Mengumpulkan log Symantec Endpoint Protection

Dokumen ini menjelaskan cara menyerap log Symantec Endpoint Protection ke Google Security Operations menggunakan Bindplane. Parser memproses log dalam format SYSLOG atau KV, dengan terlebih dahulu mengekstrak stempel waktu dari berbagai format dalam data log. Kemudian, file ini menggunakan file konfigurasi terpisah (sep_pt2.include) untuk melakukan penguraian dan penataan lebih lanjut peristiwa log, sehingga memastikan pemrosesan berhasil hanya jika ekstraksi stempel waktu awal berhasil.

Sebelum memulai

Pastikan Anda memenuhi prasyarat berikut:

• Instance Google SecOps
• Windows 2016 atau yang lebih baru atau host Linux dengan systemd
• Jika dijalankan di belakang proxy, port firewall terbuka
• Akses istimewa ke platform Symantec Endpoint Protection

Mendapatkan file autentikasi penyerapan Google SecOps

1. Login ke konsol Google SecOps.
2. Buka Setelan SIEM > Agen Pengumpulan.
3. Download File Autentikasi Penyerapan. Simpan file dengan aman di sistem tempat BindPlane akan diinstal.

Mendapatkan ID pelanggan Google SecOps

1. Login ke konsol Google SecOps.
2. Buka Setelan SIEM > Profil.
3. Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.

Menginstal agen Bindplane

Bagian berikut menjelaskan cara menginstal agen BindPlane.

Penginstalan Windows

1. Buka Command Prompt atau PowerShell sebagai administrator.

2. Jalankan perintah berikut:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

Penginstalan Linux

1. Buka terminal dengan hak istimewa root atau sudo.

2. Jalankan perintah berikut:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

Referensi penginstalan tambahan

Untuk opsi penginstalan tambahan, lihat panduan penginstalan.

Mengonfigurasi agen Bindplane untuk menyerap syslog dan mengirimkannya ke Google SecOps

1. Akses file konfigurasi:
   • Cari file config.yaml. Biasanya, file ini berada di direktori /etc/bindplane-agent/ di Linux atau di direktori penginstalan di Windows.
   • Buka file menggunakan editor teks (misalnya, nano, vi, atau Notepad).

2. Edit file config.yaml sebagai berikut:

   receivers:
       udplog:
           # Replace the port and IP address as required
           listen_address: `0.0.0.0:514`
   
   exporters:
       chronicle/chronicle_w_labels:
           compression: gzip
           # Adjust the path to the credentials file you downloaded in Step 1
           creds: '/path/to/ingestion-authentication-file.json'
           # Replace with your actual customer ID from Step 2
           customer_id: <customer_id>
           endpoint: malachiteingestion-pa.googleapis.com
           # Add optional ingestion labels for better organization
           ingestion_labels:
               log_type: 'CES'
               raw_log_field: body
   
   service:
       pipelines:
           logs/source0__chronicle_w_labels-0:
               receivers:
                   - udplog
               exporters:
                   - chronicle/chronicle_w_labels
   

3. Ganti port dan alamat IP sesuai kebutuhan di infrastruktur Anda.

4. Ganti <customer_id> dengan ID pelanggan yang sebenarnya.

5. Perbarui /path/to/ingestion-authentication-file.json ke jalur tempat file autentikasi disimpan di bagian Dapatkan file autentikasi penyerapan Google SecOps.

Mulai ulang agen Bindplane untuk menerapkan perubahan

• Untuk memulai ulang agen Bindplane di Linux, jalankan perintah berikut:

  sudo systemctl restart bindplane-agent
  

• Untuk memulai ulang agen Bindplane di Windows, Anda dapat menggunakan konsol Services atau memasukkan perintah berikut:

  net stop BindPlaneAgent && net start BindPlaneAgent
  

Mengonfigurasi Syslog di Symantec Endpoint Protection

1. Login ke UI web Symantec Endpoint Protection Manager Anda.
2. Klik ikon Admin.
3. Cari bagian View Servers, lalu klik Servers.
4. Klik Local Site > Configure External Logging.
5. Centang kotak Aktifkan Transmisi Log ke Server Syslog.
6. Berikan detail konfigurasi berikut:
   • Server Syslog: Masukkan alamat IP Bindplane.
   • Port Tujuan UDP: Masukkan nomor port Bindplane (misalnya, 514 untuk UDP).
   • Fasilitas Log: Masukkan Local6.
   • Centang kotak Audit Logs.
   • Centang kotak Log Keamanan.
   • Centang kotak Risiko.
7. Klik Oke.

Tabel pemetaan UDM

Kolom log	Pemetaan UDM	Keterangan
_DB_HOST	target.hostname
a_record	network.dns.questions.type
AccessCheckResults	security_result.detection_fields
Accesses	security_result.detection_fields
AccessList	security_result.detection_fields
AccessMask	security_result.detection_fields
AccessReason	security_result.description
AccountName	target.user.user_display_name
AccountType	principal.user.attribute.roles
ACTION	security_result.detection_fields
ACTION_TYPE	security_result.action_details
ActiveProfile	target.resource.name
ActivityID	additional.fields
AdditionalInfo2	security_result.detection_fields
ADMIN_NAME	principal.user.userid
AGENT_SECURITY_LOG_IDX	metadata.product_log_id
AgentVer	additional.fields
Alert	security_result.detection_fields
ALERT_IDX	security_result.rule_id
ALERTDATETIME	security_result.first_discovered_time
ALERTENDDATETIME	security_result.last_discovered_time
ALERTINSERTTIME	security_result.detection_fields
AlgorithmName	security_result.detection_fields
Allowedapplicationreason	security_result.detection_fields
APP_NAME	target.application
app_name	principal.application
AppPoolID	target.application
AuthenticationPackageName	additional.fields
AuthenticationSetId	security_result.detection_fields
AuthenticationSetName	target.resource.name
BitlockerUserInputTime	additional.fields
BootMenuPolicy	additional.fields
BootType	additional.fields
BU	additional.fields
BugcheckString	additional.fields
CALLER_PROCESS_ID	principal.process.pid
CALLER_PROCESS_NAME	principal.process.file.full_path
callerReturnAddress	additional.fields
callerReturnModuleName	additional.fields
Caption	target.application
Category	security_result.category_details
Channel	security_result.about.resource.attribute.labels
CIDS_SIGN_SUB_ID	additional.fields
CLIENT_USER2	principal.user.userid
Comment	metadata.description
Component	security_result.detection_fields
connection.ether_type	security_result.about.labels
ConnectionSecurityRuleName	target.resource.name
ConnectionSecurityRuleId	security_result.detection_fields
CryptographicSetId	security_result.detection_fields
CryptographicSetName	target.resource.name
CSPEID	additional.fields
DCName	intermediary.hostname
Desc	metadata.description
DesiredAccess	security_result.detection_fields
device.last_app_connection	target.asset.last_discover_time
device.wss_feature	target.asset.attribute.labels
DeviceName	target.resource.name
DeviceNameLength	additional.fields
DeviceTime	additional.fields
DeviceVersionMajor	additional.fields
DeviceVersionMinor	additional.fields
disposition	security_result.detection_fields
dns_direction	security_result.detection_fields
domain	target.administrative_domain
Domain	principal.administrative_domain
DOMAIN_ID	target.resource.product_object_id
EDate	additional.fields
EDateUTC	metadata.event_timestamp
elevated_token	additional.fields
EntryCount	additional.fields
Error	security_result.description
error	security_result.detection_fields
ErrorCode	security_result.description
ErrorDescription	security_result.description
Event	metadata.description
EVENT_DATA	additional.fields
event_type	metadata.product_event_type
EventData.Binary	additional.fields
eventDesc	metadata.description
eventInsertTime	metadata.collected_timestamp
EventReceivedTime	metadata.collected_timestamp
EventTime	metadata.event_timestamp
EventType	metadata.product_event_type
ExceptionCode	security_result.detection_fields
executionPolicy	security_result.rule_name
ExecutionProcessID	principal.process.pid
ExecutionThreadID	principal.process.product_specific_process_id
ExtensionId	security_result.detection_fields
ExtensionName	target.resource.name
ExtraInfoLength	additional.fields
ExtraInfoString	additional.fields
FailureId	security_result.detection_fields
faulting_application_name	principal.process.file.names
faulting_application_path	principal.process.file.full_path
FaultingModuleName	additional.fields
FaultingModulePath	additional.fields
FaultOffset	additional.fields
FILE_SIZE	about.file.size
FilterID	security_result.detection_fields
FinalStatus	security_result.description
GPODisplayName	target.resource.name
GPOFileSystemPath	target.file.full_path
Group	principal.resource.attribute.labels
HACK_TYPE	security_result.category_details
HandleId	target.resource.attribute.labels
HID_LEVEL	additional.fields
HN	additional.fields
host	principal.hostname
Hostname	principal.hostname
id	metadata.product_log_id
IdleImplementation	additional.fields
IdleStateCount	additional.fields
ImpersonationLevel	additional.fields
IntensiveProtectionLevel	security_result.detection_fields
Interface	security_result.detection_fields
intermediary_host	intermediary.ip intermediary.hostname	Dipetakan ke intermediary.ip jika nilainya adalah alamat IP. Dipetakan ke intermediary.hostname jika nilainya adalah nama host.
INTRUSION_PAYLOAD_URL	target.url
INTRUSION_URL	target.url
IP	principal.ip
IP_ADDR	src.ip
IpAddress	principal.ip
IpPort	principal.port
KERNEL	principal.platform_patch_level
KeyFilePath	target.file.full_path
KeyLength	additional.fields
KeyName	security_result.detection_fields
KeyType	security_result.detection_fields
lastUpdateTime	target.resource.attribute.last_update_time
LmPackageName	security_result.detection_fields
LoadOptions	additional.fields
LogonGuid	network.session_id
LogonProcessName	target.application
LogonType	extensions.auth.auth_details
MandatoryLabel	target.resource.attribute.labels
MasterKeyId	security_result.detection_fields
MaximumPerformancePercent	additional.fields
Message	metadata.description
MinimumPerformancePercent	additional.fields
MinimumThrottlePercent	additional.fields
Minutes	target.resource.attribute.labels
NewFile	target.file.full_path
NewGrp	target.group.group_display_name
NewModDt	target.file.last_modification_time
NewOwn	additional.fields
NewPerms	additional.fields
NewProcessId	target.process.pid
NewProcessName	target.process.file.full_path
NewSecurityDescriptor	security_result.description
NewSize	additional.fields
NominalFrequency	principal.resource.attribute.labels
Number	principal.resource.attribute.labels
NumberOfGroupPolicyObjects	additional.fields
ObjectName	target.resource.name
ObjectServer	target.resource.attribute.labels
ObjectType	target.resource.resource_type
ObjId	target.resource.attribute.labels
OldFile	src.file.full_path
OldGrp	src.group.group_display_name
OldModDt	src.file.last_modification_time
OldOwn	additional.fields
OldPerms	additional.fields
OldSize	additional.fields
omittedFiles	security_result.detection_fields
Opcode	additional.fields
OpcodeValue	metadata.product_event_type
Operation	security_result.description
Operation	additional.fields
OperationType	security_result.category_details
OriginalSecurityDescriptor	additional.fields
OS	principal.platform
OSVER	principal.platform_version
param2	security_result.detection_fields
param3	security_result.detection_fields
param4	security_result.detection_fields
PARAM_DEVICE_ID	principal.hostname
PARAMETER	target.file.full_path
parameters	additional.fields
PARENT_SERVER_TYPE	additional.fields
PerformanceImplementation	additional.fields
POLNm	additional.fields
prevalence	security_result.detection_fields
Priority	security_result.detection_fields
PrivilegeList	target.resource.attribute.permissions.name
PrivilegesUsedForAccessCheck	security_result.detection_fields
ProblemID	additional.fields
ProcessId	principal.process.pid
ProcessID	target.process.pid
ProcessingMode	additional.fields
ProcessingTimeInMilliseconds	additional.fields
ProcessName	principal.process.file.full_path
ProcName	principal.process.file.names
ProcPath	principal.process.file.full_path
product_event_type	metadata.product_event_type
PROFILE_SERIAL_NO	additional.fields
protected	security_result.detection_fields
ProviderGuid	metadata.product_deployment_id
ProviderName	security_result.detection_fields
PuaCount	additional.fields
PuaPolicyId	additional.fields
PUB_KEY	additional.fields
Reason	additional.fields
ReasonCode	additional.fields
RecordNumber	metadata.product_log_id
RecoveryReason	security_result.description
RecType	metadata.product_event_type
RelativeTargetName	target.user.user_display_name
report_id	metadata.product_log_id
request	additional.fields
restricted_admin_mode	additional.fields
restricted_sid_count	additional.fields
risks	security_result.detection_fields
Rule	security_result.rule_name
RuleName	security_result.rule_name
RuleType	additional.fields
scan_duration	security_result.detection_fields
scan_state	security_result.detection_fields
scan_type	security_result.detection_fields
scanned_number	security_result.detection_fields
ScriptType	additional.fields
SecurityPackageName	about.file.full_path
SEQ_ID	additional.fields
Service	target.application
SeverityValue	security_result.severity_details
sha256	principal.process.file.sha256
ShareLocalPath	target.file.full_path
ShareName	target.resource.name
SITE_IDX	additional.fields
skipped_files	security_result.detection_fields
SourceModuleName	additional.fields
SourceModuleType	additional.fields
SourceName	principal.application
spn1	target.resource.attribute.labels
spn2	target.resource.attribute.labels
standard_schemes	security_result.detection_fields
State	additional.fields
Status	target.resource.attribute.labels
StopTime	additional.fields
SubjectDomainName	principal.administrative_domain
SubjectLogonId	principal.user.userid
SubjectUserName	principal.user.userid
SubjectUserSid	principal.user.windows_sid
SupportInfo1	additional.fields
SupportInfo2	additional.fields
syslogServer	intermediary.ip intermediary.hostname	Nilai (alamat IP atau nama host) berasal dari header log, dan dikaitkan dengan perantara.
TargetDomainName	target.administrative_domain
TargetLogonId	target.user.userid
TargetUserName	target.user.userid
TargetUserSid	target.user.windows_sid
TaskContentNew	additional.fields
TaskName	target.resource.name
TaskValue	metadata.description
THREATS	security_result.detection_fields
threats	security_result.detection_fields
TimeDifferenceMilliseconds	additional.fields
TimeSampleSeconds	additional.fields
timestamp	metadata.event_timestamp
TokenElevationType	target.resource.attribute.labels
transaction_id	metadata.product_log_id
TransitedServices	security_result.detection_fields
TSId	network.session_id
type	security_result.threat_name
UMDFDeviceInstallBegin.version	target.resource.attribute.labels
UMDFReflectorDependencyMissing.Dependency	additional.fields
updateGuid	target.process.product_specific_process_id
updateRevisionNumber	target.resource.attribute.labels
updateTitle	target.resource.name
UpdateType	additional.fields
Url	target.url
urlTrackingStatus	security_result.detection_fields
User	principal.user.userid
UserID	target.user.userid
UserSid	target.user.windows_sid
VAPI_NAME	security_result.summary
VAST	additional.fields
Version	metadata.product_version
virtual_account	additional.fields
VSAD	additional.fields
WorkstationName	additional.fields
T/A	metadata.log_type	Jenis log di-hardcode menjadi SEP.
T/A	metadata.product_name	Nama produk di-hardcode menjadi SEP.
T/A	metadata.vendor_name	Nama vendor di-hardcode menjadi Symantec.

Referensi delta pemetaan UDM

Pada 26 Agustus 2025, Google SecOps merilis versi baru parser Symantec Endpoint Protection, yang mencakup perubahan signifikan pada pemetaan kolom log Symantec Endpoint Protection ke kolom UDM dan perubahan pada pemetaan jenis peristiwa.

Delta pemetaan kolom log

Tabel berikut mencantumkan delta pemetaan untuk kolom log-ke-UDM Symantec Endpoint Protection yang diekspos sebelum 26 Agustus 2025 dan setelahnya (masing-masing tercantum di kolom Pemetaan lama dan Pemetaan saat ini).

Kolom log	Pemetaan lama	Pemetaan saat ini
_DB_DRIVER	about.resource.id	about.resource.product_object_id
_ip	principal.ip	intermediary.ip
Actualaction: Quarantined	security_result.action : BLOCK	security_result.action : QUARANTINE
BEGIN_TIME	additional.fields	target.resource.attribute.labels
callerProcessId	target.process.pid	principal.process.pid
callerProcessName	target.file.full_path	principal.process.file.full_path
CATEGORY_DESC	additional.fields	security_result.category_details
CLIENT_TYPE	additional.fields	principal.user.attribute.roles
DESCRIPTION	security_result.detection_fields	security_result.summary
device.id	target.resource.id	target.resource.product_object_id
device_uid	principal.resource.id	principal.resource.product_object_id
DURATION	additional.fields	network.session_duration.seconds
END_TIME	additional.fields	target.resource.attribute.last_update_time
feature_name	about.labels	security_result.about.labels
REMOTE_HOST_MAC	additional.fields	principal.mac
resourceId	principal.resource.id	principal.resource.product_object_id
server_name_1	principal.hostname intermediary.hostname	target.hostname
UUID	additional.fields	principal.asset.asset_id

Delta pemetaan jenis peristiwa

Beberapa peristiwa yang sebelumnya diklasifikasikan sebagai peristiwa umum kini diklasifikasikan dengan benar menggunakan jenis peristiwa yang bermakna.

Tabel berikut mencantumkan perbedaan penanganan jenis peristiwa Symantec Endpoint Protection sebelum 26 Agustus 2025 dan setelahnya (masing-masing tercantum di kolom Old event_type dan Current event_type).

eventType dari log	event_type lama	event_type saat ini
Logout administrator	GENERIC_EVENT	USER_LOGOUT
Memblokir semua traffic IP lainnya dan mencatatnya	STATUS_UPDATE	NETWORK_CONNECTION
File Dibuat	GENERIC_EVENT	FILE_CREATION
File Diubah	GENERIC_EVENT	FILE_MODIFICATION
Nama File Diganti	GENERIC_EVENT	FILE_MODIFICATION
Pemindaian dimulai di drive yang dipilih	GENERIC_EVENT	SCAN_HOST
Pemindaian dimulai di drive yang dipilih, dan memiliki file	GENERIC_EVENT	SCAN_FILE
Pengguna mengakses resource, berdasarkan peristiwa	USER_UNCATEGORIZED	USER_RESOURCE_ACCESS
Pengguna mencoba menghentikan	GENERIC_EVENT	STATUS_SHUTDOWN
VAPI_NAME = File Delete	USER_UNCATEGORIZED	FILE_DELETION
VAPI_NAME = File Write	USER_UNCATEGORIZED	FILE_CREATION

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.