Raccogliere i log CASB di Zscaler

Questo documento descrive come esportare i log Zscaler CASB configurando un feed Google Security Operations e mappando i campi dei log al modello unificato dei dati (UDM).

Per ulteriori informazioni, consulta la panoramica dell'importazione dei dati in Google SecOps.

Un deployment tipico è costituito da Zscaler CASB e da un feed webhook di Google SecOps configurato per inviare i log a Google SecOps. Tuttavia, i dettagli del deployment possono variare in base al cliente e potrebbero essere più complessi.

Il deployment contiene i seguenti componenti:

  • Zscaler CASB: la piattaforma da cui raccogli i log.

  • Feed Google SecOps: il feed Google SecOps che recupera i log da Zscaler CASB e li scrive in Google SecOps.

  • Google SecOps: conserva e analizza i log.

Un'etichetta di importazione identifica il parser che normalizza i dati di log non elaborati nel formato UDM strutturato. Questo documento si applica in modo specifico al parser associato all'etichetta di importazione ZSCALER_CASB.

Prima di iniziare

  • Assicurati di avere accesso alla console Zscaler Internet Access. Per ulteriori informazioni, consulta Secure Internet and SaaS Access ZIA Help.
  • Assicurati di utilizzare Zscaler CASB versione 1.0 o 2.0.
  • Assicurati che tutti i sistemi nell'architettura di deployment siano configurati con il fuso orario UTC.
  • Assicurati di avere la chiave API necessaria per completare la configurazione del feed in Google SecOps. Per ulteriori informazioni, vedi Configurazione delle chiavi API.

Configurare i feed

Per configurare questo tipo di log:

  1. Vai a Impostazioni SIEM > Feed.
  2. Fai clic su Aggiungi nuovo feed.
  3. Fai clic sul pacchetto di feed Zscaler.
  4. Individua il tipo di log richiesto e fai clic su Aggiungi nuovo feed.

  5. Inserisci i valori per i seguenti parametri di input:

    • Tipo di origine: webhook (consigliato)
    • Delimitatore di divisione: il carattere utilizzato per separare le righe dei log. Lascia vuoto se non viene utilizzato alcun delimitatore.

    Opzioni avanzate

    • Nome feed: un valore precompilato che identifica il feed.
    • Spazio dei nomi dell'asset: spazio dei nomi associato al feed.
    • Etichette di importazione: etichette applicate a tutti gli eventi di questo feed.

  6. Fai clic su Crea feed.

Per ulteriori informazioni sulla configurazione di più feed per diversi tipi di log all'interno di questa famiglia di prodotti, consulta Configurare i feed per prodotto.

Configurare Zscaler CASB

  1. Nella console Zscaler Internet Access, fai clic su Administration > Nanolog Streaming Service > Cloud NSS Feeds > Add Cloud NSS Feed.
  2. Nella finestra Aggiungi feed NSS cloud, inserisci i dettagli.
  3. Nel campo Nome feed, inserisci un nome univoco per il feed.
  4. Seleziona Zscaler for Web in NSS Type (Tipo NSS).
  5. Nell'elenco Stato, seleziona uno stato per attivare o disattivare il feed NSS.
  6. Lascia SIEM Rate impostato su Unlimited, a meno che tu non debba limitare il flusso di output a causa di licenze o altri vincoli.
  7. Nell'elenco Tipo di SIEM, seleziona Altro.
  8. Nell'elenco Autenticazione OAuth 2.0, seleziona Disabilitata.
  9. Nel campo Dimensione massima batch, inserisci un limite di dimensione per un singolo payload della richiesta HTTP in base alla best practice del SIEM, ad esempio 512 KB.

  10. Nel campo URL API, inserisci l'URL HTTPS dell'endpoint dell'API Chronicle utilizzando il seguente formato:

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    • CHRONICLE_REGION: la regione in cui è ospitata l'istanza Google SecOps. Ad esempio, US.
    • GOOGLE_PROJECT_NUMBER: il numero del tuo progetto BYOP. Ottienilo da C4.
    • LOCATION: la regione di Chronicle (Google SecOps) (uguale a CHRONICLE_REGION). Ad esempio, US.
    • CUSTOMER_ID: il tuo ID cliente Google SecOps. Ottenere da C4.
    • FEED_ID: l'ID del feed webhook appena creato (mostrato nell'interfaccia utente del feed).

    • URL API di esempio:

      https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs

  11. Fai clic su Aggiungi intestazione HTTP e poi aggiungi le intestazioni HTTP nel seguente formato:

    • Header 1: Key1: X-goog-api-key e Value1: chiave API generata dalle credenziali API di Google Cloud BYOP.
    • Header 2: Key2: X-Webhook-Access-Key e Value2: chiave segreta API generata in "SECRET KEY" (CHIAVE SEGRETA) del webhook.

  12. Nell'elenco Tipi di log, seleziona Sicurezza SaaS o Attività di sicurezza SaaS.

  13. Nell'elenco Tipo di output feed, seleziona JSON.

  14. Imposta Carattere di escape feed su , \ ".

  15. Nell'elenco Tipo di output feed, seleziona Personalizzato per aggiungere un nuovo campo al Formato output feed.

  16. Copia e incolla il Formato di output del feed, quindi aggiungi nuovi campi in base alle necessità. Assicurati che i nomi delle chiavi corrispondano ai nomi dei campi effettivi.

  17. Di seguito sono riportati i formati di output del feed predefiniti:

    • Sicurezza SaaS
    \{ "sourcetype" : "zscalernss-casb", "event" :\{"datetime":"%s{time}","recordid":"%d{recordid}","company":"%s{company}","tenant":"%s{tenant}","login":"%s{user}","dept":"%s{department}","applicationname":"%s{applicationname}","filename":"%s{filename}","filesource":"%s{filesource}","filemd5":"%s{filemd5}","threatname":"%s{threatname}","policy":"%s{policy}","dlpdictnames":"%s{dlpdictnames}","dlpdictcount":"%s{dlpdictcount}","dlpenginenames":"%s{dlpenginenames}","fullurl":"%s{fullurl}","lastmodtime":"%s{lastmodtime}","filescantimems":"%d{filescantimems}","filedownloadtimems":"%d{filedownloadtimems}"\}\}
    • Attività di sicurezza SaaS
    \{ "sourcetype" : "zscalernss-casb", "event" :\{"login":"%s{username}","tenant":"%s{tenant}","object_type":"%d{objtype1}","applicationname":"%s{appname}","object_name_1":"%s{objnames1}","object_name_2":"%s{objnames2}"\}\}

  18. Dall'elenco Fuso orario, seleziona il fuso orario per il campo Ora nel file di output. Per impostazione predefinita, il fuso orario è impostato su quello della tua organizzazione.

  19. Rivedi le impostazioni configurate.

  20. Fai clic su Salva per verificare la connettività. Se la connessione è riuscita, viene visualizzato un segno di spunta verde accompagnato dal messaggio Test Connectivity Successful: OK (200).

Per ulteriori informazioni sui feed Google SecOps, consulta la documentazione sui feed Google SecOps. Per informazioni sui requisiti per ciascun tipo di feed, vedi Configurazione dei feed per tipo.

Se riscontri problemi durante la creazione dei feed, contatta l'assistenza Google SecOps.

Riferimento alla mappatura dei campi

Riferimento per la mappatura dei campi: ZSCALER_CASB

La tabella seguente elenca i campi di log del tipo di log ZSCALER_CASB e i relativi campi UDM.

Log field UDM mapping Logic
sourcetype security_result.detection_fields[sourcetype]
objnames2 about.resource.name
object_name_2 about.resource.name
objtypename2 about.resource.resource_subtype
externalownername additional.fields[externalownername]
act_cnt additional.fields[act_cnt]
attchcomponentfiletypes additional.fields[attchcomponentfiletypes]
channel_name additional.fields[channel_name]
collabscope additional.fields[collabscope]
day additional.fields[day]
dd additional.fields[dd]
dlpdictcount security_result.detection_fields[dlpdictcount] If the dlpdictcount log field value is not empty and the dlpdictcount log field value is not equal to None, then the dlpdictcount log field is mapped to the security_result.detection_fields.dlpdictcount UDM field.
dlpenginenames security_result.detection_fields[dlpenginenames] If the dlpenginenames log field value is not empty and the dlpenginenames log field value is not equal to None, then the dlpenginenames log field is mapped to the security_result.detection_fields.dlpenginenames UDM field.
epochlastmodtime additional.fields[epochlastmodtime]
extcollabnames additional.fields[extcollabnames]
extownername additional.fields[extownername]
file_msg_id additional.fields[file_msg_id]
fileid additional.fields[fileid]
filescantimems additional.fields[filescantimems]
filetypecategory additional.fields[filetypecategory]
hh additional.fields[hh]
messageid additional.fields[messageid]
mm additional.fields[mm]
mon additional.fields[mon]
msgsize additional.fields[msgsize]
mth additional.fields[mth]
num_ext_recpts additional.fields[num_ext_recpts]
num_int_recpts additional.fields[num_int_recpts]
numcollab additional.fields[numcollab]
rtime additional.fields[rtime]
ss additional.fields[ss]
suburl additional.fields[suburl]
tenant additional.fields[tenant]
tz additional.fields[tz]
upload_doctypename additional.fields[upload_doctypename]
yyyy additional.fields[yyyy]
collabnames additional.fields[collabnames]
companyid additional.fields[companyid]
component additional.fields[component]
intcollabnames additional.fields[intcollabnames] If intcollabnames log field value does not match the regular expression pattern None then, for index in intcollabnames, the index is mapped to the additional.fields.value.list_value UDM field.
internal_collabnames additional.fields[internal_collabnames]
external_collabnames additional.fields[externalcollabnames]
num_external_collab additional.fields[num_external_collab]
num_internal_collab additional.fields[num_internal_collab]
repochtime additional.fields[repochtime]
eventtime metadata.event_timestamp If the eventtime log field value is not empty, then the eventtime log field is mapped to the metadata.event_timestamp UDM field.
epochtime metadata.event_timestamp If the epochtime log field value is not empty, then the epochtime log field is mapped to the metadata.event_timestamp UDM field.
time metadata.event_timestamp If the time log field value is not empty, then the time log field is mapped to the metadata.event_timestamp UDM field.
datetime metadata.event_timestamp If the datetime log field value is not empty, then the datetime log field is mapped to the metadata.event_timestamp UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_UNCATEGORIZED.
act_type_name metadata.product_event_type
recordid metadata.product_log_id
metadata.product_name The metadata.product_name UDM field is set to CASB.
metadata.vendor_name The metadata.vendor_name UDM field is set to Zscaler.
sender network.email.from If the sender log field value matches the regular expression pattern (^.*@.*$), then the sender log field is mapped to the network.email.from UDM field.
extrecptnames network.email.to For index in extrecptnames, the index is mapped to the network.email.to UDM field.
internal_recptnames network.email.to For index in internal_recptnames, the index is mapped to the network.email.to UDM field.
external_recptnames network.email.to For index in external_recptnames, the index is mapped to the network.email.to UDM field.
intrecptnames network.email.to For index in intrecptnames, the index is mapped to the network.email.to UDM field.
applicationname principal.application If the applicationname log field value is not empty, then the applicationname log field is mapped to the principal.application UDM field.

Else, the appname log field is mapped to the principal.application UDM field.
src_ip principal.ip
fullurl principal.url If the fullurl log field is not empty and the fullurl log field value is not equal to Unknown URL, then the fullurl log field is mapped to the principal.url UDM field.
is_admin_act principal.user.attribute.labels[is_admin_act]
principal.user.attribute.roles.type If the is_admin_act log field value is equal to 1, then the principal.user.attribute.roles.type UDM field is set to ADMINISTRATOR.
company principal.user.company_name
department principal.user.department
dept principal.user.department
user principal.user.email_addresses If the user log field value matches the regular expression pattern (^.*@.*$), then the user log field is mapped to the principal.user.email_addresses UDM field.
username principal.user.email_addresses If the username log field value matches the regular expression pattern (^.*@.*$), then the username log field is mapped to the principal.user.email_addresses UDM field.
owner principal.user.email_addresses If the owner log field value matches the regular expression pattern (^.*@.*$), then the owner log field is mapped to the principal.user.email_addresses UDM field.
login principal.user.email_addresses If the login log field value matches the regular expression pattern (^.*@.*$), then the login log field is mapped to the principal.user.email_addresses UDM field.
login principal.user.userid If the login log field value does not match the regular expression pattern ^.+@.+$, then the login log field is mapped to the principal.user.userid UDM field.
malware security_result.associations.name
security_result.associations.type If the malware log field value is not empty, then the security_result.associations.type UDM field is set to MALWARE.
dlpdictnames security_result.detection_fields[dlpdictnames]
dlpidentifier security_result.detection_fields[dlpidentifier]
filedownloadtimems additional.fields[filedownloadtimems]
malwareclass security_result.detection_fields[malwareclass]
msgid security_result.detection_fields[msgid]
oattchcomponentfilenames security_result.detection_fields[oattchcomponentfilenames]
obucketname security_result.detection_fields[obucketname]
obucketowner security_result.detection_fields[obucketowner]
ochannel_name security_result.detection_fields[ochannel_name]
ocollabnames security_result.detection_fields[ocollabnames]
odlpdictnames security_result.detection_fields[odlpdictnames]
odlpenginenames security_result.detection_fields[odlpenginenames]
oextcollabnames security_result.detection_fields[oextcollabnames]
oexternal_collabnames security_result.detection_fields[oexternal_collabnames]
oexternal_recptnames security_result.detection_fields[oexternal_recptnames]
oexternalownername security_result.detection_fields[oexternalownername]
oextownername security_result.detection_fields[oextownername]
oextrecptnames security_result.detection_fields[oextrecptnames]
ofile_msg_id security_result.detection_fields[ofile_msg_id]
ofileid security_result.detection_fields[ofileid]
ofullurl security_result.detection_fields[ofullurl]
ohostname security_result.detection_fields[ohostname]
ointcollabnames security_result.detection_fields[ointcollabnames]
ointernal_collabnames security_result.detection_fields[ointernal_collabnames]
ointernal_recptnames security_result.detection_fields[ointernal_recptnames]
ointrecptnames security_result.detection_fields[ointrecptnames]
omessageid security_result.detection_fields[omessageid]
omsgid security_result.detection_fields[omsgid]
oowner security_result.detection_fields[oowner]
orulelabel security_result.detection_fields[orulelabel]
osender security_result.detection_fields[osender]
osharedchannel_hostname security_result.detection_fields[osharedchannel_hostname]
otenant security_result.detection_fields[otenant]
ouser security_result.detection_fields[ouser]
any_incident security_result.detection_fields[any_incident]
is_inbound security_result.detection_fields[is_inbound]
policy security_result.rule_labels[policy]
ruletype security_result.rule_labels[ruletype]
rulelabel security_result.rule_name
security_result.severity If the severity log field value is equal to High, then the security_result.severity UDM field is set to HIGH.

Else, if the severity log field value is equal to Medium, then the security_result.severity UDM field is set to MEDIUM.

Else, if the severity log field value is equal to Low, then the security_result.sevrity UDM field is set to LOW.

Else, if the severity log field value is equal to Information, then the security_result.severity UDM field is set to INFORMATIONAL.
threatname security_result.threat_name If the threatname log field value is not empty and the dlpdictcount log field value is not equal to None, then the threatname log field is mapped to the security_result.threat_name UDM field.
filesource target.file.full_path If the filesource log field value is not empty, then the filesource log field is mapped to the target.file.full_path UDM field.
filepath target.file.full_path If the filesource log field value is not empty, then the filesource log field is mapped to the target.file.full_path UDM field.

Else if the filepath log field value is not empty, then the filepath log field is mapped to the target.file.full_path UDM field.
lastmodtime target.file.last_modification_time If the lastmodtime log field value is not empty, then the lastmodtime log field is mapped to the target.file.last_modification_time UDM field.
file_msg_mod_time target.file.last_modification_time If the lastmodtime log field value is not empty, then the lastmodtime log field is mapped to the target.file.last_modification_time UDM field.

Else if the file_msg_mod_time log field value is not empty, then the file_msg_mod_time log field is mapped to the target.file.fullpath UDM field.
filemd5 target.file.md5 If the filemd5 log field value is not equal to None and the filemd5 log field value matches the regular expression pattern ^[a-fA-F0-9]{32}$, then the filemd5 log field is mapped to the target.file.md5 UDM field.

Else, if the attchcomponentmd5s log field value matches the regular expression pattern ^[a-fA-F0-9]{32}$, then the attchcomponentmd5s log field is mapped to the target.file.md5 UDM field.
filetypename target.file.mime_type
filename target.file.names
attchcomponentfilenames target.file.names
sha target.file.sha256
attchcomponentfilesizes target.file.size If the attchcomponentfilesizes log field value is not empty, then the attchcomponentfilesizes log field is mapped to the target.file.size UDM field.
filesize target.file.size If the attchcomponentfilesizes log field value is not empty, then the attchcomponentfilesizes log field is mapped to the target.file.size UDM field.

Else if the filesize log field value is not empty, then the filesize log field is mapped to the target.file.size UDM field.
sharedchannel_hostname target.hostname If the hostname log field value is not empty, then the hostname log field is mapped to the target.hostname UDM field.

Else if the sharedchannel_hostname log field value is not empty, then the sharedchannel_hostname log field is mapped to the target.hostname UDM field.
hostname target.hostname If the hostname log field value is not empty, then the hostname log field is mapped to the target.hostname UDM field.
datacentercity target.location.city
datacentercountry target.location.country_or_region
datacenter target.location.name
bucketowner target.resource.attribute.labels[bucketowner]
projectname target.resource.attribute.labels[projectname]
bucketname target.resource.name If the bucketname log field value is not empty, then the bucketname log field is mapped to the target.resource.name UDM field.
objnames1 target.resource.name If the objnames1 log field value is not empty, then the objnames1 log field is mapped to the target.resource.name UDM field.
objectname target.resource.name If the objectname log field value is not empty, then the objectname log field is mapped to the target.resource.name UDM field.
reponame target.resource.name If the reponame log field value is not empty, then the reponame log field is mapped to the target.resource.name UDM field.
object_name_1 target.resource.name If the object_name_1 log field value is not empty, then the object_name_1 log field is mapped to the target.resource.name UDM field.
bucketid target.resource.product_object_id
objtypename1 target.resource.resource_subtype If the objtypename1 log field value is not empty, then the objtypename1 log field is mapped to the target.resource.resource_subtype UDM field.
objecttype target.resource.resource_subtype If the objecttype log field value is not empty, then the objecttype log field is mapped to the target.resource.resource_subtype UDM field.
object_type target.resource.resource_subtype
target.resource.resource_type If the bucketname log field value is not empty, then the target.resource.resource_type UDM field is set to STORAGE_BUCKET.

If the reponame log field value is not empty, then the target.resource.resource_type UDM field is set to REPOSITORY.

Passaggi successivi

Hai bisogno di ulteriore assistenza? Ricevi risposte dai membri della community e dai professionisti di Google SecOps.