Anda dapat menggunakan Google Security Operations untuk menelusuri log mentah di akun Google SecOps Anda dan mendapatkan konteks yang relevan dengan peristiwa dan entity terkait.
Penelusuran log mentah menunjukkan korelasi antara peristiwa mentah dan peristiwa UDM yang dihasilkan menggunakan log mentah tersebut. Pencarian log mentah membantu Anda memahami cara kolom log diuraikan dan dinormalisasi serta membantu Anda menyelidiki setiap kesenjangan dalam proses normalisasi.
Setelah Anda menyelesaikan penelusuran log mentah, setiap baris log mentah yang cocok akan diganti dengan
peristiwa dan entitas yang terdapat dalam baris log. Jumlah peristiwa dan
entitas yang diekstrak dari setiap baris log dibatasi hingga maksimum 10.
Untuk melakukan penelusuran log mentah, ikuti langkah-langkah berikut:
Buka Investigasi > Penelusuran SIEM.
Di kolom penelusuran, tambahkan awalan raw = ke penelusuran Anda dan
sertakan istilah penelusuran dalam tanda petik (misalnya, raw =
"example.com").
Pilih penelusuran log mentah dari opsi menu. Google SecOps menemukan log mentah terkait, peristiwa UDM, dan entitas terkait. Anda juga dapat menjalankan penelusuran yang sama (raw = "example.com") dari halaman Penelusuran UDM.
Anda dapat menggunakan filter cepat yang sama dengan yang digunakan untuk menyaring hasil penelusuran UDM. Pilih filter yang ingin Anda terapkan ke hasil log mentah untuk menyaringnya lebih lanjut.
Mengoptimalkan kueri log mentah
Penelusuran log mentah biasanya lebih lambat daripada penelusuran UDM. Untuk meningkatkan performa penelusuran, batasi jumlah data yang Anda kueri dengan mengubah setelan penelusuran:
Pemilih rentang waktu: Membatasi rentang waktu data yang digunakan untuk menjalankan kueri.
Pemilih Sumber Log: Membatasi penelusuran log mentah Anda hanya ke log dari sumber tertentu, bukan semua sumber log Anda. Dari menu Sumber log, pilih satu atau beberapa sumber log (defaultnya adalah semua).
Ekspresi reguler: Gunakan ekspresi reguler. Misalnya, raw =
/goo\w{3}.com/
akan cocok dengan google.com, goodle.com,
goog1e.com untuk lebih
membatasi cakupan penelusuran log mentah Anda.
Tren dari waktu ke waktu
Gunakan grafik tren untuk memahami distribusi log mentah selama waktu penelusuran Anda. Anda dapat menerapkan filter pada grafik untuk mencari log yang diuraikan dan log mentah.
Hasil log mentah
Saat Anda menjalankan penelusuran log mentah, hasilnya adalah kombinasi peristiwa UDM dan
entitas yang dihasilkan oleh log mentah yang cocok dengan penelusuran Anda, beserta
log mentah. Anda dapat menjelajahi hasil penelusuran lebih lanjut dengan mengklik salah satu hasil:
Peristiwa atau entitas UDM: Jika Anda mengklik peristiwa atau entitas UDM, Google SecOps akan menampilkan peristiwa dan entitas terkait, beserta log mentah yang terkait dengan item tersebut.
Log mentah: Jika Anda mengklik log mentah, Google SecOps akan menampilkan seluruh baris log mentah, beserta sumber log tersebut.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eRaw log searches in Google Security Operations allow users to examine raw logs and their correlation with UDM events and entities, aiding in understanding log normalization and identifying gaps.\u003c/p\u003e\n"],["\u003cp\u003eUsers can perform raw log searches by adding the prefix \u003ccode\u003eraw =\u003c/code\u003e to their search terms in the SIEM Search, or the UDM Search page, enclosed within quotation marks.\u003c/p\u003e\n"],["\u003cp\u003eTo optimize performance, users can limit the scope of raw log searches by adjusting the time range, selecting specific log sources, or using regular expressions.\u003c/p\u003e\n"],["\u003cp\u003eThe results of a raw log search display UDM events, entities, and the raw logs, which can be explored further to view related data or the complete log line and its source.\u003c/p\u003e\n"],["\u003cp\u003eThe number of events and entities extracted from each log line is limited to a maximum of 10.\u003c/p\u003e\n"]]],[],null,["Conduct a raw log search \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\n\u003cbr /\u003e\n\n| **Note:** This feature is not available to all customers in all regions.\n\n\u003cbr /\u003e\n\nYou can use Google Security Operations to search the raw logs in your\nGoogle SecOps account and get relevant context with related events and\nentities.\n\nRaw log searches show you the correlation between raw events and the\nUDM events generated using those raw logs. A raw log search helps you to\nunderstand how log fields are parsed and normalized and helps you to investigate\nany gaps in the normalization process.\n\nAfter you complete a raw log search, each matching raw log line is replaced with\nthe events and entities contained in the log line. The number of events and\nentities extracted from each log line is limited to a maximum of 10.\n\nTo perform a raw log search, follow these steps:\n\n1. Go to **Investigation \\\u003e SIEM Search**.\n\n2. In the search field, add the prefix `raw = ` to your search and\n enclose your search term in quotation marks (for example, `raw =\n \"example.com\"`).\n\n3. Select the raw log search from the menu option. Google SecOps finds the\n associated raw logs, UDM events, and associated entities. You can also run\n the same search (raw = \"example.com\") from the UDM Search page.\n\nYou can use the same quick filters used to refine UDM search results. Select the\nfilter you want to apply to the raw log results to refine them further.\n\nOptimize raw log queries\n\nRaw log searches are typically slower than UDM searches. To improve your search\nperformance, limit the amount of data you conduct your query over by changing\nthe search settings:\n\n- Time range selector: Limits the time range of the data over which you run your query.\n- Log Source selector: Limits your raw log search to only the logs from specific sources, as opposed to all of your log sources. From the **Log\n sources** menu, select one or more log sources (the default is **all**).\n- Regular expressions: Use a regular expression. For example, `raw =\n /goo\\w{3}.com/` would match against `google.com`, `goodle.com`, `goog1e.com` to further limit the scope of your raw log search.\n\nTrend over time\n\nUse the trend graph to understand the distribution of raw logs over the time of\nyour search. You can apply filters on the graph to look for parsed logs and\nraw logs.\n\nRaw log results\n\nWhen you run a raw log search, the results are a combination of UDM events and\nentities generated by the raw logs that match your searches, along with the\nraw logs. You can explore the search results further by clicking any of the\nresults:\n\n- UDM event or entity: If you click a UDM event or entity, Google SecOps\n shows any related events and entities, along with the raw log associated\n with that item.\n\n- Raw log: If you click a raw log, Google SecOps shows\n you the entire raw log line, along with the source for that log.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
