Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan log yang dibuat oleh pemberitahuan ancaman Cloud IDS.
Log ancaman
Anda dapat melihat log yang dibuat karena ancaman di jaringan Anda di Cloud Logging.
Log menggunakan format JSON dengan kolom berikut:
threat_id - ID ancaman Palo Alto Networks yang unik.
name - Nama ancaman.
alert_severity - Tingkat keparahan ancaman. Salah satu dari INFORMATIONAL, LOW,
MEDIUM, HIGH, atau CRITICAL.
type - Jenis ancaman.
category - Subjenis ancaman.
alert_time - Waktu saat ancaman ditemukan.
network - Jaringan pelanggan tempat ancaman ditemukan.
source_ip_address - Alamat IP sumber traffic yang dicurigai. Saat Anda menggunakan load balancerGoogle Cloud , alamat IP klien yang sebenarnya tidak tersedia, dan nilai ini adalah rentang alamat IP Google Front End (GFE). Nilainya dapat berupa 130.211.0.0/22 atau 35.191.0.0/16.
destination_ip_address - Alamat IP tujuan traffic yang dicurigai.
source_port - Port sumber traffic yang dicurigai.
destination_port - Port tujuan traffic yang dicurigai.
ip_protocol - Protokol IP traffic yang dicurigai.
application - Jenis aplikasi traffic yang dicurigai—misalnya, SSH.
direction - Arah traffic yang dicurigai (klien ke server atau
server ke klien).
session_id - ID numerik internal yang diterapkan ke setiap sesi.
repeat_count - Jumlah sesi dengan IP sumber, IP tujuan, aplikasi, dan jenis yang sama yang dilihat dalam waktu 5 detik.
uri_or_filename - URI atau nama file ancaman yang relevan, jika ada.
cves - daftar CVE yang terkait dengan ancaman
details - Informasi tambahan tentang jenis ancaman, diambil dari ThreatVault Palo Alto Networks.
Kolom JSON sebelumnya disusun bertingkat di bawah kolom jsonPayload log. Nama log untuk log ancaman adalah projects/<consumer-project>/logs/ids.googleapis.com/threat.
Selain itu, kolom labels.id log berisi nama endpoint Cloud IDS, dan kolom resource.type-nya adalah ids.googleapis.com/Endpoint.
Contoh kueri
Kueri ini di Cloud Logging mengkueri log ancaman IDS di project cloud
my-project, yang menampilkan semua ancaman yang dilaporkan oleh
endpoint my-endpoint antara pukul 08.00-09.00 pada 4 April 2021, waktu PST
(offset zona waktu -07), dengan tingkat keparahan ancaman ditandai sebagai TINGGI.
logName="projects/my-project/logs/ids.googleapis.com/threat"
AND resource.type="ids.googleapis.com/Endpoint"
AND resource.labels.id="my-endpoint"
AND timestamp >= "2021-04-18T08:00:00-07"
AND timestamp <= "2021-04-18T09:00:00-07"
AND jsonPayload.alert_severity=("HIGH" OR "CRITICAL")
Kebijakan retensi
Retensi ditentukan oleh bucket penyimpanan tempat log berada.
Secara default, log ditempatkan di bucket _Default, dan secara default bucket ini memiliki kebijakan retensi data selama 30 hari.
Anda dapat memilih untuk memfilter log ke bucket yang berbeda. Selain itu, retensi dapat
dikonfigurasi.
Jika Anda menginginkan kebijakan retensi yang berbeda dari 30 hari default, Anda dapat melakukan salah satu hal berikut:
Memfilter semua log ke bucket lain dan mengonfigurasi kebijakan retensi.
Konfigurasikan kebijakan retensi kustom untuk bucket _Default. Tindakan ini akan memengaruhi semua log lainnya di bucket _Default.
Log traffic
Anda dapat melihat log yang dibuat karena traffic jaringan di Cloud Logging.
Log menggunakan format JSON dengan kolom berikut:
start_time - Waktu mulai sesi.
elapsed_time - Waktu yang berlalu selama sesi.
network - Jaringan yang terkait dengan endpoint IDS.
source_ip_address - Alamat IP sumber paket.
source_port - Port sumber traffic.
destination_ip_address - Alamat IP tujuan paket.
destination_port - Port tujuan traffic.
ip_protocol - Protokol IP paket.
application - Aplikasi yang terkait dengan sesi.
session_id - ID numerik internal yang diterapkan ke setiap sesi.
repeat_count - Jumlah sesi dengan IP sumber, IP tujuan, aplikasi, dan jenis yang sama yang terlihat dalam waktu 5 detik.
total_bytes - Jumlah total byte yang ditransfer dalam sesi.
total_packets - Jumlah total paket yang ditransfer dalam sesi.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eCloud IDS threat alerts generate logs viewable in Cloud Logging, using a JSON format with fields like \u003ccode\u003ethreat_id\u003c/code\u003e, \u003ccode\u003ename\u003c/code\u003e, and \u003ccode\u003ealert_severity\u003c/code\u003e to describe detected threats.\u003c/p\u003e\n"],["\u003cp\u003eThe JSON payload includes crucial details such as the source and destination IP addresses, ports, threat type, and severity, alongside additional data from Palo Alto Networks' ThreatVault.\u003c/p\u003e\n"],["\u003cp\u003eThreat logs can be queried within Cloud Logging using specific criteria, including the endpoint name, timestamp ranges, and threat severity levels, as demonstrated by the provided sample query.\u003c/p\u003e\n"],["\u003cp\u003eRetention of these logs depends on the storage bucket and is set to 30 days by default in the \u003ccode\u003e_Default\u003c/code\u003e bucket, but it can be customized through different bucket configurations.\u003c/p\u003e\n"],["\u003cp\u003eTraffic logs are also generated in Cloud Logging, using a JSON format, and they contain information about network traffic, such as \u003ccode\u003estart_time\u003c/code\u003e, \u003ccode\u003eelapsed_time\u003c/code\u003e, source and destination information, and the protocol used.\u003c/p\u003e\n"]]],[],null,["# Cloud IDS logging information\n\nThis page describes the logs created by Cloud IDS threat alerts.\n\nThreat logs\n-----------\n\nYou can view logs generated due to threats in your network in Cloud Logging.\nThe logs use a JSON format with the following fields:\n\n- `threat_id` - Unique Palo Alto Networks threat identifier.\n- `name` - Threat name.\n- `alert_severity` - Severity of the threat. One of `INFORMATIONAL`, `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL`.\n- `type` - Type of the threat.\n- `category` - Sub-type of the threat.\n- `alert_time` - Time when the threat was discovered.\n- `network` - Customer network in which the threat was discovered.\n- `source_ip_address` - Suspected traffic's source IP address. When you use a Google Cloud load balancer the true client IP address is not available, and this value is the IP address range of the Google Front End (GFE). The value can be `130.211.0.0/22` or `35.191.0.0/16`.\n- `destination_ip_address` - Suspected traffic's destination IP address.\n- `source_port` - Suspected traffic's source port.\n- `destination_port` - Suspected traffic's destination port.\n- `ip_protocol` - Suspected traffic's IP protocol.\n- `application` - Suspected traffic's application type---for example, SSH.\n- `direction` - Suspected traffic's direction (client-to-server or server-to-client).\n- `session_id` - An internal numerical identifier applied to each session.\n- `repeat_count` - Number of sessions with the same source IP, destination IP, application, and type seen within 5 seconds.\n- `uri_or_filename` - URI or filename of the relevant threat, if applicable.\n- `cves` - a list of CVEs associated with the threat\n- `details` - Additional information about the type of threat, taken from Palo Alto Networks' ThreatVault.\n\nThe previous JSON fields are nested under the log's `jsonPayload` field. The\nlog name for threat logs is\n`projects/\u003cconsumer-project\u003e/logs/ids.googleapis.com/threat`.\n\nIn addition, the log's `labels.id` field contains the Cloud IDS endpoint's\nname, and its `resource.type` field is `ids.googleapis.com/Endpoint`.\n\n### Sample query\n\nThis query in Cloud Logging queries the IDS threat log in cloud project\n\u003cvar translate=\"no\"\u003emy-project\u003c/var\u003e, returning all threats reported by the\n\u003cvar translate=\"no\"\u003emy-endpoint\u003c/var\u003e endpoint between 8am-9am on April 4, 2021, PST time\n(-07 timezone offset), where the threat's severity was marked HIGH. \n\n```\nlogName=\"projects/my-project/logs/ids.googleapis.com/threat\"\n AND resource.type=\"ids.googleapis.com/Endpoint\"\n AND resource.labels.id=\"my-endpoint\"\n AND timestamp \u003e= \"2021-04-18T08:00:00-07\"\n AND timestamp \u003c= \"2021-04-18T09:00:00-07\"\n AND jsonPayload.alert_severity=(\"HIGH\" OR \"CRITICAL\")\n```\n\n### Retention policy\n\nRetention is determined by the storage buckets in which the logs are located.\nBy default, logs are placed in the `_Default` bucket, and by default this bucket\nhas a retention policy of 30 days.\n\nYou can choose to filter logs to different buckets. In addition, retention is\nconfigurable.\n\nIf you want a different retention policy than the default 30 days, you can do\none of the following:\n\n- Filter all logs into another bucket and configure a retention policy.\n- Configure a custom retention policy for the `_Default` bucket. This will affect all other logs in the `_Default` bucket.\n\nTraffic logs\n------------\n\nYou can view logs generated due to network traffic in Cloud Logging.\nThe logs use a JSON format with the following fields:\n\n- `start_time` - The time of the session start.\n- `elapsed_time` - The elapsed time of the session.\n- `network` - The network associated with the IDS endpoint.\n- `source_ip_address` - The source IP address of the packet.\n- `source_port` - The source port of the traffic.\n- `destination_ip_address` - The destination IP address of the packet.\n- `destination_port` - The destination port of the traffic.\n- `ip_protocol` - The IP protocol of the packet.\n- `application` - The application associated with the session.\n- `session_id` - An internal numerical identifier applied to each session.\n- `repeat_count` - The number of sessions with the same source IP, destination IP, application, and type seen within 5 seconds.\n- `total_bytes` - The total number of bytes transferred in the session.\n- `total_packets` - The total number of packets transferred in the session."]]
