收集 Zscaler CASB 日志

本文档介绍了如何通过设置 Google 安全运营 Feed 并将日志字段映射到 Unified Data Model (UDM) 来导出 Zscaler CASB 日志。

如需了解详情，请参阅将数据提取到 Google SecOps 概览。

典型的部署包括 Zscaler CASB 和配置为将日志发送到 Google SecOps 的 Google SecOps Webhook Feed。不过，部署详情可能会因客户而异，并且可能更复杂。

该部署包含以下组件：

  • Zscaler CASB：您要从中收集日志的平台。

  • Google SecOps Feed：Google SecOps Feed 会从 Zscaler CASB 提取日志并将日志写入 Google SecOps。

  • Google SecOps：保留和分析日志。

注入标签用于标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档专门适用于与 ZSCALER_CASB 提取标签关联的解析器。

准备工作

  • 确保您有权访问 Zscaler Internet Access 控制台。如需了解详情，请参阅 Secure Internet and SaaS Access ZIA Help。
  • 确保您使用的是 Zscaler CASB 1.0 或 2.0 版。
  • 确保部署架构中的所有系统都使用世界协调时间 (UTC) 时区进行配置。
  • 确保您拥有在 Google SecOps 中完成 Feed 设置所需的 API 密钥。如需了解详情，请参阅设置 API 密钥。

在 Google SecOps 中设置注入 Feed，以注入 Zscaler CASB 日志

  1. 依次前往设置 > 动态。
  2. 点击新增。
  3. 在Feed 名称字段中，输入 Feed 的名称（例如 Zscaler CASB Logs）。
  4. 选择 Webhook 作为来源类型。
  5. 选择 Zscaler CASB 作为日志类型。
  6. 点击下一步。
  7. 可选：为以下输入参数输入值：
    1. 分屏分隔符：用于分隔日志行中的字符。如果不使用分隔符，请留空。
    2. 资产命名空间：资产命名空间。
    3. 提取标签：要应用于此 Feed 中的事件的标签。
  8. 点击下一步。
  9. 检查新的 Feed 配置，然后点击提交。
  10. 点击生成 Secret 密钥以生成用于对此 Feed 进行身份验证的 Secret 密钥。

设置 Zscaler CASB

  1. 在 Zscaler Internet Access 控制台中，依次点击管理 > Nanolog 流式传输服务 > Cloud NSS Feed > 添加 Cloud NSS Feed。
  2. 在“添加 Cloud NSS Feed”窗口中，输入详细信息。
  3. 在Feed 名称字段中，为 Feed 输入一个唯一名称。
  4. 在 NSS 类型中，选择 Zscaler for Web。
  5. 在状态列表中，选择相应状态以启用或停用 NSS Feed。
  6. 除非您因许可或其他限制而需要节流输出数据流，否则请将 SIEM 速率保留为 无限制。
  7. 在 SIEM 类型列表中，选择其他。
  8. 在 OAuth 2.0 Authentication（OAuth 2.0 身份验证）列表中，选择 Disabled（已停用）。
  9. 在 Max Batch Size 字段中，输入单个 HTTP 请求载荷的大小限制（遵循 SIEM 的最佳实践）；例如 512 KB。

  10. 在 API 网址字段中，使用以下格式输入 Chronicle API 端点的 HTTPS 网址：

      https://<CHRONICLE_REGION>-chronicle.googleapis.com/v1alpha/projects/<GOOGLE_PROJECT_NUMBER>/locations/<LOCATION>/instances/<CUSTOMER_ID>/feeds/<FEED_ID>:importPushLogs
    • CHRONICLE_REGION：您的 Google SecOps 实例的托管区域。例如 US。
    • GOOGLE_PROJECT_NUMBER：您的 BYOP 项目编号。从 C4 获取此值。
    • LOCATION：Chronicle（Google SecOps）区域（与 CHRONICLE_REGION 相同）。例如 US。
    • CUSTOMER_ID：您的 Google SecOps 客户 ID。从 C4 获取。
    • FEED_ID：新创建的 Webhook Feed 的 ID（显示在 Feed 界面中）。

    • API 网址示例：

      https://us-chronicle.googleapis.com/v1alpha/projects/12345678910/locations/US/instances/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/feeds/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy:importPushLogs

  11. 点击添加 HTTP 标头，然后按照以下格式添加 HTTP 标头：

    • Header 1：Key1 为 X-goog-api-key，Value1 为通过 Google Cloud BYOP 的 API 凭据生成的 API 密钥。
    • Header 2：Key2 为 X-Webhook-Access-Key，Value2 为在 webhook 的“SECRET KEY”中生成的 API 密钥。

  12. 在日志类型列表中，选择 SaaS 安全或 SaaS 安全活动。

  13. 在 Feed 输出类型列表中，选择 JSON。

  14. 将Feed 转义字符设置为 , \ "。

  15. 在 Feed 输出类型列表中，选择自定义以向 Feed 输出格式添加新字段。

  16. 复制并粘贴Feed 输出格式，然后根据需要添加新字段。确保键名称与实际字段名称一致。

  17. 以下是默认的Feed 输出格式：

    • SaaS 安全
    \{ "sourcetype" : "zscalernss-casb", "event" :\{"datetime":"%s{time}","recordid":"%d{recordid}","company":"%s{company}","tenant":"%s{tenant}","login":"%s{user}","dept":"%s{department}","applicationname":"%s{applicationname}","filename":"%s{filename}","filesource":"%s{filesource}","filemd5":"%s{filemd5}","threatname":"%s{threatname}","policy":"%s{policy}","dlpdictnames":"%s{dlpdictnames}","dlpdictcount":"%s{dlpdictcount}","dlpenginenames":"%s{dlpenginenames}","fullurl":"%s{fullurl}","lastmodtime":"%s{lastmodtime}","filescantimems":"%d{filescantimems}","filedownloadtimems":"%d{filedownloadtimems}"\}\}
    • SaaS 安全活动
    \{ "sourcetype" : "zscalernss-casb", "event" :\{"login":"%s{username}","tenant":"%s{tenant}","object_type":"%d{objtype1}","applicationname":"%s{appname}","object_name_1":"%s{objnames1}","object_name_2":"%s{objnames2}"\}\}

  18. 在时区列表中，为输出文件中的 Time 字段选择时区。默认情况下，时区会设为贵组织的时区。

  19. 查看已配置的设置。

  20. 点击保存以测试连接。如果连接成功，系统会显示一个绿色对勾标记，以及消息 Test Connectivity Successful: OK (200)。

如需详细了解 Google SecOps Feed，请参阅 Google SecOps Feed 文档。如需了解每种 Feed 类型的要求，请参阅按类型配置 Feed。

如果您在创建 Feed 时遇到问题，请与 Google SecOps 支持团队联系。

字段映射参考文档

字段映射参考：ZSCALER_CASB

下表列出了 ZSCALER_CASB 日志类型的日志字段及其对应的 UDM 字段。

Log field UDM mapping Logic
sourcetype security_result.detection_fields[sourcetype]
objnames2 about.resource.name
object_name_2 about.resource.name
objtypename2 about.resource.resource_subtype
externalownername additional.fields[externalownername]
act_cnt additional.fields[act_cnt]
attchcomponentfiletypes additional.fields[attchcomponentfiletypes]
channel_name additional.fields[channel_name]
collabscope additional.fields[collabscope]
day additional.fields[day]
dd additional.fields[dd]
dlpdictcount security_result.detection_fields[dlpdictcount] If the dlpdictcount log field value is not empty and the dlpdictcount log field value is not equal to None, then the dlpdictcount log field is mapped to the security_result.detection_fields.dlpdictcount UDM field.
dlpenginenames security_result.detection_fields[dlpenginenames] If the dlpenginenames log field value is not empty and the dlpenginenames log field value is not equal to None, then the dlpenginenames log field is mapped to the security_result.detection_fields.dlpenginenames UDM field.
epochlastmodtime additional.fields[epochlastmodtime]
extcollabnames additional.fields[extcollabnames]
extownername additional.fields[extownername]
file_msg_id additional.fields[file_msg_id]
fileid additional.fields[fileid]
filescantimems additional.fields[filescantimems]
filetypecategory additional.fields[filetypecategory]
hh additional.fields[hh]
messageid additional.fields[messageid]
mm additional.fields[mm]
mon additional.fields[mon]
msgsize additional.fields[msgsize]
mth additional.fields[mth]
num_ext_recpts additional.fields[num_ext_recpts]
num_int_recpts additional.fields[num_int_recpts]
numcollab additional.fields[numcollab]
rtime additional.fields[rtime]
ss additional.fields[ss]
suburl additional.fields[suburl]
tenant additional.fields[tenant]
tz additional.fields[tz]
upload_doctypename additional.fields[upload_doctypename]
yyyy additional.fields[yyyy]
collabnames additional.fields[collabnames]
companyid additional.fields[companyid]
component additional.fields[component]
intcollabnames additional.fields[intcollabnames] If intcollabnames log field value does not match the regular expression pattern None then, for index in intcollabnames, the index is mapped to the additional.fields.value.list_value UDM field.
internal_collabnames additional.fields[internal_collabnames]
external_collabnames additional.fields[externalcollabnames]
num_external_collab additional.fields[num_external_collab]
num_internal_collab additional.fields[num_internal_collab]
repochtime additional.fields[repochtime]
eventtime metadata.event_timestamp If the eventtime log field value is not empty, then the eventtime log field is mapped to the metadata.event_timestamp UDM field.
epochtime metadata.event_timestamp If the epochtime log field value is not empty, then the epochtime log field is mapped to the metadata.event_timestamp UDM field.
time metadata.event_timestamp If the time log field value is not empty, then the time log field is mapped to the metadata.event_timestamp UDM field.
datetime metadata.event_timestamp If the datetime log field value is not empty, then the datetime log field is mapped to the metadata.event_timestamp UDM field.
metadata.event_type The metadata.event_type UDM field is set to USER_UNCATEGORIZED.
act_type_name metadata.product_event_type
recordid metadata.product_log_id
metadata.product_name The metadata.product_name UDM field is set to CASB.
metadata.vendor_name The metadata.vendor_name UDM field is set to Zscaler.
sender network.email.from If the sender log field value matches the regular expression pattern (^.*@.*$), then the sender log field is mapped to the network.email.from UDM field.
extrecptnames network.email.to For index in extrecptnames, the index is mapped to the network.email.to UDM field.
internal_recptnames network.email.to For index in internal_recptnames, the index is mapped to the network.email.to UDM field.
external_recptnames network.email.to For index in external_recptnames, the index is mapped to the network.email.to UDM field.
intrecptnames network.email.to For index in intrecptnames, the index is mapped to the network.email.to UDM field.
applicationname principal.application If the applicationname log field value is not empty, then the applicationname log field is mapped to the principal.application UDM field.

Else, the appname log field is mapped to the principal.application UDM field.
src_ip principal.ip
fullurl principal.url If the fullurl log field is not empty and the fullurl log field value is not equal to Unknown URL, then the fullurl log field is mapped to the principal.url UDM field.
is_admin_act principal.user.attribute.labels[is_admin_act]
principal.user.attribute.roles.type If the is_admin_act log field value is equal to 1, then the principal.user.attribute.roles.type UDM field is set to ADMINISTRATOR.
company principal.user.company_name
department principal.user.department
dept principal.user.department
user principal.user.email_addresses If the user log field value matches the regular expression pattern (^.*@.*$), then the user log field is mapped to the principal.user.email_addresses UDM field.
username principal.user.email_addresses If the username log field value matches the regular expression pattern (^.*@.*$), then the username log field is mapped to the principal.user.email_addresses UDM field.
owner principal.user.email_addresses If the owner log field value matches the regular expression pattern (^.*@.*$), then the owner log field is mapped to the principal.user.email_addresses UDM field.
login principal.user.email_addresses If the login log field value matches the regular expression pattern (^.*@.*$), then the login log field is mapped to the principal.user.email_addresses UDM field.
login principal.user.userid If the login log field value does not match the regular expression pattern ^.+@.+$, then the login log field is mapped to the principal.user.userid UDM field.
malware security_result.associations.name
security_result.associations.type If the malware log field value is not empty, then the security_result.associations.type UDM field is set to MALWARE.
dlpdictnames security_result.detection_fields[dlpdictnames]
dlpidentifier security_result.detection_fields[dlpidentifier]
filedownloadtimems additional.fields[filedownloadtimems]
malwareclass security_result.detection_fields[malwareclass]
msgid security_result.detection_fields[msgid]
oattchcomponentfilenames security_result.detection_fields[oattchcomponentfilenames]
obucketname security_result.detection_fields[obucketname]
obucketowner security_result.detection_fields[obucketowner]
ochannel_name security_result.detection_fields[ochannel_name]
ocollabnames security_result.detection_fields[ocollabnames]
odlpdictnames security_result.detection_fields[odlpdictnames]
odlpenginenames security_result.detection_fields[odlpenginenames]
oextcollabnames security_result.detection_fields[oextcollabnames]
oexternal_collabnames security_result.detection_fields[oexternal_collabnames]
oexternal_recptnames security_result.detection_fields[oexternal_recptnames]
oexternalownername security_result.detection_fields[oexternalownername]
oextownername security_result.detection_fields[oextownername]
oextrecptnames security_result.detection_fields[oextrecptnames]
ofile_msg_id security_result.detection_fields[ofile_msg_id]
ofileid security_result.detection_fields[ofileid]
ofullurl security_result.detection_fields[ofullurl]
ohostname security_result.detection_fields[ohostname]
ointcollabnames security_result.detection_fields[ointcollabnames]
ointernal_collabnames security_result.detection_fields[ointernal_collabnames]
ointernal_recptnames security_result.detection_fields[ointernal_recptnames]
ointrecptnames security_result.detection_fields[ointrecptnames]
omessageid security_result.detection_fields[omessageid]
omsgid security_result.detection_fields[omsgid]
oowner security_result.detection_fields[oowner]
orulelabel security_result.detection_fields[orulelabel]
osender security_result.detection_fields[osender]
osharedchannel_hostname security_result.detection_fields[osharedchannel_hostname]
otenant security_result.detection_fields[otenant]
ouser security_result.detection_fields[ouser]
any_incident security_result.detection_fields[any_incident]
is_inbound security_result.detection_fields[is_inbound]
policy security_result.rule_labels[policy]
ruletype security_result.rule_labels[ruletype]
rulelabel security_result.rule_name
security_result.severity If the severity log field value is equal to High, then the security_result.severity UDM field is set to HIGH.

Else, if the severity log field value is equal to Medium, then the security_result.severity UDM field is set to MEDIUM.

Else, if the severity log field value is equal to Low, then the security_result.sevrity UDM field is set to LOW.

Else, if the severity log field value is equal to Information, then the security_result.severity UDM field is set to INFORMATIONAL.
threatname security_result.threat_name If the threatname log field value is not empty and the dlpdictcount log field value is not equal to None, then the threatname log field is mapped to the security_result.threat_name UDM field.
filesource target.file.full_path If the filesource log field value is not empty, then the filesource log field is mapped to the target.file.full_path UDM field.
filepath target.file.full_path If the filesource log field value is not empty, then the filesource log field is mapped to the target.file.full_path UDM field.

Else if the filepath log field value is not empty, then the filepath log field is mapped to the target.file.full_path UDM field.
lastmodtime target.file.last_modification_time If the lastmodtime log field value is not empty, then the lastmodtime log field is mapped to the target.file.last_modification_time UDM field.
file_msg_mod_time target.file.last_modification_time If the lastmodtime log field value is not empty, then the lastmodtime log field is mapped to the target.file.last_modification_time UDM field.

Else if the file_msg_mod_time log field value is not empty, then the file_msg_mod_time log field is mapped to the target.file.fullpath UDM field.
filemd5 target.file.md5 If the filemd5 log field value is not equal to None and the filemd5 log field value matches the regular expression pattern ^[a-fA-F0-9]{32}$, then the filemd5 log field is mapped to the target.file.md5 UDM field.

Else, if the attchcomponentmd5s log field value matches the regular expression pattern ^[a-fA-F0-9]{32}$, then the attchcomponentmd5s log field is mapped to the target.file.md5 UDM field.
filetypename target.file.mime_type
filename target.file.names
attchcomponentfilenames target.file.names
sha target.file.sha256
attchcomponentfilesizes target.file.size If the attchcomponentfilesizes log field value is not empty, then the attchcomponentfilesizes log field is mapped to the target.file.size UDM field.
filesize target.file.size If the attchcomponentfilesizes log field value is not empty, then the attchcomponentfilesizes log field is mapped to the target.file.size UDM field.

Else if the filesize log field value is not empty, then the filesize log field is mapped to the target.file.size UDM field.
sharedchannel_hostname target.hostname If the hostname log field value is not empty, then the hostname log field is mapped to the target.hostname UDM field.

Else if the sharedchannel_hostname log field value is not empty, then the sharedchannel_hostname log field is mapped to the target.hostname UDM field.
hostname target.hostname If the hostname log field value is not empty, then the hostname log field is mapped to the target.hostname UDM field.
datacentercity target.location.city
datacentercountry target.location.country_or_region
datacenter target.location.name
bucketowner target.resource.attribute.labels[bucketowner]
projectname target.resource.attribute.labels[projectname]
bucketname target.resource.name If the bucketname log field value is not empty, then the bucketname log field is mapped to the target.resource.name UDM field.
objnames1 target.resource.name If the objnames1 log field value is not empty, then the objnames1 log field is mapped to the target.resource.name UDM field.
objectname target.resource.name If the objectname log field value is not empty, then the objectname log field is mapped to the target.resource.name UDM field.
reponame target.resource.name If the reponame log field value is not empty, then the reponame log field is mapped to the target.resource.name UDM field.
object_name_1 target.resource.name If the object_name_1 log field value is not empty, then the object_name_1 log field is mapped to the target.resource.name UDM field.
bucketid target.resource.product_object_id
objtypename1 target.resource.resource_subtype If the objtypename1 log field value is not empty, then the objtypename1 log field is mapped to the target.resource.resource_subtype UDM field.
objecttype target.resource.resource_subtype If the objecttype log field value is not empty, then the objecttype log field is mapped to the target.resource.resource_subtype UDM field.
object_type target.resource.resource_subtype
target.resource.resource_type If the bucketname log field value is not empty, then the target.resource.resource_type UDM field is set to STORAGE_BUCKET.

If the reponame log field value is not empty, then the target.resource.resource_type UDM field is set to REPOSITORY.

后续步骤

需要更多帮助？向社区成员和 Google SecOps 专业人士寻求解答。