[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-03-10。"],[[["\u003cp\u003eThreat logs document threats detected by Cloud Next Generation Firewall (NGFW) during Layer 7 traffic inspection, creating log entries detailing the threat in the originating project, which can be viewed in the Logs Explorer or on the Threats page.\u003c/p\u003e\n"],["\u003cp\u003eEach threat log entry includes various fields such as \u003ccode\u003econnection\u003c/code\u003e, \u003ccode\u003eaction\u003c/code\u003e, and \u003ccode\u003ethreatDetails\u003c/code\u003e that provide a comprehensive description of the connection parameters, actions performed, and the specifics of the detected threat, respectively.\u003c/p\u003e\n"],["\u003cp\u003eThreat log fields like \u003ccode\u003eclientIp\u003c/code\u003e, \u003ccode\u003eclientPort\u003c/code\u003e, \u003ccode\u003eserverIp\u003c/code\u003e, \u003ccode\u003eserverPort\u003c/code\u003e, and \u003ccode\u003eprotocol\u003c/code\u003e, and \u003ccode\u003ethreatDetails\u003c/code\u003e contain fields such as the threat \u003ccode\u003eid\u003c/code\u003e, \u003ccode\u003ethreat\u003c/code\u003e, \u003ccode\u003edescription\u003c/code\u003e, \u003ccode\u003edirection\u003c/code\u003e, and \u003ccode\u003eseverity\u003c/code\u003e provide in depth insight on the traffic and threat found.\u003c/p\u003e\n"],["\u003cp\u003eThreat logs can be correlated with Firewall Rules Logging entries by comparing fields like source and destination IP addresses and ports to pinpoint the exact packet that triggered a threat.\u003c/p\u003e\n"],["\u003cp\u003eThe log entries for threats and firewall logs can be queried and filtered using specific parameters in the Logs Explorer, like IP addresses and ports, to examine potential threats in detail and take appropriate action.\u003c/p\u003e\n"]]],[],null,["# Threat logs let you audit, verify, and analyze the threats detected in your\nnetwork.\n\nWhen Cloud Next Generation Firewall detects a threat on the traffic being\nmonitored for Layer 7 inspection, it generates a log entry\nin the originating project with the details of the threat. To view and examine\nthe threat logs, in the [Logs Explorer](/logging/docs/view/logs-explorer-interface),\nsearch for the log `networksecurity.googleapis.com/firewall_threat`.\nYou can also view these threat logs on the [**Threats** page](/firewall/docs/view-threats).\n\nThis page explains the format and structure of the threat logs that are\ngenerated when a threat is detected.\n\nThreat log format\n-----------------\n\nCloud NGFW creates a log record entry\nin [Cloud Logging](/logging/docs/overview) for each threat detected on the\nmonitored traffic to or from a virtual machine (VM) instance in a specific zone.\nLog records are included in the JSON payload field of a\n[LogEntry](/logging/docs/reference/v2/rest/v2/LogEntry).\n\nSome log fields are in a multiple-field format, with more than one piece of data\nin a given field. For example, the `connection` field is of the `Connection`\nformat, which contains the server IP address and port, the client IP address\nand port, and the protocol number in a single field.\n\nThe following table describes the format of the threat log fields.\n\n### `Connection` field format\n\nThe following table describes the format of the `Connection` field.\n\n### `ThreatDetails` field format\n\nThe following table describes the format of the `ThreatDetails` field.\n\n### `SecurityProfileGroupDetails` field format\n\nThe following table describes the format of the `SecurityProfileGroupDetails`\nfield.\n\n### `VpcDetails` field format\n\nThe following table describes the format of the `VpcDetails` field.\n\n### `InterceptInstance` field format\n\nThe following table describes the format of the `InterceptInstance` field.\n\nThreat log correlation with a firewall log\n------------------------------------------\n\nWhen a packet matches a firewall rule with logging enabled,\nCloud NGFW logs a\n[Firewall Rules Logging](/firewall/docs/firewall-rules-logging) entry.\nThis entry includes fields such as the source IP address, the destination\nIP address, and the time of packet inspection.\nTo view these firewall rule logs, see\n[View logs](/firewall/docs/using-firewall-rules-logging#viewing_logs).\n\nIf you have a firewall policy rule for Layer 7 inspection with logging\nenabled, Cloud NGFW first logs the Firewall Rules Logging\nentry for the matched packet. Then, it sends the packet to the firewall\nendpoint for Layer 7 inspection.\nThe firewall endpoint analyzes the packet for threats. If a threat is detected,\na separate threat log is created. This threat log include fields such as\nthe type of threat, the source of the threat, and the destination of the threat.\nTo view threat logs, see\n[View threats](/firewall/docs/view-threats#view-threats).\n\nYou can compare the fields in the\n[firewall rule log](/firewall/docs/firewall-rules-logging#log-format)\nand [threat log](#log-format) to identify the packet that triggered the threat\nand take appropriate action to resolve it.\n\nFor example, you have a firewall policy rule configured with the following\nsettings:\n\n- Source IP address: `192.0.2.0`\n- Source port: `47644`\n- Destination IP address: `192.0.2.1`\n- Destination port: `80`\n- Logging: `Enabled`\n\nTo view the threat logs associated with this rule, navigate to\nthe **Logs Explorer** page. In the **Query** pane, paste the following\nquery into the query editor field.\n\n\u003cbr /\u003e\n\n```\n resource.type=\"networksecurity.googleapis.com/FirewallEndpoint\"\n jsonPayload.source_ip_address=\"192.0.2.0\"\n jsonPayload.source_port=\"47644\"\n jsonPayload.destination_ip_address=\"192.0.2.1\"\n jsonPayload.destination_port=\"80\"\n \n```\n\n\u003cbr /\u003e\n\nThe **Query results** section displays the following threat log:\n\n\u003cbr /\u003e\n\n```\n {\n insertId: \"0ac7f359-263f-4428-8ded-ac655d8a09db\"\n jsonPayload: {\n action: \"reset-server\"\n alert_severity: \"HIGH\"\n alert_time: \"2023-11-28T19:07:15Z\"\n category: \"info-leak\"\n ▸ cves: [6]\n }\n destination_ip_address: \"192.0.2.1\"\n destination_port: \"80\"\n details:\n \"This signature detects Microsoft Windows win.ini access attempts. A successful attack could allow an\n attacker to access sensitive information and conduct further attacks.\"\n direction: \"CLIENT_TO_SERVER\"\n ip_protocol: \"tcp\"\n name: \"Microsoft Windows win.ini Access Attempt Detected\"\n network: \"projects/XXXX/global/networks/fwplus-vpc.\n repeat_count: \"1\"\n security_profile_group:\n \"organizations/XXXX/locations/global/securityprofileGroups/XXXX-fwplus-spg\"\n source_ip_address: \"192.0.2.0\"\n source_port: \"47644\"\n threat_id: \"30851\"\n type: \"vulnerability\"\n uri_or_filename:\n logName: \"projects/XXXX/logs/networksecurity.googleapis.com%2Ffirewall_threat\"\n receiveTimestamp: \"2023-11-28T19:08:49.841883684Z\"\n ▸ resource: {2}\n }\n timestamp: \"2023-11-28T19:08:47.560012184Z\"\n \n```\n\n\u003cbr /\u003e\n\nSimilarly, to view the firewall logs associated with this rule, navigate to\nthe **Logs Explorer** page. In the **Query** pane, paste the following\nquery into the query editor field.\n\n\u003cbr /\u003e\n\n```\n jsonPayload.rule_details.action=\"APPLY_SECURITY_PROFILE_GROUP\"\n jsonPayload.connection.src_ip=\"192.0.2.0\"\n jsonPayload.connection.src_port=\"47644\"\n jsonPayload.connection.dest_ip=\"192.0.2.1\"\n jsonPayload.connection.dest_port=\"80\"\n \n```\n\n\u003cbr /\u003e\n\nThe **Query results** section displays the following firewall log:\n\n\u003cbr /\u003e\n\n```\n {\n insertId: \"qn82vdg109q3r9\"\n jsonPayload: {\n connection: {\n }\n dest_ip: \"192.0.2.1\"\n dest_port: 80\n protocol: 6\n src_ip: \"192.0.2.0\"\n src_port: 47644\n disposition: \"INTERCEPTED\"\n ►instance: {4}\n ▸ remote_instance: {4}\n ▸ remote_vpc: {3}\n rule_details: {\n action: \"APPLY_SECURITY_PROFILE_GROUP\"\n apply_security_profile_fallback_action: \"UNSPECIFIED\"\n direction: \"INGRESS\"\n ▸ ip_port_info: [1]\n ▼\n priority: 6000\n reference: \"network: fwplus-vpc/firewallPolicy: fwplus-fwpolicy\"\n source_range: [\n 1\n 0: \"192.0.2.0/24\"\n target_secure_tag: [\n 0: \"tagValues/281479199099651\"\n ]\n }\n vpc: {\n project_id:XXXX\n subnetwork_name: \"fwplus-us-central1-subnet\"\n vpc_name: \"fwplus-vpc\"\n }\n }\n logName: \"projects/XXXX/logs/compute.googleapis.com%2Ffirewall\",\n receiveTimestamp: \"2023-11-28T19:08:46.749244092Z\"\n resource: {2}\n timestamp: \"2023-11-28T19:08:40.207465099Z\"\n }\n \n```\n\n\u003cbr /\u003e\n\nWith both the threat log and firewall log queries you can view the\ncorrelation between them. The following table maps the firewall log fields\nto the corresponding threat log fields.\n\nWhat's next\n-----------\n\n- [View threats](/firewall/docs/view-threats)\n- [Threat signatures overview](/firewall/docs/about-threats)"]]
