收集 F5 ASM 日志

解析器版本：33.0

支持的平台：

Google SecOps SIEM

本文档介绍了如何使用 Bindplane 代理将 F5 Application Security Manager (ASM) 日志注入到 Google Security Operations。

F5 BIG-IP ASM 是一种 Web 应用防火墙 (WAF)，可针对 HTTP 请求违规、政策强制执行操作和安全事件生成 syslog 消息。解析器支持多种日志格式（CEF、syslog、CSV、Splunk、JSON），并将其映射到统一数据模型 (UDM)。

准备工作

请确保满足以下前提条件：

• Google SecOps 实例
• Windows Server 2016 或更高版本，或者具有 systemd 的 Linux 主机
• Bindplane 代理与 F5 BIG-IP 设备之间的网络连接
• 如果在代理后面运行，请确保防火墙端口已根据 Bindplane 代理要求打开
• 对 F5 BIG-IP tmsh 的特权访问权限

获取 Google SecOps 注入身份验证文件

1. 登录 Google SecOps 控制台。
2. 依次前往 SIEM 设置 > 收集代理。
3. 下载数据注入身份验证文件。

4. 将文件安全地保存在将安装 Bindplane 代理的系统上。

   注意： 此 JSON 文件包含用于向 Google SecOps 验证 Bindplane 代理身份的凭据。

获取 Google SecOps 客户 ID

1. 登录 Google SecOps 控制台。
2. 依次前往 SIEM 设置 > 配置文件。

3. 复制并保存组织详细信息部分中的客户 ID。

   注意： 配置 Bindplane 代理导出器时需要客户 ID。

安装 Bindplane 代理

按照以下说明在 Windows 或 Linux 操作系统上安装 Bindplane 代理。

Windows 安装

1. 以管理员身份打开命令提示符或 PowerShell。

2. 运行以下命令：

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. 等待安装完成。

4. 运行以下命令，验证安装是否成功：

   sc query observiq-otel-collector
   

   该服务应显示为 正在运行。

Linux 安装

1. 打开具有 root 或 sudo 权限的终端。

2. 运行以下命令：

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

3. 等待安装完成。

4. 运行以下命令，验证安装是否成功：

   sudo systemctl status observiq-otel-collector
   

   该服务应显示为有效（正在运行）。

其他安装资源

如需了解其他安装选项和问题排查信息，请参阅 Bindplane 代理安装指南。

配置 Bindplane 代理以注入 syslog 并将其发送到 Google SecOps

找到配置文件

• Linux：

  sudo nano /etc/bindplane-agent/config.yaml
  

• Windows：

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

修改配置文件

• 将 config.yaml 的全部内容替换为以下配置：

  receivers:
      udplog:
          listen_address: "0.0.0.0:514"
  
  exporters:
      chronicle/f5_asm:
          compression: gzip
          creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
          customer_id: '<customer_id>'
          endpoint: malachiteingestion-pa.googleapis.com
          log_type: F5_ASM
          raw_log_field: body
  
  service:
      pipelines:
          logs/f5_asm_to_chronicle:
              receivers:
                  - udplog
              exporters:
                  - chronicle/f5_asm
  

配置参数

替换以下占位符：

• 接收器配置：

  • listen_address：要监听的 IP 地址和端口：
    • 0.0.0.0 侦听所有接口（推荐）
    • 端口 514 是标准 syslog 端口（在 Linux 上需要 root 权限；对于非 root 用户，请使用 1514）

• 导出器配置：

  • creds_file_path：提取身份验证文件的完整路径：
    • Linux：/etc/bindplane-agent/ingestion-auth.json
    • Windows：C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • customer_id：从 Google SecOps 控制台复制的客户 ID
  • endpoint：区域端点网址：
    • 美国：malachiteingestion-pa.googleapis.com
    • 欧洲：europe-malachiteingestion-pa.googleapis.com
    • 亚洲：asia-southeast1-malachiteingestion-pa.googleapis.com
    • 如需查看完整列表，请参阅区域级端点

保存配置文件

• 修改后，保存文件：
  • Linux：依次按 Ctrl+O、Enter 和 Ctrl+X
  • Windows：依次点击文件 > 保存

重启 Bindplane 代理以应用更改

• 如需在 Linux 中重启 Bindplane 代理，请运行以下命令：

  sudo systemctl restart observiq-otel-collector
  

  1. 验证服务是否正在运行：

     sudo systemctl status observiq-otel-collector
     

  2. 检查日志是否存在错误：

     sudo journalctl -u observiq-otel-collector -f
     

• 如需在 Windows 中重启 Bindplane 代理，请选择以下选项之一：

  • 以管理员身份运行命令提示符或 PowerShell：

    net stop observiq-otel-collector && net start observiq-otel-collector
    

  • 服务控制台：

    1. 按 Win+R，输入 services.msc，然后按 Enter 键。
    2. 找到 observIQ OpenTelemetry 收集器。
    3. 右键点击并选择重新启动。

    4. 验证服务是否正在运行：

       sc query observiq-otel-collector
       

    5. 检查日志是否存在错误：

       type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
       

在 F5 ASM 中配置 syslog

1. 输入以下命令，登录到 tmsh 实例：

   tmsh
   

2. 使用以下命令修改 syslog 配置：

   edit /sys syslog all-properties
   

3. Syslog 配置会在 vi 文本编辑器中打开，并类似于以下示例：

   modify syslog {
       auth-priv-from notice
       auth-priv-to emerg
       cron-from warning
       cron-to emerg
       daemon-from notice
       daemon-to emerg
       description none
       include none
       iso-date disabled
       kern-from notice
       kern-to emerg
       mail-from notice
       mail-to emerg
       messages-from notice
       messages-to warning
       remote-servers none
       user-log-from notice
       user-log-to emerg
   }
   

4. 将 include none 行替换为以下 syslog 过滤条件：

   include `
       filter f_audit{
           match(AUDIT);
       };
       destination d_syslog_server {
           udp(\`<bindplane-ip>\` port (<bindplane-port>));
       };
       log {
           source(s_syslog_pipe);
           filter(f_audit);
           destination(d_syslog_server);
       };
   `
   

5. 将 <bindplane-ip> 和 <bindplane-port> 替换为为 Bindplane 代理配置的实际 IP 地址和端口号。

6. 输入以下键序列退出 vi：

   :wq!
   

7. 在以下提示中，输入 y 以将更改保存到文件中：

   Save changes? (y/n/e)
   

8. 输入以下命令以保存配置：

   save /sys config
   

UDM 映射表

字段名称	UDM
/BAD_MSG/request-violations/violation[n]/actual_value_length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_pattern	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/cookie/cookie_value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/blocking_mask	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/buffer	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/evasions[n]/offset	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/expected_value_length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/extension	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/flg_disallowed_file_type	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/header/header_value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sanity_checks_status	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/http_sub_violation_status	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_code	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/method_violation_details	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/enforcement_level	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/name	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/parameter_data/value	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/post_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/query_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/qs_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/blocking_mask	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/buffer	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/length	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/kw_data/offset	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/sig_id	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/sig_data[n]/specific_desc	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/total_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/uri_len_limit	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/value_length_type	security_result.detection_fields
/BAD_MSG/request-violations/violation[n]/wildcard_entity	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/cfg_target	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/leakage_type	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/pattern_type	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/response_code	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_index	security_result.detection_fields
/BAD_MSG/response_violations/violation[n]/viol_name	security_result.detection_fields
/BAD_MSG/violation_masks/alarm	security_result.detection_fields
/BAD_MSG/violation_masks/block	security_result.detection_fields
/BAD_MSG/violation_masks/learn	security_result.detection_fields
/BAD_MSG/violation_masks/staging	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/accessCode	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/companyId	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/txnPin	security_result.detection_fields
/s-Envelope/s-Body/inquireTransaction/user	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/s-Envelope/s-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/accessCode	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/companyId	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/txnPin	security_result.detection_fields
/s-Envelope/s-Body/processTransaction/user	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/accessCode	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/companyId	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/txnPin	security_result.detection_fields
/s-Envelope/s-Body/validateAccountNumber/user	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/inquireTransaction/user	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/processTransaction/user	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/accessCode	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/companyId	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/txnPin	security_result.detection_fields
/soap-Envelope/soap-Body/validateAccountNumber/user	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/inquireTransaction/user	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/processTransaction/user	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/accessCode	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/companyId	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/txnPin	security_result.detection_fields
/soap:Envelope/soap:Body/validateAccountNumber/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/inquireTransaction/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/processTransaction/user	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin	security_result.detection_fields
/soapenv-Envelope/soapenv-Body/validateAccountNumber/user	security_result.detection_fields
_csrfToken	security_result.detection_fields
Accept	additional.fields
accept	additional.fields
Accept-Charset	additional.fields
Accept-Encoding	additional.fields
accept-encoding	additional.fields
acceptEncoding	security_result.detection_fields
Accept-Language	additional.fields
accept-language	additional.fields
acceptLanguage	security_result.detection_fields
Access-Control-Request-Headers	security_result.detection_fields
Access-Control-Request-Method	network.http.method
AccountSid	target.resource.product_object_id
AccountType	target.user.attribute.roles.description
act	security_result.action security_result.action_details
act1	security_result.action
Action	additional.fields
action	security_result.action security_result.action_details
action_summary	security_result.detection_fields
additional_bot_signatures	security_result.detection_fields
actual_mitigation_action	security_result.detection_fields
actual_mitigation_action_reason	security_result.detection_fields
alert_level	security_result.severity
anomalies	additional.fields
anomaly_categories	additional.fields
apache_module	security_result.detection_fields
ApiVersion	security_result.detection_fields
App-Name	target.application
Application	target.application
Application-Type	security_result.detection_fields
application_display_name	additional.fields
application_version	security_result.detection_fields
appID	security_result.detection_fields
app_protocol	network.application_protocol
app-version	security_result.detection_fields
attack_type	metadata.description
attacktype	security_result.category_details
audit_component	additional.fields
auth	principal.user.userid
authCode	security_result.detection_fields
auth_level	principal.user.attribute.roles.name
auth_status	security_result.action security_result.summary
batchKey	security_result.detection_fields
batchNo	security_result.detection_fields
BEAuthenticator	security_result.detection_fields
bigip_mgmt_ip	intermediary.ip
bigip_mgmt_ip2	intermediary.ip
bill.isRecurring	security_result.detection_fields
bill.productId	security_result.detection_fields
blocking_exception_reason	security_result.detection_fields
bot_name	additional.fields
bot_signature	additional.fields
bot_signature_category	additional.fields
browser_actual_verification_action	additional.fields
browser_configured_verification_action	additional.fields
browser_verification_status	security_result.detection_fields
bundle-version	additional.fields
bytes_in	network.received_bytes
bytes_out	network.sent_bytes
c6a1	intermediary.ip 条件： [c6a1Label] == "device_address"
c6a2	principal.ip principal.asset.ip 条件： [c6a2Label] == "source_address"
c6a3	target.ip target.asset.ip 条件： [c6a3Label] == "destination_address"
c6a4	security_result.about.ip security_result.about.asset.ip 条件： [c6a4Label] == "ip_address_intelligence"
Cache-Control	additional.fields
captcha_result	security_result.detection_fields
captcha_status	security_result.detection_fields
category	security_result.category_details
cdn-loop	security_result.detection_fields
CF-Connecting-IP	principal.ip principal.asset.ip
cf-cert-presented	principal.asset.attribute.labels
cf-cert-revoked	principal.asset.attribute.labels
cf-cert-verified	principal.asset.attribute.labels
cf-ipcity	principal.location.city
CF-IPCountry	principal.location.country_or_region
cf-ipcountry	principal.location.country_or_region
cf-ipcontinent	principal.asset.attribute.labels
cf-iplatitude	principal.location.region_coordinates.latitude
cf-iplongitude	principal.location.region_coordinates.longitude
cf-ipmetro-code	principal.asset.attribute.labels
cf-ipostal-code	principal.asset.attribute.labels
cf-iregion	principal.location.state
cf-iregion-code	principal.asset.attribute.labels
cf-itimezone	principal.asset.attribute.labels
cf-ray	principal.asset.attribute.labels
CF-Visitor	security_result.detection_fields
CF-Visitor.scheme	principal.asset.attribute.labels
challenge_failure_reason	additional.fields
Channel	security_result.detection_fields
channel	security_result.detection_fields
Check-Id	additional.fields
childTableRef	security_result.detection_fields
CIPHER	network.tls.cipher
city	principal.location.city
class	additional.fields
classification_reason	security_result.detection_fields
clearGadgetId	security_result.detection_fields
client-request-id	additional.fields
client_id	security_result.detection_fields
client_ip	principal.ip
client_ip_geo_location	principal.location.country_or_region
client_port	principal.port
client_request_uri	target.url
client_type	additional.fields
Client-Version	security_result.detection_fields
cmd_data	principal.process.command_line
cn2 and cn2label	security_result.detection_fields
cn3	principal.asset_id 条件： [cn3Label] == "device_id" 否则： security_result.detection_fields
cn4 and cn4label	additional.fields 条件： [cs4label] == "whitelistData"
cn5 and cn5label	additional.fields
collected_time	metadata.collected_timestamp
component	additional.fields
COMPRESSION	security_result.detection_fields
configured_mitigation_action	security_result.detection_fields
configured_mitigation_action_reason	security_result.detection_fields
configuration_date_time	security_result.detection_fields
Connection	additional.fields
connection	additional.fields
contactNo	principal.user.phone_numbers
Content-Length	additional.fields
content-length	additional.fields
Content-Type	additional.fields
content-type	additional.fields
context_name	additional.fields
context_type	additional.fields
contextPath	security_result.detection_fields
Correlation-Id	security_result.detection_fields
country	principal.location.country_or_region
cs1	security_result.rule_id
cs2	security_result.summary 条件： [cs2Label] == "reason" 否则： security_result.detection_fields
cs3	security_result.detection_fields
cs4 and cs4label	additional.fields
cs5	principal.ip principal.asset.ip
currency	security_result.detection_fields
currency_type	security_result.detection_fields
current_monitor_state_1	security_result.detection_fields
current_monitor_state_2	security_result.detection_fields
currentFormName	security_result.detection_fields
custMobile	security_result.detection_fields
data.bits	network.sent_bytes
data.name	network.tls.cipher
data.sessionid	network.session_id
data.version	network.tls.version
data_mwh_requestId	security_result.detection_fields
data_renegotiation	security_result.detection_fields
datosReto	security_result.detection_fields
DATE	metadata.event_timestamp
date_time	metadata.event_timestamp
dependentInfo.DependentRel2Name	security_result.detection_fields
dependentInfo.MasterObjectId	security_result.detection_fields
dependentInfo.MasterObjectTableRef	security_result.detection_fields
dependentInfo.RelationshipTag	security_result.detection_fields
desc	security_result.description
description	metadata.description
DEST_IP	target.ip
dest_ip	target.ip
DEST_PORT	target.port
dest_port	target.port
DeviceBrand	principal.asset.hardware.manufacturer（仅接受字符串） principal.asset.attribute.labels（当 DeviceBrand 包含整数而非字符串时使用）
device.app_signature	principal.asset.attribute.labels
device.app_version	principal.asset.platform_software.platform_version
device_blade	intermediary.asset.attribute.labels
device.build_number	principal.asset.attribute.labels
device.device_id	principal.asset_id
device_id	principal.asset_id
device_id_action	security_result.detection_fields
device_id_status	security_result.detection_fields
device.manufacturer	principal.asset.hardware.manufacturer
DeviceModel	principal.asset.hardware.model
device.model	principal.asset.hardware.model
DeviceName	principal.asset.attribute.labels
DeviceOsFamily	principal.asset.platform_software.platform
device.os_version	principal.platform_version
DeviceOsVersion	principal.platform_version
device.platform	principal.asset.platform_software.platform
device_product	additional.fields
device.sdk_int	principal.asset.attribute.labels
DeviceScreenDensity	principal.asset.attribute.labels
DeviceScreenH	principal.asset.attribute.labels
DeviceScreenW	principal.asset.attribute.labels
DeviceSerial	principal.asset.hardware.serial_number
deviceSerialNo	principal.asset.hardware.serial_number
DeviceUnique	principal.asset.product_object_id
DeviceVendorId	principal.asset.attribute.labels
device_version	metadata.product_version
dimensioneLista	security_result.detection_fields
DNT	security_result.detection_fields
dos_attack_detection_mode	security_result.detection_fields
dos_attack_event	security_result.detection_fields
dos_attack_id	security_result.detection_fields
dos_attack_latency	security_result.detection_fields
dos_attack_name	security_result.detection_fields
dos_attack_tps	security_result.detection_fields
dos_baseline_latency	additional.fields
dos_baseline_tps	additional.fields
dos_dropped_requests_count	additional.fields
dos_incoming_requests_count	additional.fields
dos_mitigation_action	security_result.detection_fields
dos_mitigation_reason	security_result.detection_fields
dpt	target.port
dhost	target.hostname
dst	target.ip
dvc	intermediary.ip
dvchost	intermediary.hostname
ECID-Context	security_result.detection_fields
EE_I_ConsultaListadoProcesosCRM.codigoEntidad	security_result.detection_fields
EE_I_VerificacionBeneficiario.codigoEntidad	security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanBeneficiario	security_result.detection_fields
EE_I_VerificacionBeneficiario.ibanOrdenante	security_result.detection_fields
EE_I_VerificacionBeneficiario.nombreBeneficiario	security_result.detection_fields
email	principal.user.email_addresses
end	additional.fields
enforced_by	additional.fields
environment	security_result.detection_fields
errorcode	security_result.action security_result.rule_id
error_message	security_result.summary
errdefs_msg_name	additional.fields
errdefs_msgno	additional.fields
eventId	security_result.detection_fields
event_time	metadata.event_timestamp
expected_state	security_result.detection_fields
expDate	security_result.detection_fields
expires_in	security_result.detection_fields
externalId	additional.fields
f5_action	security_result.action
f5_file	security_result.detection_fields
f5_http_method	network.http.method
f5_id	security_result.rule_id
f5_line	security_result.detection_fields
f5_name	additional.fields
f5_path	security_result.detection_fields
f5_rev	security_result.rule_version
f5_rule_accuracy	security_result.detection_fields
f5_rule_maturity	security_result.detection_fields
f5_rule_version	security_result.detection_fields
f5_signature	security_result.rule_name
f5_sig_two	security_result.threat_id
f5_tag	security_result.detection_fields
f5_unique_id	network.session_id
f5_uri	target.url
f5_waf_msg	security_result.summary
facility	additional.fields
family_name	principal.user.last_name
Fixed-Device-Id	security_result.detection_fields
flavor	security_result.detection_fields
folder	principal.file.full_path
form_data	additional.fields
From	principal.user.phone_numbers
fragment	security_result.detection_fields
geo_info	security_result.detection_fields
geo_location	principal.location.country_or_region
given_name	principal.user.first_name
grant_type	security_result.detection_fields
hashing_cf	security_result.detection_fields
hashingCF	security_result.detection_fields
headless_signatures	security_result.detection_fields
header-one	additional.fields
Host	target.hostname target.asset.hostname
Hostname	principal.hostname
http_class_name	security_result.detection_fields
http_method	network.http.method
http_protocol_indication	network.application_protocol
http_request	network.http.referral_url
http_version	network.application_protocol_version
human_behaviour	security_result.detection_fields
id	additional.fields
idApp	target.resource.product_object_id
identificativointermediariopa	security_result.detection_fields
identificativoStazioneIntermediarioPA	security_result.detection_fields
idExterno	security_result.detection_fields
idReto	security_result.detection_fields
id_token	security_result.detection_fields
I-Twilio-Idempotency-Token	security_result.detection_fields
If-Modified-Since	security_result.detection_fields
ifModifiedSince	security_result.detection_fields
If-None-Match	security_result.detection_fields
ifNoneMatch	security_result.detection_fields
Image	target.file.full_path
imei	security_result.detection_fields
incap-client-ip	principal.ip principal.asset.ip
inquiretransaction_accessCode	security_result.detection_fields
inquiretransaction_companyId	security_result.detection_fields
inquiretransaction_txnPin	security_result.detection_fields
inquiretransaction_user	security_result.detection_fields
internal_timestamp	metadata.event_timestamp
intermediary_Ip	intermediary.ip
intermediary_port	intermediary.port
invoiceNo	security_result.detection_fields
ip	security_result.about.ip
IP_ADDRESS	principal.ip principal.asset.ip
ip_addr_int	security_result.detection_fields
ip_addr_intelli	security_result.detection_fields
IP_CLIENT	principal.ip
ip_client	principal.ip
IpIntelligenceCategory	additional.fields
ip_route_domain	principal.ip principal.asset.ip
Ipv4AddressIntelligence	additional.fields
irule	security_result.rule_name
irule-version	security_result.rule_version
isDccTransaction	security_result.detection_fields
isDebugConnected	security_result.detection_fields
isDebuggable	security_result.detection_fields
isHooked	security_result.detection_fields
isRunningInEmulator	security_result.detection_fields
isSignedWithDebugKey	security_result.detection_fields
isTamperedApk	security_result.detection_fields
is_trunct	security_result.detection_fields
isWrongCert	security_result.detection_fields
jailbroken_or_rooted_device	security_result.detection_fields
Keep-Alive	additional.fields
lat	security_result.detection_fields
lbCookie	security_result.detection_fields
level	security_result.severity
link	target.url
listener	security_result.detection_fields
lng	security_result.detection_fields
Locale	security_result.detection_fields
log_event	security_result.detection_fields
manage_ip_addr	intermediary.ip
management_ip_address	intermediary.ip
management_ip_address_2	intermediary.ip
max_amount	security_result.detection_fields
member_with_port	security_result.detection_fields
MessageSid	security_result.detection_fields
MessageStatus	security_result.detection_fields
meta_data.object_type	security_result.detection_fields
METHOD	network.http.method
method	network.http.method
micro_service_hostname	additional.fields
micro_service_matched_wildcard_url	additional.fields
micro_service_name	additional.fields
micro_service_type	additional.fields
microservice	additional.fields
min_amount	security_result.detection_fields
mobile_application_name	security_result.detection_fields
mobile_application_version	security_result.detection_fields
mobile_debugger_enabled_device	security_result.detection_fields
mobile_in_emulation_mode	security_result.detection_fields
mobile_is_app	additional.fields
mock	security_result.detection_fields
model	principal.asset.hardware.model
module	security_result.detection_fields
monitor_details	security_result.detection_fields
monitor_status	security_result.detection_fields
monitor_type_1	security_result.detection_fields
monitor_type_2	security_result.detection_fields
msg	security_result.summary
msgg	security_result.description
msg_type	security_result.detection_fields
Name	principal.user.user_display_name
nativeDeviceId	principal.asset.product_object_id
net.host.ip	principal.ip principal.asset.ip
net.host.name	principal.hostname principal.asset.hostname
net.host.port	principal.port
net.peer.ip	principal.ip principal.asset.ip
net.peer.name	target.hostname target.asset.hostname
net.peer.port	target.port
net.transport	network.ip_protocol
network_http_method	network.http.method
new_request_status	additional.fields
nickname	security_result.detection_fields
nii	security_result.detection_fields
nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
num_of_attempts	additional.fields
num_trans	security_result.detection_fields
oauth_server	security_result.detection_fields
Ocp-Apim-Subscription-Key	security_result.detection_fields
ODJFS-AUTH-TOKEN	security_result.detection_fields
Opcode	security_result.severity
Origin	additional.fields
origin	additional.fields
originId	security_result.detection_fields
os	principal.asset.platform_software.platform
Os-Version	principal.platform_version
os_name	security_result.detection_fields
packageName	security_result.detection_fields
partition	additional.fields
partition_name	intermediary.asset.attribute.labels
path	target.url
pathContext	target.application
paymentMode	security_result.detection_fields
phost	security_result.detection_fields
pideUsuario	security_result.detection_fields
platform	principal.asset.platform_software.platform
POLICY	security_result.rule_name
policy	security_result.rule_name
policy_apply_date	security_result.detection_fields
policy_name	security_result.rule_name
pool	security_result.detection_fields
pool_name	security_result.detection_fields
postalCode	principal.asset.attribute.labels
post_len	security_result.detection_fields
Pragma	additional.fields
pragma	additional.fields
previous_action	additional.fields
previous_initiated_action	security_result.detection_fields
previous_initiated_action_status	security_result.detection_fields
previous_request_date_time	security_result.detection_fields
previous_state	security_result.detection_fields
previous_support_id	security_result.detection_fields
principal_data.hostname	principal.hostname principal.asset.hostname
principal_data.ip	principal.ip principal.asset.ip
principal_ipv6	principal.ip principal.asset.ip
principal_mail	principal.user.email_addresses
Priority	additional.fields
priority	additional.fields
priority_value	additional.fields
process	target.application
process_id	principal.process.pid
processtransaction_accessCode	security_result.detection_fields
processtransaction_companyId	security_result.detection_fields
processtransaction_txnPin	security_result.detection_fields
processtransaction_user	security_result.detection_fields
product_name	security_result.rule_type
prod_id	metadata.product_log_id
properties.branch	target.resource.attribute.labels
properties.build	target.resource.attribute.labels
properties.commit	target.resource.attribute.labels
properties.deployment-environment	target.resource.attribute.labels
properties.issueId	target.resource.attribute.labels
properties.issueMatchesProjectContext	target.resource.attribute.labels
properties.projectId	target.resource.attribute.labels
properties.projectType	target.resource.attribute.labels
properties.pullrequest	target.resource.attribute.labels
properties.review	target.resource.attribute.labels
properties.timeDelta	target.resource.attribute.labels
PROTO	network.application_protocol
protocol	network.application_protocol
ProviderGuid	target.resource.id
Proxy-Authorization	security_result.detection_fields
Proxy-Connection	security_result.detection_fields
proxy_errorcode	security_result.detection_fields
proxy_id	security_result.rule_id
proxy_message	security_result.detection_fields
pushNotificationEnabled	security_result.detection_fields
Qualys-Scan	security_result.detection_fields
QUERY_STR	additional.fields
query	security_result.detection_fields
query_string	additional.fields
query_str	security_result.detection_fields
QUOTEDATA	security_result.detection_fields
rangeDa	security_result.detection_fields
rating	security_result.severity_details
RawDlrDoneDate	security_result.detection_fields
rawrequest	target.url
received_bytes	network.received_bytes
received_state	security_result.detection_fields
Referer	network.http.referral_url
referer	network.http.referral_url
referrer	network.http.referral_url
registerDevice	security_result.detection_fields
related_pid	additional.fields
remote_request_ip	principal.ip principal.asset.ip
reputation	security_result.detection_fields
REQ	additional.fields
REQ_STATUS	security_result.action
req_status	security_result.action security_result.action_details security_result.detection_fields
req_status_value	security_result.action security_result.action_details
request	target.url
request_body_size	additional.fields
Request-Context	security_result.detection_fields
request_date_time	security_result.detection_fields
Request-Id	security_result.detection_fields
request_id	additional.fields
requestClientApplication	network.http.user_agent network.http.parsed_user_agent
requestMethod	network.http.method
request_status	security_result.action security_result.action_details
request_side	security_result.detection_fields
resource_name	target.resource.name
RESP_CODE	network.http.response_code
resp	security_result.detection_fields
resp_code	network.http.response_code
response	security_result.summary
response_code	network.http.response_code
riskIT.deviceSignature.browser.userAgent	network.http.user_agent network.http.parsed_user_agent
riskIT.deviceSignature.camera.autoFocus	principal.asset.attribute.labels
riskIT.deviceSignature.camera.flash	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCamera	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedFormats	principal.asset.attribute.labels
riskIT.deviceSignature.camera.frontCameraSupportedSizes	principal.asset.attribute.labels
riskIT.deviceSignature.camera.numberOfCameras	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCamera	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedFormats	principal.asset.attribute.labels
riskIT.deviceSignature.camera.rearCameraSupportedSizes	principal.asset.attribute.labels
riskIT.deviceSignature.collector	principal.asset.attribute.labels
riskIT.deviceSignature.collectorVersion	principal.asset.attribute.labels
riskIT.deviceSignature.extra.account	principal.asset.attribute.labels
riskIT.deviceSignature.extra.securityPolicy	principal.asset.attribute.labels
riskIT.deviceSignature.location.latitude	principal.location.region_coordinates.latitude
riskIT.deviceSignature.location.longitude	principal.location.region_coordinates.longitude
riskIT.deviceSignature.screen.displayId	principal.asset.attribute.labels
riskIT.deviceSignature.screen.height	principal.asset.attribute.labels
riskIT.deviceSignature.screen.orientation	principal.asset.attribute.labels
riskIT.deviceSignature.screen.width	principal.asset.attribute.labels
riskIT.deviceSignature.system.androidId	principal.asset.attribute.labels
riskIT.deviceSignature.system.board	principal.asset.attribute.labels
riskIT.deviceSignature.system.brand	principal.asset.hardware.manufacturer
riskIT.deviceSignature.system.cpuAbi	principal.asset.hardware.cpu_platform
riskIT.deviceSignature.system.debuggerAttached	principal.asset.attribute.labels
riskIT.deviceSignature.system.deviceName	principal.asset.attribute.labels
riskIT.deviceSignature.system.hardware	principal.asset.attribute.labels
riskIT.deviceSignature.system.host	principal.asset.attribute.labels
riskIT.deviceSignature.system.id	principal.asset.attribute.labels
riskIT.deviceSignature.system.jailBroken	principal.asset.attribute.labels
riskIT.deviceSignature.system.locale	principal.asset.attribute.labels
riskIT.deviceSignature.system.model	principal.asset.hardware.model
riskIT.deviceSignature.system.numberOfProcessors	principal.asset.hardware.cpu_number_cores
riskIT.deviceSignature.system.osVersion	principal.platform_version
riskIT.deviceSignature.system.platform	principal.asset.platform_software.platform
riskIT.deviceSignature.system.processName	principal.asset.attribute.labels
riskIT.deviceSignature.system.radio	principal.asset.attribute.labels
riskIT.deviceSignature.system.tags	principal.asset.attribute.labels
riskIT.deviceSignature.system.timeZone	principal.asset.attribute.labels
riskIT.deviceSignature.system.totalDiskSpace	principal.asset.attribute.labels
riskIT.deviceSignature.system.totalMemory	principal.asset.hardware.ram
riskIT.deviceSignature.system.type	principal.asset.attribute.labels
riskIT.deviceSignature.system.user	principal.user.userid
riskIT.deviceSignature.telephony.carrierIsoCountryCode	principal.location.country_or_region
riskIT.deviceSignature.telephony.carrierMobileCountryCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierMobileNetworkCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.carrierName	principal.network.carrier_name
riskIT.deviceSignature.telephony.cellIpAddress	principal.ip principal.asset.ip
riskIT.deviceSignature.telephony.isRoamingNetwork	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.networkType	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.phoneType	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simIsoCountryCode	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simOperatorName	principal.asset.attribute.labels
riskIT.deviceSignature.telephony.simSerialNumber	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.broadcastAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.connected	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.gatewayAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.macAddress	principal.mac principal.asset.mac
riskIT.deviceSignature.wifi.netmaskAddress	principal.asset.attribute.labels
riskIT.deviceSignature.wifi.userEnabled	principal.asset.attribute.labels
riskIT.ipAddress	principal.ip principal.asset.ip
rrn	security_result.detection_fields
RS_VISITOR_ID	security_result.detection_fields
rt	metadata.event_timestamp
rule_name	security_result.rule_name
rule_summary	security_result.summary
rule_version	metadata.product_version
save_payee	security_result.detection_fields
schedule_frequency	security_result.detection_fields
schedule_occurrence	security_result.detection_fields
scope_details	additional.fields
sec-ch-ua	security_result.detection_fields
sec-ch-ua-mobile	additional.fields
sec-ch-ua-platform	principal.asset.platform_software.platform
sec-fetch-dest	additional.fields
Sec-Fetch-Dest	additional.fields
sec-fetch-mode	additional.fields
Sec-Fetch-Mode	additional.fields
sec-fetch-site	additional.fields
Sec-Fetch-Site	additional.fields
Sec-Fetch-Storage-Access	security_result.detection_fields
sec-fetch-user	additional.fields
Sec-Fetch-User	additional.fields
Sec-Fetch-User	additional.fields
sequence_id	additional.fields
server_ip	target.ip
server_port	target.port
service_id	target.resource.product_object_id
SESS_ID	network.session_id
session_id	network.session_id
session_status	security_result.detection_fields
sessionDataId	security_result.detection_fields
sessionDataKey	security_result.detection_fields
Set-Cookie	security_result.detection_fields
set_cookie	security_result.detection_fields
severity	security_result.severity
severity_number	security_result.severity
sg_event_id	security_result.detection_fields
sg_message_id	security_result.detection_fields
sg_template_id	security_result.detection_fields
sg_template_name	security_result.detection_fields
Shield	security_result.detection_fields
signature	security_result.detection_fields
SIG_IDS	security_result.rule_id
sig_cves	security_result.detection_fields
sig_ids	security_result.detection_fields
SIG_NAMES	security_result.rule_name 条件： [policy_name] == ""
SmsSid	security_result.detection_fields
SmsStatus	security_result.detection_fields
snat_ip	principal.nat_ip
snat_port	principal.nat_port
SOAPAction	additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/inquireTransaction/user	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnData	additional.fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/processTransaction/user	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/accessCode	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/companyId	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/txnPin	security_result.detection_fields
SOAP-ENV-Envelope/SOAP-ENV-Body/validateAccountNumber/user	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/companyId	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/inquireTransaction/user	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soap-Envelope/soap-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/companyId	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/processTransaction/user	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/accessCode	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/companyId	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/txnPin	security_result.detection_fields
soap-Envelope/soap-Body/validateAccountNumber/user	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/companyId	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/inquireTransaction/user	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soap:Envelope/soap:Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/companyId	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/processTransaction/user	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/accessCode	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/companyId	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/txnPin	security_result.detection_fields
soap:Envelope/soap:Body/validateAccountNumber/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/inquireTransaction/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/dimensioneLista	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoIntermediarioPA	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/identificativoStazioneIntermediarioPA	security_result.detection_fields
soapenv-Envelope/soapenv-Body/nodoChiediListaPendentiRPT/rangeDa	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/processTransaction/user	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/accessCode	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/companyId	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/txnPin	security_result.detection_fields
soapenv-Envelope/soapenv-Body/validateAccountNumber/user	security_result.detection_fields
sort_order	security_result.detection_fields
SourceModuleName	target.resource.name
SourceModuleType	observer.application
source_host	principal.hostname principal.asset.hostname
source_ip	principal.ip principal.asset.ip
spt	principal.port
src	principal.nat_ip 条件： [src] != [cs5]
SRC_PORT	principal.port
src_port	principal.port
srcport	principal.port
SSL_Client_Cert	security_result.detection_fields
ssl_error_code	security_result.detection_fields
ssl_routine	security_result.detection_fields
staged_sig_cves	security_result.detection_fields
staged_sig_ids	security_result.detection_fields
staged_sig_names	security_result.detection_fields
stagedThreatCampaignNames	additional.fields
staged_threat_campaign_names	security_result.detection_fields
start	additional.fields
start_date	security_result.detection_fields
state	principal.location.state
status	security_result.summary
SUB_VIOLATIONS	additional.fields
sub_process	additional.fields
sub_violates	security_result.summary
sub_violations	security_result.detection_fields
suid	principal.user.userid
summary	security_result.summary
SUPPORT_ID	additional.fields
suser	principal.user.user_display_name
tap_event_id	security_result.detection_fields
tap_vid	security_result.detection_fields
target_data.application	target.application
target_data.ip	target.ip target.asset.ip
target_url	target.url
taxCode	security_result.detection_fields
terminalId	security_result.detection_fields
threat_campaign_names	security_result.detection_fields
thread_id	security_result.detection_fields
tls	network.tls.version
tls_version	network.tls.version
tmm_unit	security_result.detection_fields
To	target.user.phone_numbers
token	security_result.detection_fields
t_port	target.port
traceNo	security_result.detection_fields
traceparent	security_result.detection_fields
Transfer-Encoding	security_result.detection_fields
transfer_type	security_result.detection_fields
transType	security_result.detection_fields
True-Client-IP	principal.ip principal.asset.i
true-client-ip	principal.ip principal.asset.ip
tty	additional.fields
TYPE	security_result.category security_result.category_details
type	metadata.product_event_type
uniqueId	security_result.detection_fields
Upgrade-Insecure-Requests	security_result.detection_fields
URI	target.url
url	principal.url
user	principal.user.userid
USER_AGENT	network.http.user_agent network.http.parsed_user_agent
User-Agent	network.http.user_agent network.http.parsed_user_agent
user_display_name	principal.user.user_display_name
UserID	principal.user.userid
user_id	principal.user.userid
user_name	principal.user.userid
userName	principal.user.email_addresses
user_remarks	security_result.detection_fields
user_type	principal.asset.attribute.labels
usuarioBE	security_result.detection_fields
uuid	security_result.detection_fields
validateaccountnumber_accessCode	security_result.detection_fields
validateaccountnumber_companyId	security_result.detection_fields
validateaccountnumber_txnPin	security_result.detection_fields
validateaccountnumber_user	security_result.detection_fields
vAT	security_result.detection_fields
verb	network.http.method
versionCode	security_result.detection_fields
versionName	security_result.detection_fields
VFPJSESSION	security_result.detection_fields
Via	security_result.detection_fields
VIP	security_result.detection_fields
VIRTUAL	network.tls.client.server_name
VIRTUAL_address	target.resource.name
virtual_server_name	network.tls.client.server_name
virtualserver	network.tls.client.server_name
violation_mask_alarm	security_result.detection_fields
violation_mask_block	security_result.detection_fields
violation_mask_learn	security_result.detection_fields
violation_mask_staging	security_result.detection_fields
violation_rating	security_result.detection_fields
violations	security_result.description
virus_name	security_result.threat_name
vs_ip	intermediary.ip
vs_name	target.resource.name
vs_port	intermediary.port
web_application_name	target.application
websocket_direction	network.direction = Inbound 条件： （如果 [websocket_direction] == "clientToServer"） network.direction = OUTBOUND 条件： （如果 [websocket_direction] == "ServerToclient"）
websocket_message_type	security_result.detection_fields
wm_client_ip	principal.ip principal.asset.ip
WORKIDENTIFIER	security_result.detection_fields
wtfpc	security_result.detection_fields
X-Amzn-Trace-Id	security_result.detection_fields
X-Bug-Bounty	security_result.detection_fields
X-Bug-Bounty-Contact	security_result.detection_fields
X-Bug-Bounty-Purpose	security_result.detection_fields
X-Client-Ip	principal.ip principal.asset.ip
x-codsecent	security_result.detection_fields
X-Cnection	security_result.detection_fields
X-Correlation-ID	security_result.detection_fields
x-correlation-id	security_result.detection_fields
x-country-code	principal.location.country_or_region
x-dtpc	security_result.detection_fields
X-Environment	security_result.detection_fields
X-EVENT-TYPE	metadata.product_event_type
X-F5-VIP	target.ip target.asset.ip
XFF	principal.ip
X-FORWARDED-PORT	target.port
X-FORWARDED-PROTO	network.application_protocol
X-Forwarded-For	principal.ip principal.asset.ip
X-Forwarded-Proto	network.application_protocol
x-forwarded-client-cert	security_result.detection_fields
x-fwd-hdr-val	security_result.detection_fields
X-header-postpay-addons-uri	security_result.detection_fields
X-Home-Region	security_result.detection_fields
x-iapp-real-ip	principal.ip principal.asset.ip
X-ma-bid	security_result.detection_fields
X-ma-did	security_result.detection_fields
X-ma-hostname	security_result.detection_fields
X-ma-pid	security_result.detection_fields
X-ma-sid	security_result.detection_fields
X-MicrosoftAjax	security_result.detection_fields
x-msisdnToken	security_result.detection_fields
X-msisdnToken	security_result.detection_fields
X-OAUTH-IDENTITY-DOMAIN-NAME	security_result.detection_fields
X-ORIGINAL-HOST	principal.hostname
X-Original-URL	principal.url
X-OWA-ActionId	additional.fields
X-OWA-ActionName	additional.fields
X-OWA-Attempt	additional.fields
X-OWA-CANARY	additional.fields
X-OWA-ClientBuildVersion	security_result.detection_fields
X-OWA-CorrelationId	metadata.product_log_id
X-OWA-ExplicitLogonUser	principal.user.email_addresses
X-OWA-UrlPostData	security_result.detection_fields
X-Requested-With	additional.fields
x-request-application	metadata.product_event_type
X-ROBOT-AGENT	security_result.detection_fields
X-ROBOT-LICENSE	security_result.detection_fields
X-ROBOT-MACHINE-ENCODED	security_result.detection_fields
X-ROBOT-SERVICE-USERNAME-ENCODED	security_result.detection_fields
X-ROBOT-VERSION	security_result.detection_fields
X-Remote-Addr	principal.ip principal.asset.ip
x-session	security_result.detection_fields
X-Twilio-Email-Event-Webhook-Signature	security_result.detection_fields
X-Twilio-Email-Event-Webhook-Timestamp	security_result.detection_fields
X-Twilio-Signature	security_result.detection_fields
X-UIPATH-INSTALLATION-ID	security_result.detection_fields
X-UIPATH-INSTALLATION-VERSION	security_result.detection_fields
X-UIPATH-Localization	security_result.detection_fields
X-wa-sid	security_result.detection_fields
xWpammRequestId	security_result.detection_fields
X-XSRF-TOKEN	additional.fields
X-xforwarded-client-cert	security_result.detection_fields

CSV 日志

输入列	目标字段	条件
如果 [column4] != "asm-policy"
如果第 5 列不是有效的 IP
column1	target_ip
column2	target_port
column3	geo_location	[column3]不在["N/A", ""]中
column3	target_ip	[column3] != "" AND [column3] =~ "^[0-9.]"
column5	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column6	VIOLATION_DETAILS	[column6] =~ ".*xml"
column7	intermediary_Ip	[column7] != "" AND GROK %{IP:column7} 成功
column8	network_http_method	["GET","POST","PUT","DELETE","PATCH","HEAD","OPTIONS"]：[column8]
column7	network_http_method	ELSE IF [column7] in ["GET","POST", ...]
column9	event.idm.read_only_udm.additional.fields	[column9]不在["", "N/A"]中且不是时间戳
column9	policy_apply_date	[column9]不在["", "N/A"]中且为时间戳
column10	security_result.rule_name	![column10_is_ip] AND [column10] == [column3] AND [column10] != ""
column11	app_protocol	[column11] != ""
column13	不定 (KV)	[column13] != ""
column14	req_status_value	["blocked", "allowed", "alerted", "passed"]：[column14]
column18	request_id	[column18] != ""
column19	severity_level	[column19] =~ "(?i)(Informational
column22	principal_port	[column22] 不在 ["", "N/A"] 中，且 [column22] 是数字
column23	event.idm.read_only_udm.metadata.product_log_id	[column23]不在["", "N/A"]中
column25	syslog_host	[syslog_host] == "" AND [column25] != ""
column26	event.idm.read_only_udm.network.http.referral_url	[column26]不在["", "N/A"]中
column27	VIOLATION_DETAILS	[column27] =~ ".*xml"
column28	VIOLATION_DETAILS	[column27] !~ ".xml" AND [column28] =~ ".xml"
column28	security_result.description	[column27] !~ ".xml" AND [column28] !~ ".xml" AND [column28] not in ["", "N/A"] AND [column28] is NOT numeric
column15	response	IF [column27] !~ ".*xml": [column15] != ""
column16	network_http_response_code	如果 [column27] 不包含“.*xml”：[column16] 不在 ["","-"] 中
column24	session_id	IF [column27] !~ ".*xml": [column24] != ""
column29	security_result.summary	IF [column27] !~ ".*xml": [column29] != ""
column24	resource_name	IF [column27] =~ ".*xml": [column24] != ""
column31	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
如果 column5 是有效的 IP
column1	target_ip
column2	target_port
column3	geo_location	[column3] 不是有效的 IP 地址
column3	target_ip	[column3] != "" 且 [column3] 是有效的 IP
column6	principal_ip	[column6] != "" AND GROK %{IP:column6} 成功
column7	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column7	VIOLATION_DETAILS	[column7] =~ ".*xml"
column8	intermediary_Ip	[column8] 不在 ["", "N/A"] 中，且 GROK %{IP:column8} 成功
column9	network_http_method	["GET","POST", ...]：[column9]
column8	network_http_method	ELSE IF [column8] in ["GET","POST", ...]
column9	collected_time	[column9] =~ "^[0-9]+"
column22	request_body_size	[column22] =~ "^[0-9]+$"
column10	event.idm.read_only_udm.additional.fields	[column10]不在["", "N/A"]中且不是时间戳
column10	policy_apply_date	[column10]不在["", "N/A"]中且为时间戳
column11	security_result.rule_name	[column11_is_ip] AND [column11] == [column4] AND [column11] != ""
column4	policy_name	ELSE IF [column11] != [column4] AND [column4] != "" AND [column4] is NOT numeric
column4	target_port	ELSE IF [column4] 是数字
column12	app_protocol
column13	不定 (KV)	[column13] != ""
column15	req_status_value	["blocked", "allowed", "alerted", "passed"]：[column15]
column19	request_id
column20	severity_level	[column20] =~ "(?i)(Informational
column23	principal_port	[column23] 不在 ["", "N/A"] 中，且 [column23] 是数字
column26	syslog_host	[syslog_host] == "" AND [column26] != ""
column27	event.idm.read_only_udm.network.http.referral_url	[column27]不在["", "N/A"]中
column28	VIOLATION_DETAILS	[column28] =~ ".*xml"
column29	VIOLATION_DETAILS	[column28] !~ ".xml" AND [column29] =~ ".xml"
column29	security_result.description	[column28] !~ ".xml" AND [column29] !~ ".xml" AND [column29] not in ["", "N/A"] AND [column29] is NOT numeric
column16	response	IF [column28] !~ ".*xml": [column16] != ""
column17	network_http_response_code	如果 [column28] 不包含“.*xml”：[column17] 不在 ["","-"] 中
column25	session_id	IF [column28] !~ ".*xml": [column25] != ""
column30	security_result.summary	IF [column28] !~ ".*xml": [column30] != ""
column25	principal_ip	IF [column28] =~ ".*xml": [column25] != "" AND ![column25_is_ip]
column16	network_http_response_code	IF [column28] =~ ".*xml": [column25] != "" AND [column16] != ""
column19	severity_level	IF [column28] =~ ".*xml": [column25] != "" AND [column19] =~ "(?i)(Informational…)"
column24	session_id	如果 [column28] =~ ".*xml"：[column25] != "" 且 [column24] 不在 ["", "N/A"] 中
column25	resource_name	如果 [column28] =~ ".*xml" 且 [column25] == ""：[column25] != ""
column24	event.idm.read_only_udm.metadata.product_log_id	如果 [column28] =~ ".*xml" 且 [column25] == ""：[column24] 不在 ["", "N/A"] 中
column32	event.idm.read_only_udm.principal.ip and event.idm.read_only_udm.principal.asset.ip
column33	request
column34	response
如果 [column4] == "asm-policy"
column1	principal_ip	[column1] != "" AND [column1] =~ "^[0-9.]"
column2	principal_port	[column2]不在["","N/A","none"]中
column3	principal_ip	[column3] != "" AND [column3] =~ "^[0-9.]"
column4	event.idm.read_only_udm.metadata.product_event_type	[column4] != ""
column6	principal_ip	[column6] != "" 且 [column6] 是有效的 IP
column6	req_status_value	ELSE IF [column6] in ["blocked", "allowed", ...]
column6	support_id	ELSE [column6] != ""
column7	severity_level	[column7] =~ "(?i)(Informational…)"
column8	geo_location	[column8]不在["N/A", ""]中
column9	VIOLATION_DETAILS	[column9] =~ ".*xml"
column9	event.idm.read_only_udm.target.application	ELSE IF [column9] != ""
column11	intermediary_Ip	GROK %{IP:column11} 成功
column16	target_ip	GROK %{IP:column16} 成功
column18	network_http_method	[column18]不在["","N/A","none"]中
column24	policy_apply_date
column26	app_protocol
column29	target_url	[column29] != "" AND Grok match
column29	不定 (KV)	[column29] != "" AND Grok match
column30	req_status_value	["blocked", "allowed", ...]：[column30]
column31	security_result.summary
column32	network_http_response_code	[column32] != ""
column35	severity
column55	VIOLATION_DETAILS	[column55] =~ ".*xml"
column58	VIOLATION_DETAILS	[column58] =~ ".*xml"
column60	security_result.description	[column60]不在["","N/A","none"]中
column62	event.idm.read_only_udm.target.resource.name
IF ![utf_error]（整个块都受此条件限制。如果 [utf_error] 为 true，则丢弃消息）如果 [utf_error] 为 false
column2	principalIp	（在 ![utf_error] 内）
column1	column1	（在 ![utf_error] 内）
“IF [no_ip_address]（对 column2 的 Grok 失败）”
column1	date_time
column2	attackType
column3	principalIp
column11	method
column12	url
column13	app_protocol
column10	targetIp
column9	intermediaryIp
column19	rating
column15	req_status
column5	geo_location
column27	VIOLATION_DETAILS	如果 [column27] 类似于 XML 数据
column25	VIOLATION_DETAILS	如果 [column27] 与 XML 数据不相似
“ELSE (of [no_ip_address]) (Grok on column2 succeeded)”
column1	date_time
attack_type	attackType
column10	method
column11	url
column12	app_protocol
column9	targetIp
column8	intermediaryIp
column18	rating
column14	req_status
column5	geo_location	![no_ip_address] AND [column5] 不在 ["N/A", ""] 中
column17	severity	![no_ip_address] AND [column17] 不在 ["N/A", ""] 中
column20	request_id	![no_ip_address] AND [column20] 不在 ["N/A", ""] 中
column26	x_forwarded_for	![no_ip_address] AND [column26] 不在 ["N/A", ""] 中
column4	dest_port	[column3] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
column3	dest_port	ELSE（针对 [column3] IP 检查）
column15	resp_code	不适用
column16	resp_code	如果 [column15_not_resp_code]
column17	resp_code	如果 [column15_not_resp_code] 和 [column16_not_resp_code]
attackType	attack_type	[attackType]不在["N/A", ""]中
intermediaryIp	intermediary_Ip	[intermediaryIp] != ""
principalIp	principal_ip	[principalIp] != ""
targetIp	target_ip	[targetIp] =~ "^(?:[0-9]{1,3}[.]){3}[0-9]{1,3}$"
resp_code	network_http_response_code	[resp_code] != ""
dest_port	target_port	[dest_port] != ""
url	target_url	[url] != ""
intermediary_Ip	intermediary.ip	[intermediary_Ip] != ""
ELSE（如果 ![utf_error]）
发送带有 TAG_UNSUPPORTED 的消息

发布增量

Google SecOps 发布了新版 F5 ASM 解析器，其中对 Parser_Name 日志字段到 UDM 字段的映射以及事件类型的映射进行了重大更改。

日志字段映射增量

日志字段	现有映射	新
Accept	"security_result.about.resource.attribute.label\nsecurity_result.about.labels"	additional.fields
Accept-Charset	security_result.about.resource.attribute.labels	additional.fields
Accept-Encoding	"security_result.about.resource.attribute.labels\nsecurity_result.about.labels"	additional.fields
Accept-Language	security_result.detection_fields	additional.fields
Accept-Language	"security_result.detection_fields\nsecurity_result.aboit.labels"	additional.fields
AccountType	target.user.role_description	target.user.attribute.roles.description
act	security_result.action == ALLOW	security_result.action == QUARATINE
action1	security_result.detection_fields	security_result.action_details
actual_mitigation_action	security_result.detection_fields	移除了“无”值
actual_mitigation_action_reason	security_result.detection_fields	移除了“无”值
attack_type	intermediary.hostname and security_result.category_details	security_result.category_details
Cache-Control	security_result.about.resource.attribute.labels	additional.fields
Cache-Control	security_result.detection_fields	additional.fields
cn2（评分）	security_result.severity	security_result.detection_fields
Connection	"security_result.about.resource.attribute.labels\nsecurity_result.about.labels"	additional.fields
Connection	security_result.detection_fields	additional.fields
Content-Length	security_result.about.labels	additional.fields
Content-Type	security_result.about.labels	additional.fields
date_time	metadata.event_timestamp	移除了冗余的映射
descrip	metadata.descrption	移除了冗余的映射
device_id	target.asset.id	principal.asset.id
device_product	security_result.detection_fields	additional.fields
dvchost	intermediary.ip and intermedairy.asset.ip	intermediary.ip
event_id（grok 提取的值）	additional.fields	principal.process.pid
Keep-Alive	security_result.about.resource.attribute.labels	additional.fields
net.host.port	principal.port and additional.fields	additional.fields
net.peer.name	"target.hostname, target.asset.hostname\nadditional.fields"	target.hostname
net.peer.port	target.port and additional.fields	additional.fields
policy_name	about.resource.name	security_result.rule_name
policy_name	security_result.about.resource.name	security_result.rule_name
Pragma	security_result.about.resource.attribute.labels	additional.fields
Pragma	security_result.detection_fields	additional.fields
rating	security_result.severity	移除了冗余的映射
Reason	security_resultsummary and securtiy_result.detetction_fields	security_result.detection_fields
resp_code	security_result.severity	移除了冗余的映射
response_code	additional.fields and network.http.response_code	network.http.response_code
sig_names	security_result.rule_name	security_result.detection_fields
sub_violations	security_result.about.resource.attribute.labels	security_result.detection_fields
support_id	additional.fields and metadata.product_log_id	metadata.product_log_id
SYSLOG headers	principal.ip	intermediary.ip
uri	principal.url and target.url	traget.url
violation_rating	security_result.about.resource.attribute.labels	security_result.detection_fields
X-Forwarded-For	security_result.about.resource.attribute.labels	principal.ip
XFF	intermediary.ip	principal.ip
x_forwarded_for_header_value	additional.fields	principal.ip

其他更改

• 移除了“不适用”值映射：

  • 不再为 principal.location.country_or_region 映射“不适用”值。
  • 不再为 principal.user.userid 映射“不适用”值。

• 移除了直接协议/方向映射：

  • 移除了包含“UDP”的消息与 network.ip_protocol 的直接映射。
  • 移除了包含“HTTPS”的消息与 network.application_protocol 的直接映射。
  • 已移除将 network.direction 的静态设置设为 INBOUND 的操作。
  • 移除了包含“HTTPS/1.1”的消息到 network.network.tls.version 的直接映射。

• 更新后的网址映射：

  • 之前，req_host 和 req_uri 已合并以映射到 target.url。此功能已更新为仅将 req_uri 映射到 target.url。

• 已修改的操作设置：

  • 已移除在 "num_of_attempts" 不为 null 时将 security_result.action 设置为 ALLOW 的操作。

• 移除了静态 IP 映射：

  • 已移除 dvc_ip 到 0.0.0.0 的静态映射。
  • 已移除 target_ip 到 0.0.0.0 的静态映射。

• 修订后的 externalid 映射：

  • externalid 的映射现在会填充 additional.fields，并将键名从 Support_id 更改为 externalid。

• 更新了严重程度映射：

  • 数值型 [severity_level] 值（例如“1”“2”“3”）现在会重新映射为“LOW”。此标准可将数字严重性代码标准化为一致的比例。
  • “警告”日志现已整合并映射到“中”，从而简化了严重程度分类。
  • 严重程度检查的顺序已调整为从最严重到最不严重：ERROR、CRITICAL、HIGH、MEDIUM、LOW，最后是 INFORMATIONAL。

• 移除了无效值：

  • 已从 principal.url 中移除包含英文双引号 (\") 的值。
  • 无效值（以 * 或 $ 开头的值）已从 network.http.parsed_user_agent 中移除。

更新日志

查看相应解析器的更改日志

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。