (obsoleto) additional.fields |
| total_processors | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
Almacenamiento
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes al conjunto de datos de Splunk Storage:
| Campo de registro | Asignación de UDM |
|---|---|
| array | about.labels.key/value (obsoleto) additional.fields |
| blocksize | about.labels.key/value (obsoleto) additional.fields |
| clúster | about.resource.resource_type = "CLUSTER" |
| fd_max | about.labels.key/value (obsoleto) additional.fields |
| latencia | about.labels.key/value (obsoleto) additional.fields |
| montar | principal.resource.attribute.labels.key/value |
| parent | principal.resource.parent |
| read_blocks | about.labels.key/value (obsoleto) additional.fields |
| read_latency | about.labels.key/value (obsoleto) additional.fields |
| read_ops | about.labels.key/value (obsoleto) additional.fields |
| almacenamiento | about.labels.key/value (obsoleto) additional.fields |
| write_blocks | about.labels.key/value (obsoleto) additional.fields |
| write_latency | about.labels.key/value (obsoleto) additional.fields |
| write_ops | about.labels.key/value (obsoleto) additional.fields |
| array | about.labels.key/value (obsoleto) additional.fields |
| blocksize | about.labels.key/value (obsoleto) additional.fields |
| clúster | about.resource.resource_type = "CLUSTER" |
| fd_max | about.labels.key/value (obsoleto) additional.fields |
| fd_used | about.labels.key/value (obsoleto) additional.fields |
| latencia | about.labels.key/value (obsoleto) additional.fields |
| montar | about.labels.key/value (obsoleto) additional.fields |
| parent | principal.resource.parent |
| read_blocks | about.labels.key/value (obsoleto) additional.fields |
| read_latency | about.labels.key/value (obsoleto) additional.fields |
| read_ops | about.labels.key/value (obsoleto) additional.fields |
| almacenamiento | about.labels.key/value (obsoleto) additional.fields |
| storage_free | about.labels.key/value (obsoleto) additional.fields |
| storage_free_percent | about.labels.key/value (obsoleto) additional.fields |
| storage_used | about.labels.key/value (obsoleto) additional.fields |
| storage_used_percent | about.labels.key/value (obsoleto) additional.fields |
| write_blocks | about.labels.key/value (obsoleto) additional.fields |
| write_latency | about.labels.key/value (obsoleto) additional.fields |
| write_ops | about.labels.key/value (obsoleto) additional.fields |
| error_code | security_result.description |
| operación | about.labels.key/value (obsoleto) additional.fields |
| storage_name | about.resource.name |
Usuario
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk User (Usuario):
| Campo de registro | Asignación de UDM |
|---|---|
| interactive | about.labels.key/value (obsoleto) additional.fields |
| contraseña | about.labels.key/value (obsoleto) additional.fields |
| shell | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_id | principal.user.userid |
| user_priority | principal.user.attribute.label.key/value |
Virtual_OS
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Virtual_OS de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| hipervisor | about.labels.key/value (obsoleto) additional.fields |
Captura
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Snapshot:
| Campo de registro | Asignación de UDM |
|---|---|
| size | about.file.size |
| captura | about.labels.key/value (obsoleto) additional.fields |
| Tiempo | about.labels.key/value (obsoleto) additional.fields |
JVM
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos JVM de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| jvm_description | security_result.description |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
Roscado
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Threading:
| Campo de registro | Asignación de UDM |
|---|---|
| cm_enabled | about.labels.key/value (obsoleto) additional.fields |
| cm_supported | about.labels.key/value (obsoleto) additional.fields |
| cpu_time_enabled | about.labels.key/value (obsoleto) additional.fields |
| cpu_time_supported | about.labels.key/value (obsoleto) additional.fields |
| current_cpu_time | about.labels.key/value (obsoleto) additional.fields |
| current_user_time | about.labels.key/value (obsoleto) additional.fields |
| daemon_thread_count | about.labels.key/value (obsoleto) additional.fields |
| omu_supported | about.labels.key/value (obsoleto) additional.fields |
| peak_thread_count | about.labels.key/value (obsoleto) additional.fields |
| synch_supported | about.labels.key/value (obsoleto) additional.fields |
| thread_count | about.labels.key/value (obsoleto) additional.fields |
| threads_started | about.labels.key/value (obsoleto) additional.fields |
Tiempo de ejecución
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Runtime:
| Campo de registro | Asignación de UDM |
|---|---|
| process_name | principal.process.command_line |
| start_time | about.labels.key/value (obsoleto) additional.fields |
| Tiempo de actividad | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| version | about.labels.key/value (obsoleto) additional.fields |
Recopilación
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Compilation de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| compilation_time | about.labels.key/value (obsoleto) additional.fields |
Carga de clases
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Classloading de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| current_loaded | about.labels.key/value (obsoleto) additional.fields |
| total_loaded | about.labels.key/value (obsoleto) additional.fields |
| total_unloaded | about.labels.key/value (obsoleto) additional.fields |
Malware_Attacks
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Malware_Attacks de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| categoría | security_result.category_details |
| fecha | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_nt_domain | target.administrative_domain |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| file_hash | target.file.sha256, target.file.md5, target.file.sha1 |
| file_name | about.labels.key/value (obsoleto) additional.fields |
| file_path | target.file.full_path |
| gravedad | security_result.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_user | principal.user.user_display_name |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| url | about.url |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Malware_Operations
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Malware_Operations de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_nt_domain | target.labels.key/value (obsoleto) additional.fields |
| dest_nt_domain | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_requires_av | target.labels.key/value (obsoleto) additional.fields |
| product_version | about.labels.key/value (obsoleto) additional.fields |
| signature_version | security_result.rule_version |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Malware_Operations
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Malware_Operations de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest_category | target.labels.key/value (obsoleto) additional.fields |
DNS
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos DNS de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| additional_answer_count | about.labels.key/value (obsoleto) additional.fields |
| responder | network.dns.answer.data |
| answer_count | about.labels.key/value (obsoleto) additional.fields |
| authority_answer_count | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_port | target.port |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| message_type | about.labels.key/value (obsoleto) additional.fields |
| name | about.labels.key/value (obsoleto) additional.fields |
| query | network.dns.questions.name |
| query_count | about.labels.key/value (obsoleto) additional.fields |
| query_type | network.dns.questions.type |
| record_type | network.dns.answer.type(uint32) |
| reply_code | about.labels.key/value (obsoleto) additional.fields |
| reply_code_id | network.dns.response_code |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_port | principal.port |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| transaction_id | network.dns.id |
| transporte | network.ip_protocol |
| ttl | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
All_Sessions
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Sessions de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_dns | target.labels.key/value (obsoleto) additional.fields |
| dest_ip | network.dhcp.ciaddr |
| dest_mac | network.dhcp.chaddr |
| dest_nt_host | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| duración | network.session_duration |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_dns | principal.labels.key/value (obsoleto) additional.fields |
| src_ip | principal.ip |
| src_mac | principal.mac |
| src_nt_host | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
DHCP
En la tabla siguiente se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos DHCP de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| lease_duration | network.dhcp.lease_time_second |
| lease_scope | about.labels.key/value (obsoleto) additional.fields |
All_Traffic
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Traffic de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| aplicación | network.application_protocol |
| bytes | about.labels.key/value (obsoleto) additional.fields |
| bytes_in | network.received_bytes |
| bytes_out | network.sent_bytes |
| canal | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_interface | target.labels.key/value (obsoleto) additional.fields |
| dest_ip | target.ip |
| dest_mac | target.mac |
| dest_port | target.port |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_translated_ip | target.nat_ip |
| dest_translated_port | target.nat_port |
| dest_zone | target.location.country_or_origin |
| direction | network.direction |
| duración | network.session_duration |
| dvc | principal.asset.hostname, principal.asset.ip |
| dvc_bunit | about.labels.key/value (obsoleto) additional.fields |
| dvc_category | about.labels.key/value (obsoleto) additional.fields |
| dvc_ip | about.labels.key/value (obsoleto) additional.fields |
| dvc_mac | principal.asset.mac |
| dvc_priority | about.labels.key/value (obsoleto) additional.fields |
| dvc_zone | principal.asset.location.country_or_region |
| flow_id | about.labels.key/value (obsoleto) additional.fields |
| icmp_code | about.labels.key/value (obsoleto) additional.fields |
| icmp_type | about.labels.key/value (obsoleto) additional.fields |
| paquetes | about.labels.key/value (obsoleto) additional.fields |
| packets_in | about.labels.key/value (obsoleto) additional.fields |
| packets_out | about.labels.key/value (obsoleto) additional.fields |
| protocolo | about.labels.key/value (obsoleto) additional.fields |
| protocol_version | about.labels.key/value (obsoleto) additional.fields |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| regla | security_result.rule_id |
| session_id | network.session_id |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_interface | principal.labels.key/value (obsoleto) additional.fields |
| src_ip | principal.ip |
| src_mac | principal.mac |
| src_port | principal.port |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| src_translated_ip | principal.nat_ip |
| src_translated_port | principal.nat_port |
| src_zone | principal.location.country_or_origin |
| ssid | about.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| tcp_flag | about.labels.key/value (obsoleto) additional.fields |
| transporte | network.ip_protocol |
| tos | about.labels.key/value (obsoleto) additional.fields |
| ttl | network.dns.additional.ttl |
| usuario | principal.user.userid |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_account | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| vlan | about.labels.key/value (obsoleto) additional.fields |
| Wi-Fi | about.labels.key/value (obsoleto) additional.fields |
All_Performance
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Performance de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_should_timesync | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| hypervisor_id | about.labels.key/value (obsoleto) additional.fields |
| resource_type | about.labels.key/value (obsoleto) additional.fields |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
Instalaciones
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Facilities de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| fan_speed | about.labels.key/value (obsoleto) additional.fields |
| power | about.labels.key/value (obsoleto) additional.fields |
| temperatura | about.labels.key/value (obsoleto) additional.fields |
Timesync
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Timesync de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
Tiempo de funcionamiento
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Uptime:
| Campo de registro | Asignación de UDM |
|---|---|
| Tiempo de actividad | about.labels.key/value (obsoleto) additional.fields |
View_Activity
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos View_Activity de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| aplicación | target.application |
| importe gastado | about.labels.key/value (obsoleto) additional.fields |
| uri | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| ver | about.labels.key/value (obsoleto) additional.fields |
Datamodel_Acceleration
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Datamodel_Acceleration de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| access_count | about.labels.key/value (obsoleto) additional.fields |
| access_time | about.labels.key/value (obsoleto) additional.fields |
| aplicación | target.application |
| segmentos | about.labels.key/value (obsoleto) additional.fields |
| buckets_size | about.labels.key/value (obsoleto) additional.fields |
| completado | about.labels.key/value (obsoleto) additional.fields |
| cron | about.labels.key/value (obsoleto) additional.fields |
| datamodel | about.labels.key/value (obsoleto) additional.fields |
| digestión | about.labels.key/value (obsoleto) additional.fields |
| más antiguo | about.labels.key/value (obsoleto) additional.fields |
| is_inprogress | about.labels.key/value (obsoleto) additional.fields |
| last_error | about.labels.key/value (obsoleto) additional.fields |
| last_sid | about.labels.key/value (obsoleto) additional.fields |
| más recientes | about.labels.key/value (obsoleto) additional.fields |
| mod_time | about.labels.key/value (obsoleto) additional.fields |
| de mensajes y grupos | about.labels.key/value (obsoleto) additional.fields |
| size | about.file.size |
| summary_id | about.labels.key/value (obsoleto) additional.fields |
Search_Activity
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Search_Activity de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| host | about.hostname |
| información | about.labels.key/value (obsoleto) additional.fields |
| búsqueda | about.labels.key/value (obsoleto) additional.fields |
| search_et | about.labels.key/value (obsoleto) additional.fields |
| search_lt | about.labels.key/value (obsoleto) additional.fields |
| search_type | about.labels.key/value (obsoleto) additional.fields |
| fuente | principal.labels.key/value (obsoleto) additional.fields |
| sourcetype | principal.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
Scheduler_Activity
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Scheduler_Activity de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| aplicación | target.application |
| host | about.hostname |
| savedsearch_name | about.labels.key/value (obsoleto) additional.fields |
| sid | about.labels.key/value (obsoleto) additional.fields |
| fuente | principal.labels.key/value (obsoleto) additional.fields |
| sourcetype | principal.labels.key/value (obsoleto) additional.fields |
| splunk_server | principal.ip, principal.hostname |
| status | security_result.summary |
| usuario | principal.user.user_display_name |
Web_Service_Errors
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Web_Service_Errors de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| host | about.hostname |
| fuente | principal.labels.key/value (obsoleto) additional.fields |
| sourcetype | principal.labels.key/value (obsoleto) additional.fields |
| event_id | security_result.rule_name |
Modular_Actions
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Modular_Actions de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| action_mode | about.labels.key/value (obsoleto) additional.fields |
| action_status | about.labels.key/value (obsoleto) additional.fields |
| aplicación | target.application |
| duración | network.session_duration |
| componente | about.labels.key/value (obsoleto) additional.fields |
| orig_rid | about.labels.key/value (obsoleto) additional.fields |
| orig_sid | about.labels.key/value (obsoleto) additional.fields |
| eliminar | about.labels.key/value (obsoleto) additional.fields |
| search_name | about.labels.key/value (obsoleto) additional.fields |
| action_name | security_result.action_details |
| signature | metadata.description |
| sid | about.labels.key/value (obsoleto) additional.fields |
| usuario | about.labels.key/value (obsoleto) additional.fields |
All_Ticket_Management
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos All_Ticket_Management de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| affect_dest | target.labels.key/value (obsoleto) additional.fields |
| comentarios | about.labels.key/value (obsoleto) additional.fields |
| description | security_result.description |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| prioridad | security_result.priority_details |
| gravedad | security_result.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| splunk_id | about.labels.key/value (obsoleto) additional.fields |
| splunk_realm | about.labels.key/value (obsoleto) additional.fields |
| src_user | principal.user.user_display_name |
| src_user_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_user_category | principal.labels.key/value (obsoleto) additional.fields |
| src_user_priority | principal.labels.key/value (obsoleto) additional.fields |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| ticket_id | target.user.attribute.label.ley/value |
| time_submitted | principal.user.attribute.creation_time |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
Cambiar
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Change:
| Campo de registro | Asignación de UDM |
|---|---|
| cambiar | about.labels.key/value (obsoleto) additional.fields |
Incidente
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Incident de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| incidente | about.labels.key/value (obsoleto) additional.fields |
Problema
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos de Splunk Problem:
| Campo de registro | Asignación de UDM |
|---|---|
| problema | about.labels.key/value (obsoleto) additional.fields |
Actualizaciones
En la siguiente tabla se indican los campos de registro y las asignaciones de UDM correspondientes de las actualizaciones del conjunto de datos de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_should_update | target.labels.key/value (obsoleto) additional.fields |
| dvc | principal.asset.hostname, principal.asset.ip |
| file_hash | target.file.sha256, target.file.md5, target.file.sha1 |
| file_name | about.labels.key/value (obsoleto) additional.fields |
| gravedad | security_result.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| status | security_result.summary |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Vulnerabilidades
En la siguiente tabla se enumeran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos Vulnerabilities de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| bugtraq | about.labels.key/value (obsoleto) additional.fields |
| categoría | security_result.category_details |
| cert | about.labels.key/value (obsoleto) additional.fields |
| CVE | vulnerabilites.cve_description |
| CVSS | vulnerabilites.cvss_base_score |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dvc | principal.asset.hostname, principal.asset.ip |
| dvc_bunit | about.labels.key/value (obsoleto) additional.fields |
| dvc_category | about.labels.key/value (obsoleto) additional.fields |
| dvc_priority | about.labels.key/value (obsoleto) additional.fields |
| msft | about.labels.key/value (obsoleto) additional.fields |
| mskb | about.labels.key/value (obsoleto) additional.fields |
| gravedad | extensions.vulns.vulnerabilites.severity |
| severity_id | about.labels.key/value (obsoleto) additional.fields |
| signature | metadata.description |
| signature_id | metadata.product_event_type |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| url | extensions.vulns.vulnerabilites.about.url |
| usuario | extensions.vulns.vulnerabilites.about.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
| xref | about.labels.key/value (obsoleto) additional.fields |
Web
En la siguiente tabla se muestran los campos de registro y las asignaciones de UDM correspondientes del conjunto de datos web de Splunk:
| Campo de registro | Asignación de UDM |
|---|---|
| acción | security_result.action_details security_result.action |
| aplicación | target.application |
| bytes | about.labels.key/value (obsoleto) additional.fields |
| bytes_in | network.received_bytes |
| bytes_out | network.sent_bytes |
| Almacenado en caché | about.labels.key/value (obsoleto) additional.fields |
| categoría | security_result.category_details |
| galleta | about.labels.key/value (obsoleto) additional.fields |
| dest | target.ip target.hostname target.labels.key/value (obsoleto) |
| dest_bunit | target.labels.key/value (obsoleto) additional.fields |
| dest_category | target.labels.key/value (obsoleto) additional.fields |
| dest_priority | target.labels.key/value (obsoleto) additional.fields |
| dest_port | target.port |
| duración | network.session_duration |
| http_content_type | about.labels.key/value (obsoleto) additional.fields |
| http_method | network.http.method |
| http_referrer | network.http.referral_url |
| http_referrer_domain | about.labels.key/value (obsoleto) additional.fields |
| http_user_agent | network.http.user_agent |
| http_user_agent_length | about.labels.key/value (obsoleto) additional.fields |
| response_time | about.labels.key/value (obsoleto) additional.fields |
| sitio web | about.labels.key/value (obsoleto) additional.fields |
| src | principal.ip principal.hostname principal.labels.key/value (obsoleto) |
| src_bunit | principal.labels.key/value (obsoleto) additional.fields |
| src_category | principal.labels.key/value (obsoleto) additional.fields |
| src_priority | principal.labels.key/value (obsoleto) additional.fields |
| status | network.http.response_code |
| etiqueta | about.labels.key/value (obsoleto) additional.fields |
| uri_path | about.labels.key/value (obsoleto) additional.fields |
| uri_query | about.labels.key/value (obsoleto) additional.fields |
| url | about.url |
| url_domain | about.asset.network_domain |
| url_length | about.labels.key/value (obsoleto) additional.fields |
| usuario | principal.user.user_display_name |
| user_bunit | about.labels.key/value (obsoleto) additional.fields |
| user_category | principal.user.attribute.labels.key/value |
| user_priority | principal.user.attribute.label.key/value |
| vendor_product | about.labels.key/value (obsoleto) additional.fields |
Tipos de eventos de UDM
En la siguiente tabla se enumeran las etiquetas de Splunk y los tipos de eventos de UDM correspondientes:
| Modelo de datos | Etiquetas de Splunk | Tipo de evento de UDM |
|---|---|---|
| Alertas | alerta | STATUS_UPDATE |
| Autenticación | autenticación | USER_UNCATEGORIZED |
| Certificado | certificado | NETWORK_UNCATEGORIZED |
| Cambiar | cambiar | SYSTEM_AUDIT_LOG_UNCATEGORIZED |
| Acceso a los datos | datos, acceso | USER_RESOURCE_ACCESS |
| Bases de datos | base de datos | USER_RESOURCE_ACCESS |
| Bases de datos | base de datos, instancia, estadísticas | STATUS_UPDATE |
| Bases de datos | base de datos, instancia, estado | STATUS_UPDATE |
| Bases de datos | base de datos, instancia, candado | STATUS_UPDATE |
| Bases de datos | base de datos, consulta | STATUS_UPDATE |
| Bases de datos | base de datos, consulta, espacio de tabla | STATUS_UPDATE |
| Bases de datos | base de datos, consulta, estadísticas | STATUS_UPDATE |
| Prevención de la pérdida de datos | dlp, incident | SCAN_UNCATEGORIZED |
| Correo electrónico | correo electrónico | EMAIL_UNCATEGORIZED |
| Correo electrónico | correo electrónico, entrega | EMAIL_TRANSACTION |
| Endpoint | listening, port | SERVICE_UNSPECIFIED |
| Endpoint | proceso, informe | PROCESS_UNCATEGORIZED |
| Endpoint | servicio, informe | SERVICE_UNSPECIFIED |
| Endpoint | endpoint, filesystem | FILE_UNCATEGORIZED |
| Endpoint | endpoint, registro | REGISTRY_UNCATEGORIZED |
| Firma de evento | track_event_signature | STATUS_UPDATE |
| Mensajería entre procesos | mensajería | STATUS_UPDATE |
| Detección de intrusiones | ids, ataque | SERVICE_UNSPECIFIED |
| Inventario | inventory | SYSTEM_AUDIT_LOG_UNCATEGORIZED |
| Máquina virtual Java (JVM) | jvm | SYSTEM_AUDIT_LOG_UNCATEGORIZED |
| Malware | se instale malware | STATUS_UPDATE |
| Resolución de red(DNS) | red, resolución, dns | NETWORK_DNS |
| Sesiones de networking | red, sesión | NETWORK_CONNECTION |
| Sesiones de networking | red, sesión, DHCP | NETWORK_DHCP |
| Tráfico de red | red, comunicarse | NETWORK_CONNECTION |
| Rendimiento | rendimiento | SERVICE_UNSPECIFIED |
| Registros de auditoría de Splunk | modaction | STATUS_UPDATE |
| Gestión de incidencias | venta de entradas | STATUS_UPDATE |
| Gestión de incidencias | venta de entradas, cambio | STATUS_UPDATE |
| Novedades | update | STATUS_UPDATE |
| Vulnerabilidades | report, vulnerabilites | SCAN_UNCATEGORIZED |
| Web | web | NETWORK_UNCATEGORIZED |
Siguientes pasos
¿Necesitas más ayuda? Recibe respuestas de los miembros de la comunidad y de los profesionales de Google SecOps.