收集 Palo Alto Prisma Cloud 提醒日志

支持的平台：

此解析器以 JSON 格式从 Palo Alto Prisma Cloud 提取提醒日志，并将其转换为 UDM。解析器会执行数据标准化、类型转换和条件逻辑，以填充相应的 UDM 字段。它还可以处理日志数据中的嵌套 JSON 结构和数组，以提取相关信息。本文档中的信息适用于具有 PAN_PRISMA_CA 注入标签的解析器。

准备工作

确保您满足以下前提条件：

  • Google SecOps 实例。
  • 对 Palo Alto Prisma Cloud 的特权访问权限。

设置 Feed

如需配置 Feed，请按以下步骤操作：

  1. 依次前往 SIEM 设置 > Feed。
  2. 点击添加新 Feed。
  3. 在下一页上，点击配置单个 Feed。
  4. 在 Feed 名称字段中，输入 Feed 的名称，例如 PAN Prisma Cloud 提醒。
  5. 选择 Webhook 作为来源类型。
  6. 选择 Palo Alto Prisma Cloud 提醒载荷作为日志类型。
  7. 点击下一步。
  8. 可选：为以下输入参数指定值：
    • 拆分定界符：用于分隔日志行的定界符，例如 \n。
  9. 点击下一步。
  10. 在最终确定界面中查看 Feed 配置，然后点击提交。
  11. 点击生成密钥，生成用于对此 Feed 进行身份验证的密钥。
  12. 复制并存储密钥。您将无法再次查看此密钥。如有需要，您可以重新生成新的 Secret 密钥，但此操作会使之前的 Secret 密钥失效。
  13. 在详情标签页中，从端点信息字段复制 Feed 端点网址。您需要在客户端应用中指定此端点网址。
  14. 点击完成。

为 webhook Feed 创建 API 密钥

  1. 前往 Google Cloud 控制台 > 凭据。

    转到“凭据”页面

  2. 点击创建凭据，然后选择 API 密钥。

  3. 将 API 密钥访问权限限制为 Google Security Operations API。

指定端点网址

  1. 在客户端应用中，指定 webhook Feed 中提供的 HTTPS 端点网址。

  2. 通过在自定义标头中指定 API 密钥和密钥来启用身份验证，格式如下：

    X-goog-api-key = API_KEY
X-Webhook-Access-Key = SECRET

    建议：将 API 密钥指定为标头，而不是在网址中指定。

  3. 如果您的 Webhook 客户端不支持自定义标头，您可以使用以下格式的查询参数指定 API 密钥和密钥：

    ENDPOINT_URL?key=API_KEY&secret=SECRET

    替换以下内容：

    • ENDPOINT_URL：Feed 端点网址。
    • API_KEY：用于向 Google Security Operations 进行身份验证的 API 密钥。
    • SECRET：您生成的用于验证 Feed 的密钥。

将 Palo Alto Prisma Cloud Webhook 配置为 Google SecOps

  1. 登录 Palo Alto Prisma Cloud。
  2. 依次选择设置 > 集成和通知 ((and_then)) 集成。
  3. 点击添加集成。
  4. 选择 Webhook。
  5. 为以下输入参数指定值：
    • 集成名称：提供一个唯一且描述性的名称（例如 Google SecOps）
    • 网络钩子网址：输入 ENDPOINT_网址。
    • 可选：提供集成的说明。
    • 可选：启用自定义载荷 > 点击下一步以查看或修改自定义载荷。
  6. 点击下一步。
  7. 测试和保存集成。

配置 Palo Alto Prisma Cloud 提醒

  1. 在 Palo Alto Prisma Cloud 控制台中，依次前往 Alerts > View Alert Rules。
  2. 选择要修改的现有提醒规则。
  3. 可选：为 Cloud Infrastructure 创建新提醒。
  4. 可选：为 Cloud Workload 创建新提醒。
  5. 前往配置通知。
  6. 选择 Webhook。
  7. 可选：选择您希望在提醒规则触发提醒时发送通知的渠道。
  8. 点击下一步。
  9. 点击保存。

UDM 映射表

本部分介绍解析器如何将原始日志字段映射到 Unified Data Model (UDM) 字段。

日志结构 1：包含记录数组的日志（非汇总的提醒）

原始日志字段 UDM 字段 备注
alarmType security_result.detection_fields key = "alarmType"
app principal.application
body additional.fields key = "正文"
body（账号 ID） target.user.userid 从正文字符串“(Account ID:xxxxx)”中提取
errorMessage metadata.description
errorType security_result.detection_fields key = "errorType"
notificationRuleName security_result.rule_name
policyDescription security_result.detection_fields
policyRecommendation security_result.detection_fields
policytype security_result.detection_fields
record._id additional.fields key = "ID {index}"
record.account.cloudType principal.cloud.environment 如果为“gcp”，则映射到枚举
record.accountID target.resource.attribute.labels key = "账号 ID {index}"
record.accountId target.cloud.project.id
record.accountName target.resource.attribute.labels key = "accountName"
record.accountOwners principal.user.email_addresses 已合并数组元素
record.acknowledged security_result.detection_fields key = "Acknowledged {index}"
record.additionalInfo.saveSearchId security_result.detection_fields key = "saveSearchId"
record.alertId security_result.detection_fields key = "提醒 ID"
record.alertRuleId security_result.rule_id
record.alertRuleName security_result.rule_name 可能会覆盖 record.audits.ruleName
record.alertStatus security_result.detection_fields key = "提醒状态"
record.alertTs security_result.detection_fields key = "alertTs"
record.audits._id additional.fields key = "Audit ID {audit_index}"
record.audits.attackTechniques additional.fields key = "attackTechniques_{audit_index}"
record.audits.attackType security_result.threat_name 在 record.audits 循环内
record.audits.command principal.process.command_line 在 record.audits 循环内
record.audits.container additional.fields key = "Container {audit_index}"
record.audits.count additional.fields key = "Count {audit_index}"
record.audits.effect security_result.action_details 在 record.audits 循环内
record.audits.msg metadata.description 在 record.audits 循环内
record.audits.os principal.platform_version 在 record.audits 循环内
record.audits.pid principal.process.pid 在 record.audits 循环内
record.audits.processPath principal.process.file.full_path 在 record.audits 循环内
record.audits.ruleName security_result.rule_name 在 record.audits 循环内
record.audits.severity security_result.severity 在 record.audits 循环内
record.audits.type metadata.product_event_type 在 record.audits 循环内
record.audits.user principal.user.userid 在 record.audits 循环内
record.callbackUrl metadata.url_back_to_product
record.category security_result.category_details
record.cloudType principal.cloud.environment key = "政策标签"
record.cluster principal.resource.attribute.labels key = "Cluster {index}"
record.collections additional.fields key = "Collections {index}"
record.complianceMetadata.complianceId security_result.detection_fields
record.complianceMetadata.customAssigned security_result.detection_fields
record.complianceMetadata.policyId security_result.detection_fields
record.complianceMetadata.requirementId security_result.rule_id
record.complianceMetadata.requirementName security_result.summary 子字段中的各种键
record.complianceMetadata.requirementViewOrder security_result.detection_fields
record.complianceMetadata.sectionDescription security_result.detection_fields
record.complianceMetadata.sectionId security_result.detection_fields
record.complianceMetadata.sectionLabel security_result.detection_fields
record.complianceMetadata.sectionViewOrder security_result.detection_fields
record.complianceMetadata.standardDescription security_result.detection_fields
record.complianceMetadata.standardName security_result.rule_name
record.complianceMetadata.systemDefault security_result.detection_fields
record.containerID principal.asset.asset_id 前缀“containerid:”
record.containerName principal.application，principal.resource.name
record.firstSeen principal.asset.first_seen_time
record.fqdn principal.hostname，principal.asset.hostname
record.hasFinding security_result.detection_fields key = "hasFinding"
record.hostname principal.hostname，principal.asset.hostname
record.imageID principal.resource.attribute.labels key = "图片 ID {index}"
record.imageName principal.resource.attribute.labels key = "Image Name {index}"
record.lastSeen principal.asset.last_discover_time
record.message1 security_result.description
record.namespace principal.namespace
record.policy.description security_result.detection_fields key = "policyDescription"（回退）
record.policy.id security_result.detection_fields key = "policy id"
record.policy.Labels additional.fields 如果为“gcp”，则映射到枚举
record.policy.name security_result.description 可能会覆盖 record.message1
record.policy.policyType security_result.detection_fields key = "policy type"（回退）
record.policy.recommendation security_result.detection_fields key = "policy recommendation"（后备）
record.policy.severity security_result.severity
record.policyDescription security_result.detection_fields key = "policyDescription"
record.policyId security_result.detection_fields key = "policyId"
record.policyLabels additional.fields
record.policyName security_result.description 可能会覆盖 record.policy.name
record.policyRecommendation security_result.detection_fields key = "政策建议"
record.policyType security_result.detection_fields key = "policy type"
record.profileID additional.fields key = "Profile ID {index}"
record.provider target.resource.attribute_labels key = "Provider %{index}"
record.reason security_result.summary
record.region principal.location.country_or_region
record.resource principal.resource.attribute.labels key = "resource {key}"（对于资源中的其他键）
record.resource.account principal.resource.attribute.labels
record.resource.account target.resource.product_object_id
record.resource.accountId principal.resource.attribute.labels
record.resource.accountId target.cloud.project.id 后备
record.resource.data.document.Statement additional.fields key = "Statement{key}{stmt_index}"
record.resource.data.document.Version additional.fields key = "版本"
record.resource.data.entities.policyRoles additional.fields key = "policyRole{key}{role_index}"
record.resource.data.isAttached security_result.detection_fields key = "isAttached"
record.resource.data.isDefaultVersion security_result.detection_fields key = "isDefaultVersion"
record.resource.data.isPermissionBoundarySet security_result.detection_fields key = "isPermissionBoundarySet"
record.resource.data.secretVersionsToStages.terraform-20260122172341570100000002 principal.resource.attribute.labels 数组中每个元素的键 = "value: {index_1}"
record.resource.data.tags additional.fields key = "{tag_key} {index} {tag_index}"
record.resource.id principal.resource.attribute.labels
record.resource.name principal.resource.attribute.labels
record.resource.region principal.resource.attribute.labels
record.resource.regionId principal.resource.attribute.labels
record.resource.resourceType principal.resource.attribute.labels
record.resource.resourceType principal.resource.resource_subtype 后备
record.resource.url principal.resource.attribute.labels
record.resource.url principal.url 如果键为“url”
record.resourceCloudService principal.resource.attribute.labels key = "resource cloud service"
record.resourceId principal.resource.product_object_id
record.resourceName principal.resource.name 可能会覆盖 record.containerName
record.resourceRegion principal.location.country_or_region 可能会覆盖 record.region
record.resourceRegionId principal.cloud.availability_zone
record.resourceType principal.resource.resource_subtype
record.sender metadata.description 可能会覆盖 record.audits.msg
record.sentTs metadata.event_timestamp
record.serialNum additional.fields key = "序列号 {index}"
record.severity security_result.severity
record.shouldCollect additional.fields key = "Should Collect {index}"
record.source principal.application
record.tags principal.resource.attribute.labels key = "{tag_key} {index} {tag_index}"
record.time metadata.event_timestamp
record.type principal.resource.type
severity security_result.severity LOW、MEDIUM、HIGH、UNKNOWN
title additional.fields key = "title"
alarmType event.idm.read_only_udm.security_result.detection_fields 从变更日志映射
errorType event.idm.read_only_udm.security_result.detection_fields 从变更日志映射
isPermissionBoundarySet event.idm.read_only_udm.security_result.detection_fields 从变更日志映射
isDefaultVersion event.idm.read_only_udm.security_result.detection_fields 从变更日志映射
isAttached event.idm.read_only_udm.security_result.detection_fields 从变更日志映射
emailValue principal.user.email_addresses 从变更日志映射
account_id target.user.userid 从变更日志映射
record.region principal.location.country_or_region 从变更日志映射
record.policy.name security_result.description 从变更日志映射
record.account.cloudType principal.cloud.environment 从变更日志映射
record.policy.policyType", "record.policy.recommendation", and "record.policy.description security_result.detection_fields 从变更日志映射
record.policy.severity security_result.severity 从变更日志映射
record.policy.labels additional.fields 从变更日志映射
callbackUrl metadata.url_back_to_product 从变更日志映射
errorMessage metadata.description 从变更日志映射
notificationRuleName security_result.rule_name 从变更日志映射
body", "title additional.fields 从变更日志映射
alarmType principal.cloud.environment 从变更日志映射
severity security_result.severity 从变更日志映射
aggregatedAlert.vulnerabilities.imageID extensions.vulns.vulnerabilities.about.file.sha256 从变更日志映射
aggregatedAlert.vulnerabilities.imageName extensions.vulns.vulnerabilities.about.file.path 从变更日志映射
aggregatedAlert.vulnerabilities.distribution extensions.vulns.vulnerabilities.name 从变更日志映射
aggregatedAlert.vulnerabilities.newVulnerabilities.severity extensions.vulns.vulnerabilities.severity 从变更日志映射
aggregatedAlert.vulnerabilities.newVulnerabilities.cve extensions.vulns.vulnerabilities.cve_id 从变更日志映射
aggregatedAlert.vulnerabilities.newVulnerabilities.link extensions.vulns.vulnerabilities.about.url 从变更日志映射
aggregatedAlert.vulnerabilities.newVulnerabilities.status extensions.vulns.vulnerabilities.description 从变更日志映射
aggregatedAlert.vulnerabilities.newVulnerabilities.packages", "aggregatedAlert.vulnerabilities.newVulnerabilities.packageVersion", and "aggregatedAlert.vulnerabilities.newVulnerabilities.sourcePackage target.resource.attribute.labels 从变更日志映射
policyLabels additional.fields 从变更日志映射
policyType security_result.detection_fields 从变更日志映射
resource.unifiedAssetId principal.asset.asset_id 从变更日志映射
policyName security_result.description 从变更日志映射
resource.resourceConfigJsonAvailable", "resource.resourceDetailsAvailable", and "policy.deleted additional.fields 从变更日志映射
policy.recommendation", "policy.policyType", and "policy.description security_result.detection_fields 从变更日志映射
resource.url principal.url 从变更日志映射
reason security_result.summary 从变更日志映射
resource.region principal.location.state 从变更日志映射
resource.regionId principal.location.country_or_region 从变更日志映射
resource.resourceType target.resource.resource_subtype 从变更日志映射
resource.accountId target.resource.product_object_id 从变更日志映射
resourceId principal.resource.product_object_id 从变更日志映射
accountId target.resource.product_object_id 从变更日志映射
alertRuleName security_result.rule_name 从变更日志映射
accountName target.resource.name 从变更日志映射
hasFinding security_result.detection_fields 从变更日志映射
resourceRegionId principal.cloud.availability_zone 从变更日志映射
source principal.application 从变更日志映射
alertRuleId security_result.rule_id 从变更日志映射
alertId security_result.detection_fields 从变更日志映射
resourceName principal.resource.name 从变更日志映射
resourceRegion principal.location.country_or_region 从变更日志映射
policyDescription security_result.detection_fields 从变更日志映射
policyRecommendation security_result.detection_fields 从变更日志映射
resourceCloudService principal.resource.attribute.labels 从变更日志映射
alertTs security_result.detection_fields 从变更日志映射
firstSeen principal.asset.first_seen_time 从变更日志映射
lastSeen principal.asset.last_discover_time 从变更日志映射
alertStatus security_result.detection_fields 从变更日志映射

日志结构 2：包含 records[].aggregatedAlerts 数组的日志

原始日志字段 UDM 字段 备注
aggregatedAlert.accountIDs target.resource.attribute.labels key = "AccountID {alert_index} {acct_index}"
aggregatedAlert.appID security_result.detection_fields key = "appID"
aggregatedAlert.category security_result.category_details 附加到类型
aggregatedAlert.clusters target.resource.attribute.labels key = "Cluster {alert_index} {clus_index}"
aggregatedAlert.collections target.resource.attribute.labels key = "Collection {alert_index} {coll_index}"
aggregatedAlert.command principal.process.command_line，security_result.detection_fields detection_fields key = "Command"
aggregatedAlert.complianceIssues.category security_result.category_details 在 complianceIssues 循环内
aggregatedAlert.complianceIssues.description security_result.description，security_result.detection_fields detection_fields 键 = "Description {alert_index} {ci_index}"
aggregatedAlert.complianceIssues.severity security_result.severity，security_result.detection_fields detection_fields 键 = "Severity {alert_index} {ci_index}"
aggregatedAlert.complianceIssues.title security_result.action_details，security_result.detection_fields detection_fields key = "Title {alert_index} {ci_index}"
aggregatedAlert.container target.resource.name
aggregatedAlert.containerID target.resource.product_object_id
aggregatedAlert.forensics principal.url
aggregatedAlert.fqdn principal.domain.name
aggregatedAlert.host principal.hostname，principal.asset.hostname
aggregatedAlert.image target.resource.attribute.labels key = "image"
aggregatedAlert.imageID target.resource.attribute.labels key = "imageID"
aggregatedAlert.incidentTime target.resource.attribute.labels key = "incidentTime"
aggregatedAlert.labels.controller-uid target.user.product_object_id
aggregatedAlert.labels.io.kubernetes.pod.name target.hostname
aggregatedAlert.message1 security_result.description
aggregatedAlert.namespaces target.resource.attribute.labels key = "Namespace {alert_index} {ns_index}"
aggregatedAlert.osDistro security_result.detection_fields key = "osDistro"
aggregatedAlert.osRelease security_result.detection_fields key = "osRelease"
aggregatedAlert.provider security_result.detection_fields key = "provider"
aggregatedAlert.region target.cloud.availability_zone
aggregatedAlert.rule security_result.rule_name
aggregatedAlert.runtime security_result.detection_fields key = "runtime"
aggregatedAlert.startupProcess principal.process.parent_process.command_line
aggregatedAlert.tags security_result.detection_fields key = "tags"
aggregatedAlert.time metadata.event_timestamp
aggregatedAlert.type security_result.category_details
aggregatedAlert.user principal.user.userid
aggregatedAlert.vulnerabilities.distribution extensions.vulns.vulnerabilities.name
aggregatedAlert.vulnerabilities.imageID extensions.vulns.vulnerabilities.about.file.sha256 提取 sha256
aggregatedAlert.vulnerabilities.imageName extensions.vulns.vulnerabilities.about.file.full_path
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.cve extensions.vulns.vulnerabilities.cve_id
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.link extensions.vulns.vulnerabilities.about.url
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.packages target.resource.attribute.labels key = "Packages {vln_idx1}-{vln_idx2}"
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion target.resource.attribute.labels key = "PackageVersion {vln_idx1}-{vln_idx2}"
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.severity extensions.vulns.vulnerabilities.severity
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage target.resource.attribute.labels key = "SourcePackage {vln_idx1}-{vln_idx2}"
aggregatedAlert.vulnerabilities.newVulnerabilities.vulnerabilities.status extensions.vulns.vulnerabilities.description 前缀“状态 - ”

日志结构 3：单个 JSON 对象日志（后备）

原始日志字段 UDM 字段 备注
"CASB"（静态价值） metadata.product_name
"Palo Alto Networks"（静态价值） metadata.vendor_name
accountId target.resource.product_object_id，target.resource.id
actionParameters.clientID principal.group.product_object_id 来自用户请求
complianceMetadata security_result.detection_fields 各不相同，请参阅配置了解详情
createdAt metadata.event_timestamp 来自用户请求
data.allocationId principal.resource.product_object_id
data.publicIp principal.ip
deleted additional.fields key = "deleted"
description metadata.description
email_add principal.user.email_addresses
entitySnapshot.externalId principal.group.product_object_id 来自用户请求
entitySnapshot.tags.io.cri-containerd.kind target.resource.attribute.labels key = "Containerd Kind"
entitySnapshot.tags.io.kubernetes.container.name target.resource.attribute.labels key = "Container Name"
entitySnapshot.tags.io.kubernetes.pod.name target.resource.attribute.labels key = "Pod Name"
entitySnapshot.tags.io.kubernetes.pod.namespace target.resource.attribute.labels key = "Pod Namespace"
entitySnapshot.tags.io.kubernetes.pod.uid target.resource.attribute.labels key = "Pod Id"
entitySnapshot.tags.maintainer target.resource.attribute.labels key = "Maintainer"
policy Type security_result.detection_fields
policy.complianceMetadata.complianceId security_result.detection_fields
policy.complianceMetadata.customAssigned security_result.detection_fields
policy.complianceMetadata.policyId security_result.detection_fields
policy.complianceMetadata.requirementId security_result.rule_id
policy.complianceMetadata.requirementName security_result.summary 子字段中的各种键
policy.complianceMetadata.requirementViewOrder security_result.detection_fields
policy.complianceMetadata.sectionDescription security_result.detection_fields
policy.complianceMetadata.sectionId security_result.detection_fields
policy.complianceMetadata.sectionLabel security_result.detection_fields
policy.complianceMetadata.standardDescription security_result.detection_fields
policy.complianceMetadata.standardName security_result.rule_name
policy.complianceMetadata.systemDefault security_result.detection_fields
policy.deleted additional.fields deleted"（后备）
policy.description security_result.detection_fields key = "policyDescription"
policy.name security_result.description
policy.policyType security_result.detection_fields key = "Policy Type"（回退）
policy.recommendation security_result.detection_fields key = "Recommendation"（后备）
policyId security_result.detection_fields key = "政策 ID"
policyType security_result.detection_fields key = "政策类型"
reason security_result.summary
recommendation security_result.detection_fields key = "Recommendation"
region principal.location.state
regionId principal.location.country_or_region
resource.accountId target.resource.product_object_id，target.resource.id 后备
resource.cloudType principal.cloud.environment 如果为“gcp”，则映射到枚举
resource.region principal.location.state 后备
resource.regionId principal.location.country_or_region 后备
resource.resourceConfigJsonAvailable additional.fields key = "resourceConfigJsonAvailable"（后备）
resource.resourceDetailsAvailable additional.fields key = "resourceDetailsAvailable"（后备）
resource.resourceType target.resource.resource_subtype 后备
resource.unifiedAssetId principal.asset.asset_id 后备
resource.url principal.url
resourceConfigJsonAvailable additional.fields key = "resourceConfigJsonAvailable"
resourceDetailsAvailable additional.fields key = "resourceDetailsAvailable"
resourceType target.resource.resource_subtype
severity security_result.severity
systemDefault additional.fields key = "systemDefault"
timestamp metadata.event_timestamp 来自用户请求
unifiedAssetId principal.asset.asset_id 前缀“ASSETID:”

活动类型映射

  • metadata.event_type 字段是根据以下逻辑设置的：

    if [has_user] == "true" and ([has_principal] == "true" or [has_target] == "true") {
    metadata.event_type = USER_UNCATEGORIZED
if [aggregatedAlert][host] != "" and [target_present] == "true" and [principal_user_present] != "true" {
    metadata.event_type = USER_RESOURCE_ACCESS
    } else if [principal_user_present] == "true" {
        metadata.event_type = USER_UNCATEGORIZED
    } else if [principal_present] == "true" and [aggregatedAlert][host] != "" {
        metadata.event_type = STATUS_UPDATE
    } else {
        metadata.event_type = GENERIC_EVENT
    }
}

更新日志

查看相应解析器的更改日志

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。