收集 Zscaler VPN 記錄

本文說明如何設定 Bindplane 代理程式來匯出 Zscaler VPN 記錄，以及記錄欄位如何對應至 Google SecOps Unified Data Model (UDM) 欄位。

詳情請參閱「將資料擷取至 Google SecOps 總覽」。

一般部署作業包含 Zscaler VPN 和 Bindplane 代理程式，後者會設定為將記錄傳送至 Google SecOps。每個客戶的部署作業可能有所不同，也可能更複雜。

部署作業包含下列元件：

• Zscaler VPN：您從中收集記錄的平台。

• Bindplane 代理程式：Bindplane 代理程式會從 Zscaler VPN 擷取記錄，並將記錄傳送至 Google SecOps。

• Google SecOps：保留及分析記錄檔。

擷取標籤會識別剖析器，該剖析器會將原始記錄資料正規化為具結構性的 UDM 格式。本文件中的資訊適用於標示 ZSCALER_VPN 的剖析器。

事前準備

• 確認您可以存取 Zscaler Private Access 控制台。詳情請參閱安全私人存取 (ZPA) 說明。
• 請確認你使用的是 Zscaler VPN 2024 以上版本。
• 請確保部署架構中的所有系統都已設定為世界標準時間時區。

在 Zscaler Private Access 中設定記錄接收器

如要在 Zscaler Private Access 中設定及管理記錄接收器，請按照下列步驟操作：

新增記錄接收器

1. 依序前往「設定與控制」>「私人基礎架構」>「記錄串流服務」>「記錄接收器」。
2. 按一下「新增記錄接收者」。
3. 在「記錄接收器」分頁中，執行下列操作：
   1. 在「Name」(名稱) 欄位中，輸入記錄接收器的名稱。
   2. 在「Description」(說明) 欄位中輸入說明。
   3. 在「網域或 IP 位址」欄位中，輸入記錄接收器的完整網域名稱 (FQDN) 或 IP 位址。
   4. 在「TCP Port」(TCP 通訊埠) 欄位中，輸入記錄接收器使用的 TCP 通訊埠編號。
   5. 在「TLS 加密」中選取加密類型，即可啟用或停用應用程式連接器與記錄接收器之間的流量加密功能。這項設定預設為停用。
   6. 從「App Connector groups」(應用程式連線群組) 清單中，選取可將記錄轉送至接收端的應用程式連線群組，然後按一下「Done」(完成)。
   7. 點選「下一步」。

4. 在「記錄串流」分頁中，執行下列操作：

   1. 從選單中選取「記錄類型」。
   2. 從選單中選取「記錄範本」。

   3. 複製並貼上「記錄串流內容」，然後新增欄位。確認鍵名與實際欄位名稱相符。

      以下是各記錄類型的預設「記錄串流內容」設定：

      • 使用者活動：

        {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"ConnectionID": %j{ConnectionID},"InternalReason": %j{InternalReason},"ConnectionStatus": %j{ConnectionStatus},"IPProtocol": %d{IPProtocol},"DoubleEncryption": %d{DoubleEncryption},"Username": %j{Username},"ServicePort": %d{ServicePort},"ClientPublicIP": %j{ClientPublicIP},"ClientPrivateIP": %j{ClientPrivateIP},"ClientLatitude": %f{ClientLatitude},"ClientLongitude": %f{ClientLongitude},"ClientCountryCode": %j{ClientCountryCode},"ClientZEN": %j{ClientZEN},"Policy": %j{Policy},"Connector": %j{Connector},"ConnectorZEN": %j{ConnectorZEN},"ConnectorIP": %j{ConnectorIP},"ConnectorPort": %d{ConnectorPort},"Host": %j{Host},"Application": %j{Application},"AppGroup": %j{AppGroup},"Server": %j{Server},"ServerIP": %j{ServerIP},"ServerPort": %d{ServerPort},"PolicyProcessingTime": %d{PolicyProcessingTime},"ServerSetupTime": %d{ServerSetupTime},"TimestampConnectionStart": %j{TimestampConnectionStart:iso8601},"TimestampConnectionEnd": %j{TimestampConnectionEnd:iso8601},"TimestampCATx": %j{TimestampCATx:iso8601},"TimestampCARx": %j{TimestampCARx:iso8601},"TimestampAppLearnStart": %j{TimestampAppLearnStart:iso8601},"TimestampZENFirstRxClient": %j{TimestampZENFirstRxClient:iso8601},"TimestampZENFirstTxClient": %j{TimestampZENFirstTxClient:iso8601},"TimestampZENLastRxClient": %j{TimestampZENLastRxClient:iso8601},"TimestampZENLastTxClient": %j{TimestampZENLastTxClient:iso8601},"TimestampConnectorZENSetupComplete": %j{TimestampConnectorZENSetupComplete:iso8601},"TimestampZENFirstRxConnector": %j{TimestampZENFirstRxConnector:iso8601},"TimestampZENFirstTxConnector": %j{TimestampZENFirstTxConnector:iso8601},"TimestampZENLastRxConnector": %j{TimestampZENLastRxConnector:iso8601},"TimestampZENLastTxConnector": %j{TimestampZENLastTxConnector:iso8601},"ZENTotalBytesRxClient": %d{ZENTotalBytesRxClient},"ZENBytesRxClient": %d{ZENBytesRxClient},"ZENTotalBytesTxClient": %d{ZENTotalBytesTxClient},"ZENBytesTxClient": %d{ZENBytesTxClient},"ZENTotalBytesRxConnector": %d{ZENTotalBytesRxConnector},"ZENBytesRxConnector": %d{ZENBytesRxConnector},"ZENTotalBytesTxConnector": %d{ZENTotalBytesTxConnector},"ZENBytesTxConnector": %d{ZENBytesTxConnector},"Idp": %j{Idp},"ClientToClient": %j{c2c},"ClientCity": %j{ClientCity},"MicroTenantID": %j{MicroTenantID},"AppMicroTenantID": %j{AppMicroTenantID}}\n
        

      • 使用者狀態：

        {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"Username": %j{Username},"SessionID": %j{SessionID},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"ZEN": %j{ZEN},"CertificateCN": %j{CertificateCN},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"Idp": %j{Idp},"Hostname": %j{Hostname},"Platform": %j{Platform},"ClientType": %j{ClientType},"TrustedNetworks": [%j(,){TrustedNetworks}],"TrustedNetworksNames": [%j(,){TrustedNetworksNames}],"SAMLAttributes": %j{SAMLAttributes},"PosturesHit": [%j(,){PosturesHit}],"PosturesMiss": [%j(,){PosturesMiss}],"ZENLatitude": %f{ZENLatitude},"ZENLongitude": %f{ZENLongitude},"ZENCountryCode": %j{ZENCountryCode},"FQDNRegistered": %j{fqdn_registered},"FQDNRegisteredError": %j{fqdn_register_error},"City": %j{City},"MicroTenantID": %j{MicroTenantID}}\n
        

      • 瀏覽器存取權：

        {"LogTimestamp":%j{LogTimestamp:time},"ConnectionID":%j{ConnectionID},"Exporter":%j{Exporter},"TimestampRequestReceiveStart":%j{TimestampRequestReceiveStart:iso8601},"TimestampRequestReceiveHeaderFinish":%j{TimestampRequestReceiveHeaderFinish:iso8601},"TimestampRequestReceiveFinish":%j{TimestampRequestReceiveFinish:iso8601},"TimestampRequestTransmitStart":%j{TimestampRequestTransmitStart:iso8601},"TimestampRequestTransmitFinish":%j{TimestampRequestTransmitFinish:iso8601},"TimestampResponseReceiveStart":%j{TimestampResponseReceiveStart:iso8601},"TimestampResponseReceiveFinish":%j{TimestampResponseReceiveFinish:iso8601},"TimestampResponseTransmitStart":%j{TimestampResponseTransmitStart:iso8601},"TimestampResponseTransmitFinish":%j{TimestampResponseTransmitFinish:iso8601},"TotalTimeRequestReceive":%d{TotalTimeRequestReceive},"TotalTimeRequestTransmit":%d{TotalTimeRequestTransmit},"TotalTimeResponseReceive":%d{TotalTimeResponseReceive},"TotalTimeResponseTransmit":%d{TotalTimeResponseTransmit},"TotalTimeConnectionSetup":%d{TotalTimeConnectionSetup},"TotalTimeServerResponse":%d{TotalTimeServerResponse},"Method":%j{Method},"Protocol":%j{Protocol},"Host":%j{Host},"URL":%j{URL},"UserAgent":%j{UserAgent},"XFF":%j{XFF},"NameID":%j{NameID},"StatusCode":%d{StatusCode},"RequestSize":%d{RequestSize},"ResponseSize":%d{ResponseSize},"ApplicationPort":%d{ApplicationPort},"ClientPublicIp":%j{ClientPublicIp},"ClientPublicPort":%d{ClientPublicPort},"ClientPrivateIp":%j{ClientPrivateIp},"Customer":%j{Customer},"ConnectionStatus":%j{ConnectionStatus},"ConnectionReason":%j{ConnectionReason},"Origin":%j{Origin},"CorsToken":%j{CorsToken}}\n
        

      • Private Service Edge 狀態：

        {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"PackageVersion": %j{PackageVersion},"Platform": %j{Platform},"ZEN": %j{ZEN},"ServiceEdge": %j{ServiceEdge},"ServiceEdgeGroup": %j{ServiceEdgeGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostUpTime": %j{HostUpTime},"ServiceEdgeStartTime": %j{ServiceEdgeStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n
        

      • 應用程式連接器狀態：

        {"LogTimestamp": %j{LogTimestamp:time},"Customer": %j{Customer},"SessionID": %j{SessionID},"SessionType": %j{SessionType},"SessionStatus": %j{SessionStatus},"Version": %j{Version},"Platform": %j{Platform},"ZEN": %j{ZEN},"Connector": %j{Connector},"ConnectorGroup": %j{ConnectorGroup},"PrivateIP": %j{PrivateIP},"PublicIP": %j{PublicIP},"Latitude": %f{Latitude},"Longitude": %f{Longitude},"CountryCode": %j{CountryCode},"TimestampAuthentication": %j{TimestampAuthentication:iso8601},"TimestampUnAuthentication": %j{TimestampUnAuthentication:iso8601},"CPUUtilization": %d{CPUUtilization},"MemUtilization": %d{MemUtilization},"ServiceCount": %d{ServiceCount},"InterfaceDefRoute": %j{InterfaceDefRoute},"DefRouteGW": %j{DefRouteGW},"PrimaryDNSResolver": %j{PrimaryDNSResolver},"HostStartTime": %j{HostStartTime},"ConnectorStartTime": %j{ConnectorStartTime},"NumOfInterfaces": %d{NumOfInterfaces},"BytesRxInterface": %d{BytesRxInterface},"PacketsRxInterface": %d{PacketsRxInterface},"ErrorsRxInterface": %d{ErrorsRxInterface},"DiscardsRxInterface": %d{DiscardsRxInterface},"BytesTxInterface": %d{BytesTxInterface},"PacketsTxInterface": %d{PacketsTxInterface},"ErrorsTxInterface": %d{ErrorsTxInterface},"DiscardsTxInterface": %d{DiscardsTxInterface},"TotalBytesRx": %d{TotalBytesRx},"TotalBytesTx": %d{TotalBytesTx},"MicroTenantID": %j{MicroTenantID}}\n
        

   4. 在「SAML 屬性」中，按一下「選取 IdP」，然後選取要納入政策的 IdP 設定。

   5. 在「應用程式區隔」選單中，選取要加入的應用程式區隔，然後按一下「完成」。

   6. 在「區隔群組」選單中，選取要加入的區隔群組，然後按一下「完成」。

   7. 在「用戶端類型」選單中，選取要納入的用戶端類型，然後按一下「完成」。

   8. 在「工作階段狀態」選單中，選取要排除的工作階段狀態代碼，然後按一下「完成」。

   9. 點選「下一步」。

5. 在「檢閱」分頁中，檢查記錄接收器設定，然後按一下「儲存」。

注意：ZSCALER_VPN Gold 剖析器僅支援 JSON 記錄格式，因此設定記錄串流時，請務必從選單中選取「JSON」做為「記錄範本」。

複製記錄接收器

1. 依序前往「Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 在表格中找出要修改的記錄接收者，然後按一下「複製」。
3. 在「新增記錄接收器」視窗中，視需要修改欄位。如要進一步瞭解各個欄位，請參閱「新增記錄接收端」一節中的程序。
4. 按一下 [儲存]。

編輯記錄接收器

1. 依序前往「Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 在表格中找出要修改的記錄接收器，然後按一下「編輯」。
3. 在「編輯記錄接收器」視窗中，視需要修改欄位。如要進一步瞭解各個欄位，請參閱「新增記錄接收端」一節中的程序。
4. 按一下 [儲存]。

刪除記錄接收器

1. 依序前往「Control」>「Private Infrastructure」>「Log Streaming Service」>「Log Receivers」。
2. 在表格中找出要修改的記錄接收者，然後按一下「刪除」。
3. 在「確認」視窗中，按一下「刪除」。

使用 Bindplane 代理程式將記錄轉送至 Google SecOps

1. 安裝並設定 Linux 虛擬機器。
2. 在 Linux 上安裝及設定 Bindplane 代理程式，將記錄轉寄至 Google SecOps。如要進一步瞭解如何安裝及設定 Bindplane 代理程式，請參閱 Bindplane 代理程式安裝及設定操作說明。

如果在建立動態饋給時遇到問題，請與 Google SecOps 支援團隊聯絡。

支援的 Zscaler VPN 記錄格式

Zscaler VPN 剖析器支援 JSON 格式的記錄。

支援的 Zscaler VPN 記錄範例

• JSON：

  {
    "LogTimestamp": "Thu Jan 18 10:31:01 2024",
    "Customer": "ABC Group",
    "SessionID": "session-id",
    "ConnectionID": "session-id,connection-id",
    "InternalReason": "OPEN_OR_ACTIVE_CONNECTION",
    "ConnectionStatus": "open",
    "IPProtocol": 6,
    "DoubleEncryption": 0,
    "Username": "bc@myownpersonaldomain.com",
    "ServicePort": 443,
    "ClientPublicIP": "198.51.100.0",
    "ClientPrivateIP": "198.51.100.0",
    "ClientLatitude": 51.000000,
    "ClientLongitude": 0.000000,
    "ClientCountryCode": "GB",
    "ClientZEN": "EU-GB-9900",
    "Policy": "RG-NAC-IT",
    "Connector": "abc.mc.local",
    "ConnectorZEN": "EU-GB-9900",
    "ConnectorIP": "198.51.100.0",
    "ConnectorPort": 51146,
    "Host": "xyz.io",
    "Application": "blabla",
    "AppGroup": "HB App Segments",
    "Server": "0",
    "ServerIP": "198.51.100.0",
    "ServerPort": 443,
    "PolicyProcessingTime": 63,
    "ServerSetupTime": 13069,
    "TimestampConnectionStart": "2024-01-18T10:31:01.152Z",
    "TimestampConnectionEnd": "",
    "TimestampCATx": "",
    "TimestampCARx": "2024-01-18T10:31:01.152Z",
    "TimestampAppLearnStart": "",
    "TimestampZENFirstRxClient": "",
    "TimestampZENFirstTxClient": "",
    "TimestampZENLastRxClient": "",
    "TimestampZENLastTxClient": "",
    "TimestampConnectorZENSetupComplete": "2024-01-18T10:31:01.172Z",
    "TimestampZENFirstRxConnector": "",
    "TimestampZENFirstTxConnector": "2024-01-18T10:31:01.172Z",
    "TimestampZENLastRxConnector": "",
    "TimestampZENLastTxConnector": "2024-01-18T10:31:01.172Z",
    "ZENTotalBytesRxClient": 710,
    "ZENBytesRxClient": 710,
    "ZENTotalBytesTxClient": 0,
    "ZENBytesTxClient": 0,
    "ZENTotalBytesRxConnector": 0,
    "ZENBytesRxConnector": 0,
    "ZENTotalBytesTxConnector": 0,
    "ZENBytesTxConnector": 0,
    "Idp": "Azure IdP Config",
    "ClientToClient": "0",
    "ClientCity": "Thamesmead",
    "MicroTenantID": "0",
    "AppMicroTenantID": "0"
  }
  

欄位對應參考資料

欄位對應參考資料：ZSCALER_VPN

下表列出 ZSCALER_VPN 記錄類型的記錄欄位，以及對應的 UDM 欄位。

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。