As entidades fornecem contexto para eventos de rede que normalmente não mostram todas as informações conhecidas sobre os sistemas a que se conectam. Por exemplo, embora um evento PROCESS_LAUNCH possa estar vinculado a um usuário (abc@foo.corp) que iniciou o processo shady.exe, ele não indica que o usuário (abc@foo.corp) era um funcionário demitido recentemente em um projeto altamente sensível. Normalmente, esse contexto só é fornecido por mais pesquisas realizadas por um analista de segurança.
Com o modelo de dados de entidade, é possível ingerir esses tipos de relacionamentos de entidade, fornecendo dados de inteligência de ameaças de IOC mais ricos e focados. Ele também apresenta e expande as mensagens de permissão, função, vulnerabilidade e recurso para capturar novos contextos disponíveis no IAM, em sistemas de gerenciamento de vulnerabilidades e em sistemas de proteção de dados.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThe entity data model allows for the ingestion of entity relationships, enriching threat intelligence data and providing more context to network events.\u003c/p\u003e\n"],["\u003cp\u003eThe entity data model enhances Permission, Role, Vulnerability, and Resource messages to capture context from IAM, vulnerability management, and data protection systems.\u003c/p\u003e\n"],["\u003cp\u003eVarious default parsers and API feeds are supported to ingest asset or user context data, including Azure AD, Google Cloud IAM, Microsoft AD, and more.\u003c/p\u003e\n"],["\u003cp\u003eThe Ingestion API can be used to directly ingest entity data into a Google Security Operations account.\u003c/p\u003e\n"]]],[],null,["# Ingest data using the entity data model\n=======================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nEntities provide context to network events which typically do not surface all the information known about the systems they connect to. For example, while a PROCESS_LAUNCH event might be linked to a user (abc@foo.corp) who launched the shady.exe process, the PROCESS_LAUNCH event won't indicate that the user (abc@foo.corp) was a recently-terminated employee on a highly-sensitive project. This context would normally only be provided by further research conducted by a security analyst.\n\nThe entity data model enables you to ingest these types of entity relationships, providing a richer and more focused IOC threat intelligence data. It also introduces and expands the Permission, Role, Vulnerability, and Resource messages to capture new context available from IAM, vulnerability management systems, and data protection systems.\n\nFor details on the entity data model syntax, see the [Entity Data Model Reference](/chronicle/docs/reference/udm-field-list#udm_entity_data_model) documentation.\n\n### Default parsers\n\nThe following [default parsers](/chronicle/docs/reference/default-parsers)\nand [API feeds](/chronicle/docs/reference/chronicle-api-feeds) support the\ningestion of asset or user context data:\n\n- Azure AD Organizational Context\n- Duo User Context\n- Google Cloud IAM Analysis\n- Google Cloud IAM Context\n- Google Cloud Identity Context\n- JAMF\n- Microsoft AD\n- Microsoft Defender for Endpoint\n- Nucleus Unified Vulnerability Management\n- Nucleus Asset Metadata\n- Okta User Context\n- Rapid7 Insight\n- SailPoint IAM\n- ServiceNow CMDB\n- Tanium Asset\n- Workday\n- Workspace ChromeOS Devices\n- Workspace Mobile Devices\n- Workspace Privileges\n- Workspace Users\n\nIngestion API\n-------------\n\nUse the Ingestion API to ingest entity data into your Google Security Operations account directly.\n\nSee the [Ingestion API](/chronicle/docs/reference/ingestion-api) documentation.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
