Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Com os registros de ameaças você pode auditar, verificar e analisar as ameaças detectadas na sua
rede.
Quando o Cloud Next Generation Firewall detecta uma ameaça no tráfego monitorado para inspeção da camada 7, ele gera uma entrada de registro no projeto de origem com os detalhes da ameaça. Para visualizar e examinar
os registros de ameaças, na Análise de registros,
pesquise o registro networksecurity.googleapis.com/firewall_threat.
Você também encontra esses registros na página Ameaças.
Nesta página, explicamos o formato e a estrutura dos registros de ameaças
gerados quando uma ameaça é detectada.
Formato do registro de ameaças
O Cloud NGFW cria uma entrada de registro
no Cloud Logging para cada ameaça detectada no
tráfego monitorado para ou de uma instância de máquina virtual (VM) em uma zona específica.
Os registros são incluídos no campo de payload JSON de um LogEntry.
Alguns campos de registro aparecem em um formato múltiplo, com mais de um dado em cada campo. Por exemplo, o campo connection tem o formato Connection,
que contém a porta e o endereço IP do servidor, o endereço IP
e a porta do cliente, além do número do protocolo em um único campo.
Confira na tabela a seguir o formato dos campos de registro de ameaças.
Os detalhes da rede de nuvem privada virtual (VPC) associada à instância de VM em que a ameaça é detectada.
Formato do campo Connection
Confira na tabela a seguir o formato do campo Connection.
Campo
Tipo
Descrição
clientIp
string
O endereço IP do cliente. Se o cliente for uma VM do Compute Engine, clientIp será o endereço de IP interno principal ou um endereço em um intervalo de IP de alias da interface de rede da VM. O endereço IP externo não é exibido. Os registros mostram o endereço IP da instância de VM, conforme observado no cabeçalho do pacote, de maneira semelhante ao despejo de TCP da instância de VM.
clientPort
integer
O número da porta do cliente.
serverIp
string
O endereço IP do servidor. Se o servidor for uma VM do Compute Engine, serverIp será o endereço de IP interno principal ou um endereço em um intervalo de IP de alias da interface de rede da VM. O endereço IP externo não é exibido, mesmo que seja usado para fazer a conexão.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2024-12-21 UTC."],[[["\u003cp\u003eThreat logs document threats detected by Cloud Next Generation Firewall (NGFW) during Layer 7 traffic inspection, creating log entries detailing the threat in the originating project, which can be viewed in the Logs Explorer or on the Threats page.\u003c/p\u003e\n"],["\u003cp\u003eEach threat log entry includes various fields such as \u003ccode\u003econnection\u003c/code\u003e, \u003ccode\u003eaction\u003c/code\u003e, and \u003ccode\u003ethreatDetails\u003c/code\u003e that provide a comprehensive description of the connection parameters, actions performed, and the specifics of the detected threat, respectively.\u003c/p\u003e\n"],["\u003cp\u003eThreat log fields like \u003ccode\u003eclientIp\u003c/code\u003e, \u003ccode\u003eclientPort\u003c/code\u003e, \u003ccode\u003eserverIp\u003c/code\u003e, \u003ccode\u003eserverPort\u003c/code\u003e, and \u003ccode\u003eprotocol\u003c/code\u003e, and \u003ccode\u003ethreatDetails\u003c/code\u003e contain fields such as the threat \u003ccode\u003eid\u003c/code\u003e, \u003ccode\u003ethreat\u003c/code\u003e, \u003ccode\u003edescription\u003c/code\u003e, \u003ccode\u003edirection\u003c/code\u003e, and \u003ccode\u003eseverity\u003c/code\u003e provide in depth insight on the traffic and threat found.\u003c/p\u003e\n"],["\u003cp\u003eThreat logs can be correlated with Firewall Rules Logging entries by comparing fields like source and destination IP addresses and ports to pinpoint the exact packet that triggered a threat.\u003c/p\u003e\n"],["\u003cp\u003eThe log entries for threats and firewall logs can be queried and filtered using specific parameters in the Logs Explorer, like IP addresses and ports, to examine potential threats in detail and take appropriate action.\u003c/p\u003e\n"]]],[],null,["# Threat logs let you audit, verify, and analyze the threats detected in your\nnetwork.\n\nWhen Cloud Next Generation Firewall detects a threat on the traffic being\nmonitored for Layer 7 inspection, it generates a log entry\nin the originating project with the details of the threat. To view and examine\nthe threat logs, in the [Logs Explorer](/logging/docs/view/logs-explorer-interface),\nsearch for the log `networksecurity.googleapis.com/firewall_threat`.\nYou can also view these threat logs on the [**Threats** page](/firewall/docs/view-threats).\n\nThis page explains the format and structure of the threat logs that are\ngenerated when a threat is detected.\n\nThreat log format\n-----------------\n\nCloud NGFW creates a log record entry\nin [Cloud Logging](/logging/docs/overview) for each threat detected on the\nmonitored traffic to or from a virtual machine (VM) instance in a specific zone.\nLog records are included in the JSON payload field of a\n[LogEntry](/logging/docs/reference/v2/rest/v2/LogEntry).\n\nSome log fields are in a multiple-field format, with more than one piece of data\nin a given field. For example, the `connection` field is of the `Connection`\nformat, which contains the server IP address and port, the client IP address\nand port, and the protocol number in a single field.\n\nThe following table describes the format of the threat log fields.\n\n### `Connection` field format\n\nThe following table describes the format of the `Connection` field.\n\n### `ThreatDetails` field format\n\nThe following table describes the format of the `ThreatDetails` field.\n\n### `SecurityProfileGroupDetails` field format\n\nThe following table describes the format of the `SecurityProfileGroupDetails`\nfield.\n\n### `VpcDetails` field format\n\nThe following table describes the format of the `VpcDetails` field.\n\n### `InterceptInstance` field format\n\nThe following table describes the format of the `InterceptInstance` field.\n\nThreat log correlation with a firewall log\n------------------------------------------\n\nWhen a packet matches a firewall rule with logging enabled,\nCloud NGFW logs a\n[Firewall Rules Logging](/firewall/docs/firewall-rules-logging) entry.\nThis entry includes fields such as the source IP address, the destination\nIP address, and the time of packet inspection.\nTo view these firewall rule logs, see\n[View logs](/firewall/docs/using-firewall-rules-logging#viewing_logs).\n\nIf you have a firewall policy rule for Layer 7 inspection with logging\nenabled, Cloud NGFW first logs the Firewall Rules Logging\nentry for the matched packet. Then, it sends the packet to the firewall\nendpoint for Layer 7 inspection.\nThe firewall endpoint analyzes the packet for threats. If a threat is detected,\na separate threat log is created. This threat log include fields such as\nthe type of threat, the source of the threat, and the destination of the threat.\nTo view threat logs, see\n[View threats](/firewall/docs/view-threats#view-threats).\n\nYou can compare the fields in the\n[firewall rule log](/firewall/docs/firewall-rules-logging#log-format)\nand [threat log](#log-format) to identify the packet that triggered the threat\nand take appropriate action to resolve it.\n\nFor example, you have a firewall policy rule configured with the following\nsettings:\n\n- Source IP address: `192.0.2.0`\n- Source port: `47644`\n- Destination IP address: `192.0.2.1`\n- Destination port: `80`\n- Logging: `Enabled`\n\nTo view the threat logs associated with this rule, navigate to\nthe **Logs Explorer** page. In the **Query** pane, paste the following\nquery into the query editor field.\n\n\u003cbr /\u003e\n\n```\n resource.type=\"networksecurity.googleapis.com/FirewallEndpoint\"\n jsonPayload.source_ip_address=\"192.0.2.0\"\n jsonPayload.source_port=\"47644\"\n jsonPayload.destination_ip_address=\"192.0.2.1\"\n jsonPayload.destination_port=\"80\"\n \n```\n\n\u003cbr /\u003e\n\nThe **Query results** section displays the following threat log:\n\n\u003cbr /\u003e\n\n```\n {\n insertId: \"0ac7f359-263f-4428-8ded-ac655d8a09db\"\n jsonPayload: {\n action: \"reset-server\"\n alert_severity: \"HIGH\"\n alert_time: \"2023-11-28T19:07:15Z\"\n category: \"info-leak\"\n ▸ cves: [6]\n }\n destination_ip_address: \"192.0.2.1\"\n destination_port: \"80\"\n details:\n \"This signature detects Microsoft Windows win.ini access attempts. A successful attack could allow an\n attacker to access sensitive information and conduct further attacks.\"\n direction: \"CLIENT_TO_SERVER\"\n ip_protocol: \"tcp\"\n name: \"Microsoft Windows win.ini Access Attempt Detected\"\n network: \"projects/XXXX/global/networks/fwplus-vpc.\n repeat_count: \"1\"\n security_profile_group:\n \"organizations/XXXX/locations/global/securityprofileGroups/XXXX-fwplus-spg\"\n source_ip_address: \"192.0.2.0\"\n source_port: \"47644\"\n threat_id: \"30851\"\n type: \"vulnerability\"\n uri_or_filename:\n logName: \"projects/XXXX/logs/networksecurity.googleapis.com%2Ffirewall_threat\"\n receiveTimestamp: \"2023-11-28T19:08:49.841883684Z\"\n ▸ resource: {2}\n }\n timestamp: \"2023-11-28T19:08:47.560012184Z\"\n \n```\n\n\u003cbr /\u003e\n\nSimilarly, to view the firewall logs associated with this rule, navigate to\nthe **Logs Explorer** page. In the **Query** pane, paste the following\nquery into the query editor field.\n\n\u003cbr /\u003e\n\n```\n jsonPayload.rule_details.action=\"APPLY_SECURITY_PROFILE_GROUP\"\n jsonPayload.connection.src_ip=\"192.0.2.0\"\n jsonPayload.connection.src_port=\"47644\"\n jsonPayload.connection.dest_ip=\"192.0.2.1\"\n jsonPayload.connection.dest_port=\"80\"\n \n```\n\n\u003cbr /\u003e\n\nThe **Query results** section displays the following firewall log:\n\n\u003cbr /\u003e\n\n```\n {\n insertId: \"qn82vdg109q3r9\"\n jsonPayload: {\n connection: {\n }\n dest_ip: \"192.0.2.1\"\n dest_port: 80\n protocol: 6\n src_ip: \"192.0.2.0\"\n src_port: 47644\n disposition: \"INTERCEPTED\"\n ►instance: {4}\n ▸ remote_instance: {4}\n ▸ remote_vpc: {3}\n rule_details: {\n action: \"APPLY_SECURITY_PROFILE_GROUP\"\n apply_security_profile_fallback_action: \"UNSPECIFIED\"\n direction: \"INGRESS\"\n ▸ ip_port_info: [1]\n ▼\n priority: 6000\n reference: \"network: fwplus-vpc/firewallPolicy: fwplus-fwpolicy\"\n source_range: [\n 1\n 0: \"192.0.2.0/24\"\n target_secure_tag: [\n 0: \"tagValues/281479199099651\"\n ]\n }\n vpc: {\n project_id:XXXX\n subnetwork_name: \"fwplus-us-central1-subnet\"\n vpc_name: \"fwplus-vpc\"\n }\n }\n logName: \"projects/XXXX/logs/compute.googleapis.com%2Ffirewall\",\n receiveTimestamp: \"2023-11-28T19:08:46.749244092Z\"\n resource: {2}\n timestamp: \"2023-11-28T19:08:40.207465099Z\"\n }\n \n```\n\n\u003cbr /\u003e\n\nWith both the threat log and firewall log queries you can view the\ncorrelation between them. The following table maps the firewall log fields\nto the corresponding threat log fields.\n\nWhat's next\n-----------\n\n- [View threats](/firewall/docs/view-threats)\n- [Threat signatures overview](/firewall/docs/about-threats)"]]
