Entitas memberikan konteks pada peristiwa jaringan yang biasanya tidak menampilkan semua informasi yang diketahui tentang sistem yang terhubung dengannya. Misalnya, meskipun peristiwa PROCESS_LAUNCH mungkin ditautkan ke pengguna (abc@foo.corp) yang meluncurkan proses shady.exe, peristiwa PROCESS_LAUNCH tidak akan menunjukkan bahwa pengguna (abc@foo.corp) adalah karyawan yang baru-baru ini diberhentikan dalam proyek yang sangat sensitif. Konteks ini biasanya hanya diberikan oleh riset lebih lanjut yang dilakukan oleh analis keamanan.
Model data entitas memungkinkan Anda menyerap jenis hubungan entitas ini, sehingga memberikan data intelijen ancaman IOC yang lebih kaya dan lebih terfokus. Selain itu, pesan Izin, Peran, Kerentanan, dan Resource diperkenalkan dan diperluas untuk mencakup konteks baru yang tersedia dari IAM, sistem pengelolaan kerentanan, dan sistem perlindungan data.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eThe entity data model allows for the ingestion of entity relationships, enriching threat intelligence data and providing more context to network events.\u003c/p\u003e\n"],["\u003cp\u003eThe entity data model enhances Permission, Role, Vulnerability, and Resource messages to capture context from IAM, vulnerability management, and data protection systems.\u003c/p\u003e\n"],["\u003cp\u003eVarious default parsers and API feeds are supported to ingest asset or user context data, including Azure AD, Google Cloud IAM, Microsoft AD, and more.\u003c/p\u003e\n"],["\u003cp\u003eThe Ingestion API can be used to directly ingest entity data into a Google Security Operations account.\u003c/p\u003e\n"]]],[],null,["# Ingest data using the entity data model\n=======================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nEntities provide context to network events which typically do not surface all the information known about the systems they connect to. For example, while a PROCESS_LAUNCH event might be linked to a user (abc@foo.corp) who launched the shady.exe process, the PROCESS_LAUNCH event won't indicate that the user (abc@foo.corp) was a recently-terminated employee on a highly-sensitive project. This context would normally only be provided by further research conducted by a security analyst.\n\nThe entity data model enables you to ingest these types of entity relationships, providing a richer and more focused IOC threat intelligence data. It also introduces and expands the Permission, Role, Vulnerability, and Resource messages to capture new context available from IAM, vulnerability management systems, and data protection systems.\n\nFor details on the entity data model syntax, see the [Entity Data Model Reference](/chronicle/docs/reference/udm-field-list#udm_entity_data_model) documentation.\n\n### Default parsers\n\nThe following [default parsers](/chronicle/docs/reference/default-parsers)\nand [API feeds](/chronicle/docs/reference/chronicle-api-feeds) support the\ningestion of asset or user context data:\n\n- Azure AD Organizational Context\n- Duo User Context\n- Google Cloud IAM Analysis\n- Google Cloud IAM Context\n- Google Cloud Identity Context\n- JAMF\n- Microsoft AD\n- Microsoft Defender for Endpoint\n- Nucleus Unified Vulnerability Management\n- Nucleus Asset Metadata\n- Okta User Context\n- Rapid7 Insight\n- SailPoint IAM\n- ServiceNow CMDB\n- Tanium Asset\n- Workday\n- Workspace ChromeOS Devices\n- Workspace Mobile Devices\n- Workspace Privileges\n- Workspace Users\n\nIngestion API\n-------------\n\nUse the Ingestion API to ingest entity data into your Google Security Operations account directly.\n\nSee the [Ingestion API](/chronicle/docs/reference/ingestion-api) documentation.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
