我们已重新整理文档导航结构，使其与您的运营工作流程直接保持一致。如需了解详情，请参阅版本说明和演示视频。

Google 会使用 AI 技术将内容翻译成您偏好的语言。AI 翻译可能包含错误。

收集 Check Point 防火墙日志

解析器版本：34.0

支持的平台：

Google SecOps SIEM

本文档介绍了如何使用 Bindplane 代理将 Check Point 防火墙日志注入到 Google Security Operations。

Check Point 防火墙会针对网络连接、安全事件、VPN 活动、威胁防御和管理操作生成日志。解析器会提取键值对和 CEF 字段，并将它们映射到统一数据模型 (UDM)。

准备工作

请确保满足以下前提条件：

Google SecOps 实例
Windows Server 2016 或更高版本，或者具有 systemd 的 Linux 主机
Bindplane 代理与 Check Point 防火墙之间的网络连接
如果在代理后面运行，请确保防火墙端口已根据 Bindplane 代理要求打开
对 Check Point 防火墙界面的特权访问权限

获取 Google SecOps 注入身份验证文件

登录 Google SecOps 控制台。
依次前往 SIEM 设置 > 收集代理。
下载数据注入身份验证文件
将文件安全地保存在将要安装 Bindplane 代理的系统上。

注意：此 JSON 文件包含用于向 Google SecOps 验证 Bindplane 代理身份的凭据。

获取 Google SecOps 客户 ID

登录 Google SecOps 控制台。
依次前往 SIEM 设置 > 配置文件。
复制并保存组织详细信息部分中的客户 ID。

注意：配置 Bindplane 代理导出器时需要客户 ID。

安装 Bindplane 代理

按照以下说明在 Windows 或 Linux 操作系统上安装 Bindplane 代理。

Windows 安装

以管理员身份打开命令提示符或 PowerShell。

运行以下命令：

msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

等待安装完成。
运行以下命令，验证安装是否成功：
```
sc query observiq-otel-collector
```
该服务应显示为 正在运行。

Linux 安装

打开具有 root 或 sudo 权限的终端。

运行以下命令：

sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

等待安装完成。
运行以下命令，验证安装是否成功：
```
sudo systemctl status observiq-otel-collector
```
该服务应显示为有效（正在运行）。

其他安装资源

如需了解其他安装选项和问题排查信息，请参阅 Bindplane 代理安装指南。

配置 Bindplane 代理以注入 syslog 并将其发送到 Google SecOps

找到配置文件

Linux：

sudo nano /etc/bindplane-agent/config.yaml

Windows：

notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

修改配置文件

将 config.yaml 的全部内容替换为以下配置：

receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/checkpoint_firewall:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: CHECKPOINT_FIREWALL
        raw_log_field: body

service:
    pipelines:
        logs/checkpoint_firewall_to_chronicle:
            receivers:
                - udplog
            exporters:
                - chronicle/checkpoint_firewall

配置参数

替换以下占位符：

接收器配置：
- listen_address：要监听的 IP 地址和端口：
  - 0.0.0.0 侦听所有接口（推荐）
  - 端口 514 是标准 syslog 端口（在 Linux 上需要 root 权限；对于非 root 用户，请使用 1514）
导出器配置：
- creds_file_path：提取身份验证文件的完整路径：
  - Linux：/etc/bindplane-agent/ingestion-auth.json
  - Windows：C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
- customer_id：从 Google SecOps 控制台复制的客户 ID
- endpoint：区域端点网址：
  - 美国：malachiteingestion-pa.googleapis.com
  - 欧洲：europe-malachiteingestion-pa.googleapis.com
  - 亚洲：asia-southeast1-malachiteingestion-pa.googleapis.com
  - 如需查看完整列表，请参阅区域级端点

保存配置文件

修改后，保存文件：
- Linux：依次按 Ctrl+O、Enter 和 Ctrl+X
- Windows：依次点击文件 > 保存

重启 Bindplane 代理以应用更改

如需在 Linux 中重启 Bindplane 代理，请运行以下命令：

sudo systemctl restart observiq-otel-collector

验证服务是否正在运行：

```bash
sudo systemctl status observiq-otel-collector
```

检查日志是否存在错误：

```bash
sudo journalctl -u observiq-otel-collector -f
```

如需在 Windows 中重启 Bindplane 代理，请选择以下选项之一：
- 以管理员身份运行命令提示符或 PowerShell：
```
net stop observiq-otel-collector && net start observiq-otel-collector
```
- 服务控制台：
  1. 按 Win+R，输入 services.msc，然后按 Enter 键。
  2. 找到 observIQ OpenTelemetry 收集器。
  3. 右键点击并选择重新启动。
  4. 验证服务是否正在运行：
```
sc query observiq-otel-collector
```
  5. 检查日志是否存在错误：
```
type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
```

在 Check Point 防火墙中配置 syslog 导出

使用具有特权的账号登录 Check Point 防火墙界面。
依次前往日志和监控 > 日志服务器。
前往 Syslog 服务器。
点击配置，然后设置以下值：
- 协议：选择 UDP 以发送安全日志和/或系统日志。
- 名称：提供一个唯一名称（例如 Bindplane_Server）。
- IP 地址：提供您的 syslog 服务器 IP 地址（Bindplane IP）。
- 端口：提供您的 Syslog 服务器端口（Bindplane 端口）。
选择启用日志服务器。
选择要转发的日志：系统日志和安全日志。
点击应用。

UDM 映射表

日志字段	UDM 映射
`@timestamp`	`metadata.event_timestamp`
`__id`	`additional.fields`
`__nsons`	`additional.fields`
`__p_dport`	`additional.fields`
`__pos`	`additional.fields`
`_action`	`security_result.action_id`
`access_method`	`metadata.product_event_type`
`acks_total`	`additional.fields`
`act`	`security_result.action_details`
`Action`	`additional.fields`
`action_details`	`additional.fields`
`action_reason`	`security_result.detection_fields`
`Activity`	`security_result.summary`
`additional_info`	`security_result.description`, `security_result.detection_fields`
`administrator`	`target.user.userid`
`aggregated_log_count`	`security_result.detection_fields`
`alert`	`security_result.detection_fields`
`answer_rdata`	`additional.fields`
`app`	`principal.application`
`app_activity`	`security_result.description`
`app_category`	`security_result.category_details`
`app_desc`	`additional.fields`
`app_id`	`additional.fields`
`app_properties`	`additional.fields`, `security_result.detection_fields`
`app_risk`	`security_result.detection_fields`
`app_session_id`	`network.session_id`
`app_sig_id`	`additional.fields`
`appcategory`	`additional.fields`
`appi_name`	`security_result.detection_fields`
`application`	`principal.application`
`application_version`	`additional.fields`
`arrival_time`	`additional.fields`
`attachment_link`	`additional.fields`
`attachments_num`	`additional.fields`
`attack`	`security_result.threat_name`
`attack_info`	`security_result.description`
`attack_status`	`additional.fields`
`attack_traffic_bps`	`additional.fields`
`attackStatus`	`security_result.detection_fields`
`audit_status`	`additional.fields`
`auth_method`	`additional.fields`
`auth_status`	`security_result.summary`
`authentication_trial`	`additional.fields`
`authority_rdata`	`principal.resource.attribute.labels`
`authorization`	`security_result.detection_fields`
`bandwidth`	`security_result.detection_fields`
`best_practice_id`	`security_result.detection_fields`
`blade_name`	`security_result.detection_fields`
`browse_time`	`additional.fields`
`browser`	`network.http.user_agent`
`bytes`	`additional.fields`
`c_bytes`	`additional.fields`
`calc_desc`	`security_result.description`
`calc_service`	`additional.fields`
`cat`	`security_result.detection_fields`
`category`	`security_result.category_details`
`cb_bp_blade`	`additional.fields`
`cb_rate`	`additional.fields`
`cb_recommendation`	`additional.fields`
`cb_relevantobjectname`	`additional.fields`
`cb_relevantobjectstatus`	`additional.fields`
`cb_scan_id`	`security_result.detection_fields`
`cb_status`	`additional.fields`
`certificate_validity`	`additional.fields`
`client_inbound_bytes`	`principal.network.received_bytes`
`client_inbound_interface`	`additional.fields`
`client_inbound_packets`	`principal.network.received_packets`
`client_ip`	`principal.ip`, `principal.asset.ip`
`client_name`	`security_result.detection_fields`
`client_outbound_bytes`	`principal.network.sent_bytes`
`client_outbound_interface`	`additional.fields`
`client_outbound_packets`	`principal.network.sent_packets`
`client_to_gateway_ciphers`	`additional.fields`
`client_type_os`	`principal.platform`
`client_version.0`	`intermediary.platform_version`
`cloud_hourly_quota`	`additional.fields`
`cloud_hourly_quota_exceeded`	`additional.fields`
`cloud_hourly_quota_usage_for_quota_id`	`additional.fields`
`cloud_hourly_quota_usage_for_this_gw`	`additional.fields`
`cloud_hourly_remaining_quota`	`additional.fields`
`cloud_last_quota_update_gmt_time`	`additional.fields`
`cloud_monthly_quota`	`additional.fields`
`cloud_monthly_quota_exceeded`	`additional.fields`
`cloud_monthly_quota_period_end`	`additional.fields`
`cloud_monthly_quota_period_start`	`additional.fields`
`cloud_monthly_quota_usage_for_quota_id`	`additional.fields`
`cloud_monthly_quota_usage_for_this_gw`	`additional.fields`
`cloud_quota_description`	`additional.fields`
`cloud_quota_identifier`	`additional.fields`
`cloud_quota_status`	`additional.fields`
`cloud_remaining_quota`	`additional.fields`
`cluster_info`	`additional.fields`
`cn2`	`additional.fields`
`cn3`	`additional.fields`
`comment`	`security_result.description`
`community`	`additional.fields`
`condition`	`additional.fields`
`confidence_level`	`security_result.confidence`
`conn_direction`	`network.direction`, `additional.fields`
`connection_count`	`security_result.detection_fields`
`connection_luuid`	`additional.fields`
`connection_uid`	`additional.fields`
`consent_flag_status`	`additional.fields`
`consent_flag_value`	`additional.fields`
`content_disposition`	`target.file.names`
`content_length`	`target.file.size`
`content_risk`	`additional.fields`
`content_type`	`target.file.mime_type`
`context_num`	`additional.fields`
`contextnum`	`additional.fields`
`contract_name`	`security_result.detection_fields`
`control_log_type`	`additional.fields`
`controller`	`additional.fields`
`cookiei`	`additional.fields`
`cookier`	`additional.fields`
`cp_component_name`	`additional.fields`
`cp_component_version`	`additional.fields`
`creation_time`	`principal.asset.attribute.creation_time`
`cs2_second`	`intermediary.ip`, `intermediary.asset.ip`
`cu_detected_by`	`additional.fields`
`cu_detection_time`	`additional.fields`
`cu_log_count`	`additional.fields`
`cu_rule_category`	`security_result.rule_name`
`cu_rule_id`	`security_result.rule_id`
`current_value`	`additional.fields`
`d_name`	`security_result.detection_fields`
`data_type_name`	`security_result.detection_fields`
`date_value`	`additional.fields`
`datetime`	`metadata.event_timestamp`
`db_tag`	`security_result.detection_fields`
`db_ver`	`additional.fields`
`DCE_RPC_Interface_UID`	`additional.fields`
`dce-rpc_interface_uuid`	`additional.fields`
`dce-rpc_interface_uuid-1`	`additional.fields`
`dce-rpc_interface_uuid-2`	`additional.fields`
`dce-rpc_interface_uuid-3`	`additional.fields`
`dedup_time`	`additional.fields`
`default_device_message`	`additional.fields`
`delivery_time`	`additional.fields`
`desc`	`security_result.summary`
`description`	`security_result.detection_fields`
`description_url`	`additional.fields`
`Destination`	`additional.fields`
`destination_dns_hostname`	`target.hostname`, `target.asset.hostname`
`destinationAddress`	`target.ip`, `target.asset.ip`
`destinationDnsDomain`	`target.url`
`destinationPort`	`target.port`
`destinationTranslatedAddress`	`target.ip`, `target.asset.ip`, `target.nat_ip`
`destinationTranslatedPort`	`target.port`, `target.nat_port`
`detected_by`	`security_result.detection_fields`
`device`	`intermediary.ip`, `intermediary.asset.ip`
`device_identification`	`additional.fields`
`device_message`	`security_result.description`
`device_name`	`target.hostname`, `target.asset.hostname`
`device_type`	`target.resource.resource_subtype`
`deviceCustomNumber2`	`additional.fields`
`deviceCustomString2`	`security_result.rule_name`
`deviceDirection`	`network.direction`
`devTime`	`metadata.event_timestamp`
`direction`	`additional.fields`
`discard_traffic_bps`	`additional.fields`
`discard_traffic_pps`	`additional.fields`
`dlp_data_type_name`	`additional.fields`
`dlp_relevant_data_types`	`additional.fields`
`dlp_rule_name`	`additional.fields`
`dlp_transport`	`additional.fields`
`dn`	`additional.fields`
`dns_domain_name`	`target.hostname`, `target.asset.hostname`
`dns_message_type`	`security_result.detection_fields`
`dns_query_type`	`additional.fields`
`dns_query.queries`	`network.dns.questions.name`
`dns_type`	`additional.fields`
`domain`	`principal.administrative_domain`
`domain_name`	`principal.administrative_domain`
`dpt`	`target.port`
`drop_reason`	`security_result.summary`
`dst`	`target.ip`, `target.asset.ip`
`dst_country`	`target.location.country_or_region`
`dst_domain_name`	`target.hostname`, `target.asset.hostname`
`dst_ip`	`target.ip`, `target.asset.ip`
`dst_machine_name`	`target.user.email_addresses`
`dst_phone_number`	`target.user.phone_numbers`
`dst_port`	`target.port`
`dst_uo_icon`	`additional.fields`
`dst_uo_name`	`target.location.country_or_region`
`dst_user_dn`	`target.resource.attribute.labels`
`dst_user_name`	`target.user.user_display_name`
`dstBytes`	`additional.fields`
`dstkeyid`	`additional.fields`
`dstPostNAT`	`target.nat_ip`
`dstPostNATPort`	`target.nat_port`
`duration`	`network.session_duration.seconds`
`during_sec`	`additional.fields`
`dvc`	`target.ip`, `intermediary.ip`
`elapsed`	`additional.fields`
`email_content`	`security_result.description`
`email_control`	`additional.fields`
`email_queue_id`	`security_result.detection_fields`
`email_queue_name`	`security_result.detection_fields`
`email_session_id`	`additional.fields`
`email_status`	`security_result.detection_fields`
`email_subject`	`network.email.subject`
`emailSubject`	`network.email.subject`
`emulated_on`	`additional.fields`
`encryption_fail_reason`	`additional.fields`
`encryption_failure`	`security_result.description`
`environment_id`	`target.resource.product_object_id`
`Errors`	`security_result.description`
`euid`	`additional.fields`
`event_kind`	`additional.fields`
`event_name`	`metadata.description`
`event_start_time`	`additional.fields`
`extraction_download_time`	`additional.fields`
`extraction_time`	`additional.fields`
`extraction_total_time`	`additional.fields`
`failure_impact`	`additional.fields`
`failure_reason`	`additional.fields`
`feature_name`	`additional.fields`
`fg-1_client_in_rule_name`	`additional.fields`
`fg-1_client_out_rule_name`	`additional.fields`
`fieldschanges`	`security_result.detection_fields`
`file_count`	`additional.fields`
`file_direction`	`additional.fields`
`file_md5`	`target.file.md5`
`file_name`	`target.file.names`
`file_sha1`	`target.file.sha1`
`file_sha256`	`target.file.sha256`
`file_size`	`target.file.size`
`file_status`	`target.resource.attribute.labels`
`file_type`	`additional.fields`
`Firewall management node`	`security_result.detection_fields`
`firstname`	`principal.user.first_name`
`flags`	`additional.fields`
`flexString2`	`security_result.detection_fields`
`FollowUp`	`security_result.detection_fields`
`fragments_dropped`	`additional.fields`
`from`	`network.email.from`, `additional.fields`
`from_user`	`principal.user.userid`
`fservice`	`security_result.detection_fields`
`fw_message`	`additional.fields`
`fw_subproduct`	`metadata.product_name`
`gateway_to_server_ciphers`	`additional.fields`
`geoip_dst.country_name`	`target.location.country_or_region`
`h_version`	`security_result.detection_fields`
`has_accounting`	`additional.fields`
`header_ip_`	`intermediary.ip`, `intermediary.asset.ip`
`hll_key`	`additional.fields`
`host`	`target.hostname`, `target.asset.hostname`
`hostname`	`target.hostname`, `target.asset.hostname`
`http_host`	`target.ip`、 `target.asset.ip`（如果是 IP 地址）、 `target.hostname`（如果是主机名）
`http_server`	`target.application`
`http_status`	`network.http.response_code`
`https_inspection_action`	`additional.fields`
`https_inspection_rule_id`	`security_result.detection_fields`
`https_inspection_rule_name`	`security_result.detection_fields`
`https_validation`	`security_result.detection_fields`
`i_ip`	`intermediary.ip`, `intermediary.asset.ip`
`icmp`	`additional.fields`
`ICMP`	`additional.fields`
`icmp_code`	`additional.fields`
`ICMP_Code`	`additional.fields`
`icmp_type`	`additional.fields`
`ICMP_Type`	`additional.fields`
`id`	`metadata.product_log_id`
`identity_src`	`target.application`
`identity_type`	`additional.fields`, `extensions.auth.type`
`if_direction`	`network.direction`
`if_name`	`additional.fields`
`ifdir`	`network.direction`
`ifname`	`security_result.detection_fields`
`ike`	`security_result.description`
`ike_ids`	`additional.fields`
`Impact`	`additional.fields`
`indicator_name`	`security_result.detection_fields`
`indicator_uuid`	`security_result.detection_fields`
`industry_reference`	`additional.fields`
`Info`	`security_result.description`
`information`	`metadata.description`
`inspection_category`	`additional.fields`
`inspection_information`	`additional.fields`
`inspection_item`	`additional.fields`
`inspection_profile`	`additional.fields`
`install_policy_acceleration`	`additional.fields`
`instance_id`	`principal.hostname`, `principal.asset.hostname`
`instruction`	`additional.fields`
`inter_host`	`intermediary.ip`
`inter_host1`	`intermediary.hostname`
`inter_hostname_`	`intermediary.hostname`
`intermediary_application`	`intermediary.application`
`intermediary_hostname_`	`intermediary.ip`, `_intermediary.hostname`
`intermediary_ip`	`intermediary.ip`
`inzone`	`security_result.detection_fields`
`ip_address`	`target.resource.attribute.labels`
`ip_address`（从数据包中派生）	`principal.ip`
`ip_address2`（从数据包中派生）	`principal.ip`, `principal.asset.ip`
`ip_host`	`intermediary.ip`、 `intermediary.asset.ip`（如果是 IP 地址）、 `intermediary.hostname`（如果是主机名）
`ip_id`	`additional.fields`
`ip_len`	`additional.fields`
`ip_offset`	`additional.fields`
`ipv6_dst`	`target.ip`, `target.asset.ip`
`ipv6_src`	`principal.ip`, `principal.asset.ip`
`is_correlated`	`additional.fields`
`is_last`	`additional.fields`
`last_hit_time`	`security_result.last_discovered_time`
`last_rematch_time`	`additional.fields`
`lastchg`	`additional.fields`
`lastname`	`principal.user.last_name`
`lastupdatetime`	`security_result.last_updated_time`
`layer_name`	`security_result.rule_set_display_name`, `security_result.detection_fields`
`layer_name_match_table`	`additional.fields`（列表）
`layer_name_TP_match_table`	`additional.fields`（列表）
`layer_names`	`additional.fields.list`
`layer_uuid`	`security_result.rule_set`, `security_result.detection_fields`
`layer_uuid_match_table`	`additional.fields`（列表）
`layer_uuid_rule_uuid.0`	`security_result.rule_id`
`layer_uuids`	`additional.fields.list`
`level`	`security_result.detection_fields`
`Level`	`security_result.confidence_details`
`local_value`	`additional.fields`
`localhost`	`target.hostname`, `target.asset.hostname`
`log_attachment_uid`	`additional.fields`
`log_delay`	`additional.fields`
`log_id`	`metadata.product_log_id`
`log_link`	`additional.fields`
`log_sys_message`	`metadata.description`
`log_uid`	`additional.fields`
`log_version`	`metadata.product_version`
`logic_changes`	`security_result.detection_fields`
`logicchanges.FollowUp`	`security_result.detection_fields`
`logicchanges.Protection`	`security_result.detection_fields`
`logicchanges.Srcs_srcs`	`target.resource.product_object_id`
`logid`	`security_result.detection_fields`
`loguid`	`metadata.product_log_id`
`mac_address`	`principal.mac`
`machine`	`target.ip`
`maestro_gw`	`additional.fields`
`malware`	`security_result.detection_fields`
`malware_action`	`security_result.detection_fields`
`malware_family`	`security_result.detection_fields`, `security_result.about.resource.attribute.labels`
`malware_rule_id`	`security_result.detection_fields`
`malware_rule_id_TP_match_table`	`additional.fields`（列表）
`malware_rule_name`	`security_result.detection_fields`
`match_id`	`additional.fields`（列表）
`match_id_match_table`	`additional.fields`（列表）
`match_ids`	`security_result.detection_fields`
`matched_category`	`security_result.detection_fields`
`max_num_count_detected`	`additional.fields`
`max_vms_num`	`additional.fields`
`media_type`	`additional.fields`
`member_id`	`additional.fields`
`message_info`	`metadata.description`
`metadata.product_log_id_insertion_epoch_timestamp`	`metadata.collected_timestamp`
`method`	`network.http.method`
`methods`	`additional.fields`
`mgmt_value`	`additional.fields`
`mitre_collection`	`additional.fields`
`mitre_command_and_control`	`additional.fields`
`mitre_credential_access`	`additional.fields`
`mitre_defense_evasion`	`additional.fields`
`mitre_discovery`	`additional.fields`
`mitre_execution`	`additional.fields`
`mitre_exfiltration`	`additional.fields`
`mitre_impact`	`additional.fields`
`mitre_initial_access`	`security_result.detection_fields`
`mitre_lateral_movement`	`additional.fields`
`mitre_persistence`	`additional.fields`
`mitre_privilege_escalation`	`additional.fields`
`more_sources`	`principal.ip`
`msg`	`security_result.description`
`msgid`	`additional.fields`
`Name`	`security_result.detection_fields`, `security_result.about.resource.attribute.labels`
`nat_addtnl_rulenum`	`additional.fields`
`NAT_addtnl_rulenum`	`security_result.detection_fields`
`nat_rule_uid`	`additional.fields`
`nat_rulenum`	`security_result.detection_fields`
`NAT_rulenum`	`security_result.detection_fields`
`needs_browse_time`	`additional.fields`
`next_update_desc`	`additional.fields`
`num_of_updates`	`additional.fields`
`object`	`target.ip`
`objectname`	`additional.fields`
`objecttype`	`security_result.detection_fields`
`observable_comment`	`security_result.detection_fields`
`observable_id`	`security_result.detection_fields`
`observable_name`	`security_result.detection_fields`
`oid_prefix`	`additional.fields`
`operation`	`additional.fields`
`operation_number`	`security_result.detection_fields`
`operation_results`	`additional.fields`
`orig`	`principal.hostname`, `principal.asset.hostname`
`orig_log_server`	`principal.resource.product_object_id`
`orig_log_server_ip`	`principal.ip`, `principal.asset.ip`
`origin`	`intermediary.ip`、 `target.ip`、 `target.asset.ip`（当正文和目标机器详情均为 null 时）。
`origin_repetitions`	`additional.fields`
`origin_sic_name`	`intermediary.asset_id`
`originsicname`	`security_result.detection_fields`
`os`	`principal.platform`
`os_name`	`principal.asset.platform_software.platform`
`os_version`	`principal.asset.platform_software.platform_patch_level`
`outzone`	`security_result.detection_fields`
`p_hostname`	`principal.hostname`
`p_ip`	`principal.ip`, `principal.asset.ip`
`p_userid`	`principal.user.userid`
`p_username`	`principal.user.user_display_name`
`package_action`	`additional.fields`
`packet_amount`	`additional.fields`
`packet_capture_name`	`additional.fields`
`packet_capture_time`	`additional.fields`
`packet_capture_unique_id`	`additional.fields`
`packets`	`additional.fields`
`parameter`	`additional.fields`
`parent_rule`	`additional.fields`（列表）
`parent_rule_match_table`	`additional.fields`（列表）
`parent_rules`	`additional.fields.list`
`password_field`	`additional.fields`
`path`	`target.file.full_path`
`peer_gateway`	`target.ip`, `target.asset.ip`
`performance_impact`	`additional.fields`
`performanceImpAction`	`security_result.detection_fields`
`pid`	`principal.process.pid`
`platform_patch_level`	`principal.asset.platform_software.platform_patch_level`
`policy`	`additional.fields`
`policy_name`	`security_result.detection_fields`
`policy_time`	`security_result.detection_fields`
`policyNames`	`security_result.rule_set_display_name`
`port`	`additional.fields`
`port`（从数据包中派生）	`principal.port`
`port2`（从数据包中派生）	`target.port`
`portal_message`	`security_result.description`
`ppid`	`principal.process.parent_pid`
`precise_error`	`security_result.detection_fields`
`principal_hostname`	`principal.ip` 和 `principal.asset.ip`（当 `principal_hostname` 是有效的 IP 时）、 `principal.hostname`、 `principal.asset.hostname` 和 `intermediary.hostname`（所有其他情况）
`principal_ip`	`principal.ip`, `principal.asset.ip`
`product`	`metadata.product_name`
`product_event_type`	`metadata.product_event_type`
`product_family`	`additional.fields`
`product_log_id`	`metadata.product_log_id`
`ProductFamily`	`additional.fields`
`profile`	`security_result.detection_fields`
`Protection`	`security_result.detection_fields`
`protection_id`	`security_result.detection_fields`
`protection_name`	`security_result.detection_fields`, `security_result.about.resource.attribute.labels`
`protection_type`	`security_result.detection_fields`, `security_result.about.resource.attribute.labels`
`proto`	`additional.fields`
`protocol`	`network.application_protocol`
`proxy`	`security_resultc_ipprincipal.nat_ip`
`query`	`additional.fields`
`question_rdata`	`security_result.detection_fields`
`reason`	`security_result.summary`
`received_bytes`	`network.received_bytes`
`Reference`	`security_result.detection_fields`, `security_result.about.resource.attribute.labels`
`registered_ip_phones`	`additional.fields`
`reject_category`	`security_result.summary`
`reject_id_kid`	`security_result.detection_fields`
`resource`	`additional.fields.list_value`
`resource_name`	`target.resource.name`
`resource1`	`target.url`
`result`	`security_result.summary`
`roles`	`additional.fields`
`ROW_END`	`additional.fields`
`ROW_START`	`additional.fields`
`rt`	`metadata.event_timestamp`
`rule`	`security_result.rule_name`, `security_result.detection_fields`
`rule_action`	`security_result.action`, `security_result.detection_fields`
`rule_action_match_table`	`additional.fields`（列表）
`rule_actions`	`security_result.detection_fields`
`rule_id`	`security_result.rule_id`
`rule_name`	`security_result.rule_name`
`rule_name_match_table`	`additional.fields`（列表）
`rule_names`	`additional.fields`
`rule_uid"	`security_result.rule_id`
`rule_uid_match_table`	`additional.fields`（列表）
`rule_uids`	`security_result.detection_fields`, `additional.fields`
`s_port`	`additional.fields`
`scheme`	`additional.fields`
`scope`	`principal.ip`（如果它是 IP 地址）、 `additional.fields`（如果它不是 IP 地址）
`scrub_activity`	`additional.fields`
`securexl_message`	`additional.fields`
`security_inzone`	`security_result.detection_fields`
`security_outzone`	`security_result.detection_fields`
`segment_time`	`additional.fields`
`sendtotrackerasadvancedauditlog`	`security_result.detection_fields`
`sensor_alert_blade`	`additional.fields`
`sensor_alert_category`	`additional.fields`
`sensor_alert_duration`	`additional.fields`
`sensor_alert_id`	`additional.fields`
`sensor_alert_message`	`additional.fields`
`sensor_alert_module`	`additional.fields`
`sensor_alert_solution`	`additional.fields`
`sensor_alert_solution_sk`	`additional.fields`
`sensor_alert_title`	`additional.fields`
`sensor_alert_type`	`additional.fields`
`sensor_test_name`	`additional.fields`
`sent_bytes`	`network.sent_bytes`
`sequencenum`	`additional.fields`
`ser_agent_kid`	`security_result.detection_fields`
`server_inbound_bytes`	`network.sent_bytes`
`server_inbound_interface`	`additional.fields`
`server_inbound_packets`	`network.sent_bytes`
`server_kid`	`additional.fields`
`server_outbound_bytes`	`network.received_bytes`
`server_outbound_interface`	`target.resource.attribute.labels`
`server_outbound_packets`	`network.received_bytes`
`service`	`target.port`
`service_id`	`additional.fields`
`session_description`	`security_result.detection_fields`
`session_id`	`network.session_id`
`session_name`	`security_result.detection_fields`
`session_uid`	`network.session_id`
`sev`	`security_result.severity`
`severity`	`security_result.detection_fields`
`Severity`	`security_result.severity`
`sig_id`	`additional.fields`
`signature`	`security_result.threat_name`
`site`	`network.http.user_agent`
`smartdefense_profile`	`security_result.detection_fields`
`smartdefense_profile_TP_match_table`	`additional.fields`（列表）
`sni`	`additional.fields`
`snid`	`network.session_id`
`Source`	`target.resource.attribute.labels`
`source_os`	`additional.fields`
`sourceAddress`	`principal.ip`, `principal.asset.ip`
`sourcePort`	`principal.port`
`sourceTranslatedAddress`	`principal.ip`, `principal.asset.ip`, `principal.nat_ip`
`sourceTranslatedPort`	`principal.port`, `principal.nat_port`
`sourceUserName`	`match => { "sourceUserName" => [ "%{DATA:firstname}( %{DATA:lastname})? \\\(%{DATA:userid}\\\)"]}`
`special_attack`	`additional.fields`
`spt`	`principal.port`
`sr_url`	`security_result.about.url`
`src`	`principal.ip`、 `principal.hostname`、 `principal.asset.ip`、 `principal.asset.hostname`
`src_domain_name`	`principal.hostname`, `principal.asset.hostname`
`src_ip`	`principal.ip`, `principal.asset.ip`
`src_localhost`	`principal.hostname`, `principal.asset.hostname`
`src_machine_group`	`principal.resource.attribute.labels`
`src_machine_name`	`principal.user.email_addresses`
`src_port`	`principal.port`
`src_uo_icon`	`additional.fields`
`src_uo_name`	`principal.location.country_or_region`
`src_user`	`principal.user.userid`
`src_user_dn`	`principal.resource.attribute.labels`
`src_user_group`	`principal.resource.attribute.labels`
`src_user_name`	`principal.user.userid`
`srcBytes`	`additional.fields`
`srcip`	`additional.fields`
`srcPort`	`principal.port`
`srcPostNAT`	`principal.nat_ip`
`srcPostNATPort`	`principal.nat_port`
`Srcs`	`security_resultcstarget.resource.attribute.labels`
`srv_ip`	`target.ip`
`ssh_connection_stage`	`additional.fields`
`sshd_function`	`additional.fields`
`start_time`	`metadata.collected_timestamp`
`status`	`security_result.action_details`, `security_result.detection_fields`, `security_result.action`
`stormagentaction`	`additional.fields`
`stormagentname`	`additional.fields`
`sub_policy_name`	`security_result.detection_fields`
`sub_policy_uid`	`security_result.detection_fields`
`subject`	`metadata.description`
`subscription_description`	`additional.fields`
`subscription_stat`	`security_result.detection_fields`
`subscription_stat_desc`	`security_result.summary`
`subscription_status`	`security_result.detection_fields`
`suppressed_logs`	`security_result.detection_fields`
`svc`	`target.port`
`sys_message`	`additional.fields`
`syslog_date`	`additional.fields`
`syslog_facility_code`	`additional.fields`
`syslog_pri`	`additional.fields`
`system_alert_message`	`additional.fields`
`system_application`	`additional.fields`
`tags`	`security_result.detection_fields`
`tar_user`	`target.user.userid`
`tar_userid`	`target.user.userid`
`tar_username`	`target.user.user_display_name`
`target_port`	`target.port`
`tcp_flags`	`additional.fields`
`tcp_packet_out_of_state`	`security_result.detection_fields`
`te_verdict_determined_by`	`additional.fields`
`temp_duser`	`target.user.email_addresses`
`tid`	`security_result.detection_fields`
`time`	`metadata.event_timestamp`
`time_interval`	`additional.fields`
`tls_server_host_name`	`additional.fields`
`to`	`network.email.to`, `additional.fields`
`TP_match_table`	`additional.fields`
`Track`	`additional.fields`
`two-factor_authentication`	`security_result.detection_fields`
`type`	`security_result.rule_type`
`uid`	`additional.fields`
`UP_match_table`	`additional.fields`
`update_count`	`additional.fields`
`update_service`	`additional.fields`
`update_status`	`security_result.action`, `security_result.action_details`
`url`	`principal.url`
`url_count`	`additional.fields`
`user`	`principal.user.user_display_name`
`user_agent`	`network.http.user_agent`, `network.http.parsed_user_agent`
`usercheck_interaction_name`	`security_result.rule_name`
`userid`	`principal.user.userid`
`userip`	`principal.ip`, `principal.asset.ip`
`UUid`	`metadata.product_log_id`
`validation_log`	`additional.fields`
`vendor_list`	`security_result.detection_fields`
`vendor_name`	`metadata.vendor_name`
`verdict`	`security_result.verdict_info.verdict_response`
`version`	`metadata.product_version`
`version_`	`additional.fields`
`via`	`additional.fields`
`voip_call_dir`	`additional.fields`
`voip_call_id`	`network.session_id`
`voip_call_state`	`additional.fields`
`voip_duration`	`additional.fields`
`voip_log_type`	`additional.fields`
`voip_media_ipp`	`additional.fields`
`voip_media_port`	`additional.fields`
`voip_method`	`additional.fields`
`voip_reason_info`	`additional.fields`
`voip_reg_ip`	`additional.fields`
`voip_reg_ipp`	`additional.fields`
`voip_reg_period`	`additional.fields`
`voip_reg_port`	`additional.fields`
`voip_reg_server`	`additional.fields`
`voip_reject_reason`	`additional.fields`
`VPN`	`additional.fields`
`vpn_feature_name`	`additional.fields`
`watermark`	`additional.fields`
`web_client_type`	`network.useragent`
`web_client_type.0`	`network.http.user_agent`, `network.http.parsed_user_agent`
`xlatedport`	`target.nat_port`
`xlatedst`	`target.nat_ip`
`xlatesport`	`principal.nat_port`
`xlatesrc`	`principal.nat_ip`

发布增量

2026 年 3 月 1 日，Google SecOps 发布了新版 Check Point 防火墙解析器，其中包含对 Parser_Name 日志字段到 UDM 字段的映射以及事件类型映射的重大更改。

日志字段映射增量

下表列出了 2026 年 3 月 1 日之前和之后公开的 Check Point 防火墙日志到 UDM 字段的映射增量（分别列在旧映射和当前映射列中）：

日志字段	旧映射	当前映射
`client_inbound_bytes`	`princiapal.resource.attribute_labels`	`principal.network.received_bytes`
`client_outbound_bytes`	`princiapal.resource.attribute_labels`	`principal.network.sent_bytes`
`lastupdatetime`	`additional.fields`	`security_result.last_updated_time`
`layer_names`	`security_result.detection_fields`	`additional.fields.list`
`layer_uuids`	`security_result.detection_fields`，`additional.fields`	`additional.fields.list`
`operation`	`security_result.detection_fields`	`additional.fields`
`originsicname`	`intermediary.labels`	`security_resul.detection_fields`
`parent_rules`	`additional.fields`	`additional.fields.list`
`pid`	`additional.fields`	`principal.process.pid`
`scope`	`additional.fields`	`principal.ip`（如果它是 IP 地址）、 `additional.fields`（如果它不是 IP 地址）
`server_inbound_bytes`	`target.resource.attribute.labels`，`network.sent_bytes`	`network.sent_bytes`
`server_inbound_packets`	`target.resource.attribute.labels`、`network.sent_packets`	`network.sent_packets`
`server_outbound_bytes`	`target.resource.attribute.labels`、`network.received_bytes`	`network.received_bytes`
`server_outbound_packets`	`target.resource.attribute.labels`，`network.received_packets`	`network.received_packets`
`src_machine_name`	`additional.fields`	`principal.user.email_addresses`
`src_user_dn`	`sr.detection_fields`	`principal.resource.attribute.labels`
`suppressed_logs`	`additional.fields`	`security_result.detection_fields`
`web_client_type`	`additional.fields`	`network.useragent`

事件类型映射增量

之前被归类为通用类别的多个事件现在已正确归类为有意义的事件类型。

下表列出了 2026 年 3 月 1 日之前和之后 Check Point 防火墙事件类型处理方式的差异（分别列在旧 event_type 和当前 event_type 列中）：

格式	日志中的事件 ID	旧 event_type	当前 event_type
SYSLOG+KV	日志包含 `sourceAddress` 和 `host`	`GENERIC_EVENT`	`NETWORK_CONNECTION`
SYSLOG+JSON	日志包含 `sourceAddress` 和 `host`	`NETWORK_HTTP`	`NETWORK_CONNECTION`
SYSLOG+JSON	日志包含 `sourceAddress` 和 `host`	`NETWORK_HTTP`	`NETWORK_CONNECTION`

更新日志

查看相应解析器的更改日志