收集 Palo Alto Prisma Cloud 提醒日志

支持的平台：

Google SecOps SIEM

此解析器以 JSON 格式从 Palo Alto Prisma Cloud 提取提醒日志，并将其转换为 UDM。解析器会执行数据规范化、类型转换和条件逻辑，以填充相应的 UDM 字段。它还可以处理日志数据中的嵌套 JSON 结构和数组，以提取相关信息。本文档中的信息适用于具有 PAN_PRISMA_CA 注入标签的解析器。

准备工作

确保您满足以下前提条件：

• Google SecOps 实例。
• 对 Palo Alto Prisma Cloud 的特权访问权限。

设置 Feed

如需配置 Feed，请按以下步骤操作：

1. 依次前往 SIEM 设置 > Feed。
2. 点击添加新 Feed。
3. 在下一页上，点击配置单个 Feed。
4. 在 Feed 名称字段中，输入 Feed 的名称，例如 PAN Prisma Cloud 提醒。
5. 选择 Webhook 作为来源类型。
6. 选择 Palo Alto Prisma Cloud 提醒载荷作为日志类型。
7. 点击下一步。
8. 可选：为以下输入参数指定值：
   • 拆分定界符：用于分隔日志行的定界符，例如 \n。
9. 点击下一步。
10. 在最终确定界面中查看 Feed 配置，然后点击提交。
11. 点击生成密钥，生成用于对此 Feed 进行身份验证的密钥。
12. 复制并存储密钥。您将无法再次查看此密钥。如有需要，您可以重新生成新的 Secret 密钥，但此操作会使之前的 Secret 密钥失效。
13. 在详情标签页中，从端点信息字段复制 Feed 端点网址。您需要在客户端应用中指定此端点网址。
14. 点击完成。

为 webhook Feed 创建 API 密钥

1. 前往 Google Cloud 控制台 > 凭据。

   转到“凭据”页面

2. 点击创建凭据，然后选择 API 密钥。

3. 将 API 密钥访问权限限制为 Google Security Operations API。

指定端点网址

1. 在客户端应用中，指定 webhook Feed 中提供的 HTTPS 端点网址。

2. 通过在自定义标头中指定 API 密钥和密钥来启用身份验证，格式如下：

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   建议：将 API 密钥指定为标头，而不是在网址中指定。

3. 如果您的 Webhook 客户端不支持自定义标头，您可以使用以下格式的查询参数指定 API 密钥和密钥：

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

   替换以下内容：

   • ENDPOINT_URL：Feed 端点网址。
   • API_KEY：用于向 Google Security Operations 进行身份验证的 API 密钥。
   • SECRET：您生成的用于验证 Feed 的密钥。

将 Palo Alto Prisma Cloud Webhook 配置为 Google SecOps

1. 登录 Palo Alto Prisma Cloud。
2. 依次选择设置 > 集成和通知 ((and_then)) 集成。
3. 点击添加集成。
4. 选择 Webhook。
5. 为以下输入参数指定值：
   • 集成名称：提供一个唯一且描述性的名称（例如 Google SecOps）
   • 网络钩子网址：输入 ENDPOINT_URL。
   • 可选：提供集成的说明。
   • 可选：启用自定义载荷 > 点击下一步以查看或修改自定义载荷。
6. 点击下一步。
7. 测试和保存集成。

配置 Palo Alto Prisma Cloud 提醒

1. 在 Palo Alto Prisma Cloud 控制台中，依次前往 Alerts > View Alert Rules。
2. 选择要修改的现有提醒规则。
3. 可选：为 Cloud Infrastructure 创建新提醒。
4. 可选：为 Cloud Workload 创建新提醒。
5. 前往配置通知。
6. 选择 Webhook。
7. 可选：选择您希望在提醒规则触发提醒时发送通知的渠道。
8. 点击下一步。
9. 点击保存。

UDM 映射表

下表列出了从 Palo Alto Prisma Cloud 提醒载荷日志字段映射的 UDM 字段：

日志字段	UDM 映射
_id	metadata.product_log_id
account.cloudType	principal.resource.attribute.cloud.environment
account.id	additional.fields
account.name	additional.fields
account_id_body	target.user.userid
accountId	target.resource.product_object_id
accountIDs	additional.fields
accountName	target.resource.attribute.labels
accountOwners	principal.user.email_addresses, principal.user.attribute.labels
acknowledged	security_result.detection_fields
additionalInfo.*	security_result.detection_fields
aggregatedAlerts.*	about.resource.attribute.labels, target.resource.attribute.labels
aggregatedAlerts.accountIDs	target.resource.attribute.labels
aggregatedAlerts.clusters	target.resource.attribute.labels
aggregatedAlerts.collections	target.resource.attribute.labels
aggregatedAlerts.command	about.process.command_line
aggregatedAlerts.complianceIssues.*	security_result.detection_fields
aggregatedAlerts.container	about.resource.name
aggregatedAlerts.containerID	about.resource.product_object_id
aggregatedAlerts.forensics	about.url
aggregatedAlerts.fqdn	about.domain.name
aggregatedAlerts.host	about.hostname
aggregatedAlerts.labels.aadpodidbinding	about.resource.attribute.labels
aggregatedAlerts.labels.app_kubernetes.io_component	about.resource.attribute.labels
aggregatedAlerts.labels.app_kubernetes.io_part_of	about.resource.attribute.labels
aggregatedAlerts.labels.io.kubernetes.container.name	about.resource.attribute.labels
aggregatedAlerts.labels.io.kubernetes.pod.namespace	about.resource.attribute.labels
aggregatedAlerts.labels.io.kubernetes.pod.uid	about.resource.attribute.labels
aggregatedAlerts.labels.networking/gateway-ingress	about.resource.attribute.labels
aggregatedAlerts.labels.pod-template-hash	about.resource.attribute.labels
aggregatedAlerts.labels.product	about.resource.attribute.labels
aggregatedAlerts.labels.role	about.resource.attribute.labels
aggregatedAlerts.namespaces	target.resource.attribute.labels
aggregatedAlerts.region	about.resource.attribute.cloud.availability_zone
aggregatedAlerts.user	about.user.userid
aggregatedAlerts.vulnerabilities.accountIDs	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.clusters	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.collections	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.distribution	extensions.vulns.vulnerabilities.name
aggregatedAlerts.vulnerabilities.imageID	extensions.vulns.vulnerabilities.about.file.sha256
aggregatedAlerts.vulnerabilities.imageName	extensions.vulns.vulnerabilities.about.file.full_path
aggregatedAlerts.vulnerabilities.namespaces	extensions.vulns.vulnerabilities.about.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.cve	extensions.vulns.vulnerabilities.cve_id
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.link	extensions.vulns.vulnerabilities.about.url
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packages	target.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion	target.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.severity	extensions.vulns.vulnerabilities.severity, extensions.vulns.vulnerabilities.severity_details
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage	target.resource.attribute.labels
aggregatedAlerts.vulnerabilities.newVulnerabilities.vulnerabilities.status	extensions.vulns.vulnerabilities.description
alarmType	principal.asset.attribute.cloud.environment, security_result.detection_fields
alertId	security_result.detection_fields
alertRemediationCli	security_result.detection_fields
alertRemediationCliDescription	security_result.detection_fields
alertRemediationImpact	security_result.detection_fields
alertRuleId	security_result.rule_id
alertRuleName	security_result.rule_name
alertStatus	security_result.detection_fields
alertTime	security_result.first_discovered_time
alertTs	security_result.first_discovered_time
App	principal.application
audits._id	additional.fields
audits.accountID	about.resource.attribute.labels
audits.attackTechniques	additional.fields
audits.attackType	security_result.threat_name, security_result.detection_fields
audits.cluster	about.resource.attribute.labels
audits.command	about.process.command_line
audits.container	additional.fields
audits.containerId	about.resource.attribute.labels
audits.containerName	about.resource.attribute.labels
audits.count	additional.fields
audits.effect	security_result.action_details, security_result.detection_fields
audits.hostname	about.hostname
audits.imageId	about.resource.attribute.labels
audits.imageName	about.resource.attribute.labels
audits.msg	metadata.description, about.resource.attribute.labels
audits.namespace	about.namespace
audits.os	about.platform_version
audits.pid	about.process.pid
audits.processPath	about.process.file.full_path
audits.profileId	about.resource.attribute.labels
audits.provider	about.resource.attribute.cloud.environment
audits.region	about.location.country_or_region
audits.ruleName	security_result.rule_name, security_result.detection_fields
audits.severity	security_result.severity, security_result.severity_details, security_result.detection_fields
audits.time	about.resource.attribute.labels
audits.type	metadata.product_event_type, about.resource.attribute.labels
audits.user	about.user.userid
body	additional.fields
callbackUrl	metadata.url_back_to_product
category	security_result.category_details
cluster	principal.resource.attribute.labels
clusters	additional.fields
cloudAccountGroups	target.user.group_identifiers
cloudAccountOwners	target.user.email_addresses, target.user.attribute.labels
cloudServiceName	target.resource.attribute.labels
cloudType	principal.resource.attribute.cloud.environment
collections	additional.fields
command	principal.process.command_line
complianceIssues.*	security_result.detection_fields
complianceIssues.category	security_result.category_details, security_result.detection_fields
complianceIssues.description	security_result.description, security_result.detection_fields
complianceIssues.id	security_result.detection_fields
complianceIssues.severity	security_result.severity, security_result.severity_details, security_result.detection_fields
complianceIssues.title	security_result.action_details, security_result.detection_fields
complianceIssues.type	security_result.detection_fields
complianceMetadata.*	security_result.detection_fields
container	target.resource.name
containerID	principal.asset.asset_id, target.resource.product_object_id
containerName	principal.resource.name
data.allocationId	principal.resource.product_object_id
data.attachments.*	additional.fields
data.createTime	target.resource.attribute.creation_time
data.publicIp	principal.ip, principal.asset.ip
data.*	additional.fields
deleted	additional.fields
description	metadata.description
dropped	security_result.detection_fields
email_add	principal.user.email_addresses
errorMessage	metadata.description
firstSeen	principal.asset.first_seen_time
forensics	security_result.url_back_to_product
fqdn	principal.domain.name
hasFinding	security_result.detection_fields
host	principal.hostname, principal.asset.hostname
hostname	principal.hostname, principal.asset.hostname
id	metadata.product_log_id
image	target.process.file.full_path
imageID	principal.process.file.sha256, target.process.file.sha256
imageName	principal.process.file.full_path
incidentTime	security_result.first_discovered_time
investigateOptions.*	security_result.detection_fields
labels	additional.fields
labels.aadpodidbinding	target.resource.attribute.labels
labels.app	target.application
labels.app_kubernetes.io_component	target.resource.attribute.labels
labels.app_kubernetes.io_part_of	target.resource.attribute.labels
labels.io.kubernetes.container.name	target.resource.attribute.labels
labels.io.kubernetes.pod.name	target.hostname, target.asset.hostname
labels.io.kubernetes.pod.namespace	target.resource.attribute.labels
labels.io.kubernetes.pod.uid	target.resource.attribute.labels
labels.networking/gateway-ingress	target.resource.attribute.labels
labels.owner	target.user.userid
labels.pod-template-hash	target.resource.attribute.labels
labels.product	target.resource.attribute.labels
labels.role	target.resource.attribute.labels
lastModifiedBy	principal.user.email_addresses
lastModifiedOn	security_result.detection_fields
lastSeen	principal.asset.first_discover_time
lastUpdated	security_result.detection_fields
message	security_result.description
msg_metadata.remediable	security_result.detection_fields
msg_metadata.saveSearchId	security_result.detection_fields
name	security_result.summary
namespace	principal.namespace
namespaces	additional.fields
notificationRuleName	security_result.rule_name
policy.complianceMetadata.*	security_result.detection_fields
policy.description	security_result.detection_fields
policy.deleted	additional.fields
policy.hasSearchExecutionSupport	security_result.detection_fields
policy.id	security_result.detection_fields
policy.lastModifiedBy	principal.user.email_addresses
policy.lastModifiedOn	security_result.detection_fields
policy.name	security_result.description
policy.policyId	security_result.detection_fields
policy.policyType	security_result.detection_fields
policy.policyTs	security_result.detection_fields
policy.recommendation	security_result.detection_fields
policy.remediable	security_result.detection_fields
policy.severity	security_result.severity, security_result.severity_details
policy.systemDefault	security_result.detection_fields
policyDescription	security_result.detection_fields
policyId	security_result.detection_fields
policyLabels	additional.fields
policyName	security_result.description
policyRecommendation	security_result.detection_fields
policyType	security_result.detection_fields
profileID	additional.fields
provider	target.resource.attribute.cloud.environment
reason	security_result.summary
recommendation	security_result.detection_fields
remediable	security_result.detection_fields
region	principal.location.country_or_region, principal.location.state, target.resource.attribute.cloud.availability_zone
resource.account	additional.fields
resource.accountId	target.resource.product_object_id, additional.fields
resource.additionalInfo.*	security_result.detection_fields
resource.cloudAccountGroups	target.user.group_identifiers
resource.cloudAccountOwners	target.user.email_addresses, target.user.attribute.labels
resource.cloudServiceName	target.resource.attribute.labels
resource.cloudType	principal.resource.attribute.cloud.environment, principal.resource.attribute.labels
resource.data.*	additional.fields
resource.data.addonsConfig.dnsCacheConfig.enabled	additional.fields
resource.data.addonsConfig.gcePersistentDiskCsiDriverConfig.enabled	additional.fields
resource.data.addonsConfig.gcpFilestoreCsiDriverConfig.enabled	additional.fields
resource.data.addonsConfig.gcsFuseCsiDriverConfig.enabled	additional.fields
resource.data.addonsConfig.kubernetesDashboard.disabled	additional.fields
resource.data.addonsConfig.networkPolicyConfig.disabled	additional.fields
resource.data.allowed.IPProtocol	additional.fields
resource.data.allowed.ports	additional.fields
resource.data.arn	principal.resource.attribute.labels
resource.data.attributes.access_logs.s3.enabled	additional.fields
resource.data.attributes.deletion_protection.enabled	additional.fields
resource.data.attributes.dns_record.client_routing_policy	additional.fields
resource.data.attributes.load_balancing.cross_zone.enabled	additional.fields
resource.data.attributes.secondary_ips.auto_assigned.per_subnet	additional.fields
resource.data.attributes.zonal_shift.config.enabled	additional.fields
resource.data.authenticatorGroupsConfig.enabled	target.group.attribute.labels
resource.data.authenticatorGroupsConfig.securityGroup	target.group.email_addresses
resource.data.authorizationRules.*	additional.fields
resource.data.authorizationRules.properties.rights	additional.fields
resource.data.autoscaling.autoscalingProfile	additional.fields
resource.data.availabilityZones.*	additional.fields
resource.data.blockDeviceMappings.deviceName	additional.fields
resource.data.blockDeviceMappings.ebs.*	additional.fields
resource.data.capacityReservationSpecification.capacityReservationPreference	additional.fields
resource.data.Command.*	additional.fields
resource.data.Command.ScriptLocation	target.process.file.full_path
resource.data.conditions.*	additional.fields
resource.data.controlPlaneEndpointsConfig.dnsEndpointConfig.*	additional.fields
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.*	additional.fields
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.authorizedNetworksConfig.privateEndpointEnforcementEnabled	additional.fields
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.privateEndpoint	target.ip, target.asset.ip
resource.data.controlPlaneEndpointsConfig.ipEndpointsConfig.publicEndpoint	target.ip, target.asset.ip
resource.data.cpuOptions.coreCount	additional.fields
resource.data.cpuOptions.threadsPerCore	additional.fields
resource.data.createDate	principal.resource.attribute.labels
resource.data.createdDate	principal.resource.attribute.labels
resource.data.createdTime	target.resource.attribute.creation_time
resource.data.CreatedOn	target.resource.attribute.creation_time
resource.data.createTime	target.resource.attribute.creation_time
resource.data.creationTimestamp	principal.resource.attribute.labels
resource.data.databaseEncryption.*	additional.fields
resource.data.DefaultArguments.*	additional.fields
resource.data.defaultMaxPodsConstraint.maxPodsPerNode	additional.fields
resource.data.deleteRetentionPolicy.blob.*	additional.fields
resource.data.description	principal.resource.attribute.labels
resource.data.diagnosticSettings.*	additional.fields
resource.data.diagnosticSettings.properties.*	additional.fields
resource.data.diagnosticSettings.properties.logs.*	additional.fields
resource.data.diagnosticSettings.properties.metrics.*	additional.fields
resource.data.direction	principal.resource.attribute.labels, network.direction
resource.data.disks.*	additional.fields
resource.data.displayName	target.user.user_display_name
resource.data.document.Statement.*	additional.fields
resource.data.document.Statement.Action.*	additional.fields
resource.data.document.Statement.Resource.*	additional.fields
resource.data.document.Version	additional.fields
resource.data.enclaveOptions.enabled	additional.fields
resource.data.encryptionStatuses.*	additional.fields
resource.data.endpoint	target.ip, target.asset.ip
resource.data.enterpriseConfig.clusterTier	additional.fields
resource.data.entities.policyRoles.*	additional.fields
resource.data.ExecutionProperty.MaxConcurrentRuns	additional.fields
resource.data.hibernationOptions.configured	additional.fields
resource.data.id	principal.resource.attribute.labels
resource.data.identity.type	additional.fields
resource.data.instanceGroupUrls	additional.fields
resource.data.ipAllocationPolicy.*	target.resource.attribute.labels
resource.data.ipAllocationPolicy.networkTierConfig.networkTier	target.resource.attribute.labels
resource.data.kind	principal.resource.attribute.labels
resource.data.lastAccessedDate	principal.resource.attribute.labels
resource.data.lastChangedDate	principal.resource.attribute.labels
resource.data.listeners.*	additional.fields
resource.data.listeners.rules.*	additional.fields
resource.data.listeners.rules.actions.*	additional.fields
resource.data.listeners.rules.actions.forwardConfig.targetGroups.*	additional.fields
resource.data.loadBalancerName	target.resource.name
resource.data.location	principal.resource.attribute.labels
resource.data.locations	additional.fields
resource.data.logConfig.enable	additional.fields
resource.data.loggingConfig.componentConfig.enableComponents	additional.fields
resource.data.loggingProperties.blob.*	additional.fields
resource.data.loggingProperties.queue.*	additional.fields
resource.data.loggingProperties.table.*	additional.fields
resource.data.mail	target.user.email_addresses
resource.data.maintenancePolicy.resourceVersion	additional.fields
resource.data.maintenancePolicy.window.recurringWindow.recurrence	additional.fields
resource.data.maintenancePolicy.window.recurringWindow.window.endTime	additional.fields
resource.data.maintenancePolicy.window.recurringWindow.window.startTime	additional.fields
resource.data.masterAuth.clusterCaCertificate	additional.fields
resource.data.masterAuthorizedNetworksConfig.privateEndpointEnforcementEnabled	additional.fields
resource.data.metadata.items	additional.fields
resource.data.metadataOptions.*	additional.fields
resource.data.monitoring.state	additional.fields
resource.data.monitoringConfig.componentConfig.enableComponents	additional.fields
resource.data.monitoringConfig.managedPrometheusConfig.enabled	additional.fields
resource.data.msg_metadata.fingerprint	additional.fields
resource.data.msg_metadata.kind	additional.fields
resource.data.Name	target.resource.name
resource.data.name	principal.resource.attribute.labels
resource.data.network	principal.resource.attribute.labels
resource.data.networkConfig.*	additional.fields
resource.data.networkConfig.dnsConfig.clusterDns	additional.fields
resource.data.networkConfig.dnsConfig.clusterDnsScope	additional.fields
resource.data.networkConfig.gatewayApiConfig.channel	additional.fields
resource.data.networkInterfaces.*	additional.fields
resource.data.networkInterfaces.aliasIpRanges.*	additional.fields
resource.data.networkInterfaces.attachment.*	additional.fields
resource.data.networkInterfaces.groups.*	additional.fields
resource.data.networkInterfaces.macAddress	target.mac, target.asset.mac
resource.data.networkInterfaces.networkIP	target.ip, target.asset.ip
resource.data.networkInterfaces.operator.managed	additional.fields
resource.data.networkInterfaces.privateIpAddress	target.ip, target.asset.ip
resource.data.networkPerformanceOptions.bandwidthWeighting	additional.fields
resource.data.networkRuleSet.*	additional.fields
resource.data.networkRuleSet.properties.*	additional.fields
resource.data.nodeConfig.*	target.resource.attribute.labels
resource.data.nodeConfig.bootDisk.diskType	target.resource.attribute.labels
resource.data.nodeConfig.bootDisk.sizeGb	target.resource.attribute.labels
resource.data.nodeConfig.kubeletConfig.insecureKubeletReadonlyPortEnabled	target.resource.attribute.labels
resource.data.nodeConfig.kubeletConfig.maxParallelImagePulls	target.resource.attribute.labels
resource.data.nodeConfig.msg_metadata.disable-legacy-endpoints	target.resource.attribute.labels
resource.data.nodeConfig.nodeImageConfig.image	target.resource.attribute.labels
resource.data.nodeConfig.nodeImageConfig.imageProject	target.resource.attribute.labels
resource.data.nodeConfig.oauthScopes	target.resource.attribute.labels
resource.data.nodeConfig.resourceLabels.goog-gke-node-pool-provisioning-model	target.resource.attribute.labels
resource.data.nodeConfig.serviceAccount	target.user.email_addresses, target.user.userid
resource.data.nodeConfig.shieldedInstanceConfig.enableIntegrityMonitoring	target.resource.attribute.labels
resource.data.nodeConfig.tags	target.resource.attribute.labels
resource.data.nodeConfig.workloadMetadataConfig.mode	target.resource.attribute.labels
resource.data.nodePoolAutoConfig.networkTags.tags	additional.fields
resource.data.nodePoolAutoConfig.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled	additional.fields
resource.data.nodePoolDefaults.nodeConfigDefaults.loggingConfig.variantConfig.variant	additional.fields
resource.data.nodePoolDefaults.nodeConfigDefaults.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled	additional.fields
resource.data.nodePools.*	additional.fields
resource.data.nodePools.autoscaling.*	additional.fields
resource.data.nodePools.config.*	additional.fields
resource.data.nodePools.instanceGroupUrls	additional.fields
resource.data.nodePools.locations	additional.fields
resource.data.nodePools.management.*	additional.fields
resource.data.nodePools.maxPodsConstraint.*	additional.fields
resource.data.nodePools.networkConfig.*	additional.fields
resource.data.nodePools.upgradeSettings.*	additional.fields
resource.data.operator.hiddenByDefault	additional.fields
resource.data.operator.managed	additional.fields
resource.data.placement.*	additional.fields
resource.data.podAutoscaling.hpaProfile	additional.fields
resource.data.policyArn	principal.resource.attribute.labels
resource.data.policyName	principal.resource.attribute.labels
resource.data.privateClusterConfig.*	additional.fields
resource.data.privateDnsName	target.hostname, target.asset.hostname
resource.data.privateIpAddress	target.ip, target.asset.ip
resource.data.properties.*	additional.fields
resource.data.properties.aadProfile.enableAzureRBAC	additional.fields
resource.data.properties.aadProfile.managed	additional.fields
resource.data.properties.aadProfile.tenantID	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.enableSecretRotation	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.config.rotationPollInterval	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.enabled	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.clientId	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.objectId	additional.fields
resource.data.properties.addonProfiles.azureKeyvaultSecretsProvider.identity.resourceId	additional.fields
resource.data.properties.addonProfiles.azurepolicy.config.version	additional.fields
resource.data.properties.addonProfiles.azurepolicy.enabled	additional.fields
resource.data.properties.addonProfiles.azurepolicy.identity.clientId	additional.fields
resource.data.properties.addonProfiles.azurepolicy.identity.objectId	additional.fields
resource.data.properties.addonProfiles.azurepolicy.identity.resourceId	additional.fields
resource.data.properties.addonProfiles.omsagent.config.logAnalyticsWorkspaceResourceID	additional.fields
resource.data.properties.addonProfiles.omsagent.config.useAADAuth	additional.fields
resource.data.properties.addonProfiles.omsagent.enabled	additional.fields
resource.data.properties.addonProfiles.omsagent.identity.clientId	additional.fields
resource.data.properties.addonProfiles.omsagent.identity.objectId	additional.fields
resource.data.properties.addonProfiles.omsagent.identity.resourceId	additional.fields
resource.data.properties.agentPoolProfiles.*	additional.fields
resource.data.properties.agentPoolProfiles.availabilityZones	additional.fields
resource.data.properties.agentPoolProfiles.nodeLabels.nodepool	additional.fields
resource.data.properties.agentPoolProfiles.powerState.code	additional.fields
resource.data.properties.agentPoolProfiles.tags.*	additional.fields
resource.data.properties.apiServerAccessProfile.disableRunCommand	additional.fields
resource.data.properties.apiServerAccessProfile.enablePrivateCluster	additional.fields
resource.data.properties.apiServerAccessProfile.enablePrivateClusterPublicFQDN	additional.fields
resource.data.properties.apiServerAccessProfile.privateDNSZone	additional.fields
resource.data.properties.autoScalerProfile.*	additional.fields
resource.data.properties.autoUpgradeProfile.upgradeChannel	additional.fields
resource.data.properties.httpProxyConfig.effectiveNoProxy	additional.fields
resource.data.properties.httpProxyConfig.httpProxy	additional.fields
resource.data.properties.httpProxyConfig.httpsProxy	additional.fields
resource.data.properties.httpProxyConfig.noProxy	additional.fields
resource.data.properties.httpProxyConfig.trustedCa	additional.fields
resource.data.properties.identityProfile.kubeletidentity.*	additional.fields
resource.data.properties.linuxProfile.adminUsername	additional.fields
resource.data.properties.linuxProfile.ssh.publicKeys.*	additional.fields
resource.data.properties.networkProfile.*	target.resource.attribute.labels
resource.data.properties.networkProfile.dnsServiceIP	target.ip, target.asset.ip
resource.data.properties.networkProfile.ipFamilies	target.resource.attribute.labels
resource.data.properties.networkProfile.serviceCidrs	target.resource.attribute.labels
resource.data.properties.powerState.code	additional.fields
resource.data.properties.principalId	target.user.product_object_id
resource.data.properties.privateFQDN	target.hostname, target.asset.hostname
resource.data.properties.privateLinkResources.*	additional.fields
resource.data.properties.privateLinkResources.requiredMembers	additional.fields
resource.data.properties.roleDefinition.*	additional.fields
resource.data.properties.roleDefinition.properties.*	additional.fields
resource.data.properties.roleDefinition.properties.assignableScopes	additional.fields
resource.data.properties.roleDefinition.properties.permissions.actions	additional.fields
resource.data.properties.roleDefinition.properties.permissions.notActions	additional.fields
resource.data.properties.servicePrincipalProfile.clientId	additional.fields
resource.data.properties.storageProfile.diskCSIDriver.enabled	additional.fields
resource.data.properties.storageProfile.fileCSIDriver.enabled	additional.fields
resource.data.properties.storageProfile.snapshotController.enabled	additional.fields
resource.data.properties.windowsProfile.adminUsername	additional.fields
resource.data.properties.windowsProfile.enableCSIProxy	additional.fields
resource.data.rbacBindingConfig.enableInsecureBindingSystemAuthenticated	additional.fields
resource.data.rbacBindingConfig.enableInsecureBindingSystemUnauthenticated	additional.fields
resource.data.releaseChannel.channel	additional.fields
resource.data.resourceGroup	principal.resource.attribute.labels
resource.data.resourceLabels.gke-cluster	additional.fields
resource.data.resourceLabels.goog-terraform-provisioned	additional.fields
resource.data.roles	target.user.attribute.roles.name
resource.data.scheduling.automaticRestart	additional.fields
resource.data.scheduling.onHostMaintenance	additional.fields
resource.data.scheduling.preemptible	additional.fields
resource.data.secretVersionsToStages.terraform-20260122172341570100000002	principal.resource.attribute.labels
resource.data.securityPostureConfig.mode	security_result.detection_fields
resource.data.securityPostureConfig.vulnerabilityMode	security_result.detection_fields
resource.data.selfLink	principal.resource.attribute.labels
resource.data.shareDeleteRetentionPolicy.file.*	additional.fields
resource.data.shieldedInstanceConfig.enableIntegrityMonitoring	additional.fields
resource.data.shieldedInstanceConfig.enableSecureBoot	additional.fields
resource.data.shieldedInstanceConfig.enableVtpm	additional.fields
resource.data.shieldedInstanceIntegrityPolicy.updateAutoLearnPolicy	additional.fields
resource.data.sku.*	additional.fields
resource.data.sourceRanges	security_result.about.ip
resource.data.state.code	additional.fields
resource.data.state.name	additional.fields
resource.data.tags	additional.fields
resource.data.tags.*	additional.fields
resource.data.tags.Creator	target.user.email_addresses, target.user.userid
resource.data.tags.Email	target.user.email_addresses, target.user.userid
resource.data.tags.items	additional.fields
resource.data.targetGroups.*	target.resource.attribute.labels
resource.data.targetGroups.loadBalancerArns	target.resource.attribute.labels
resource.data.targetTags	additional.fields
resource.data.type	principal.resource.attribute.labels
resource.data.user	target.user.email_addresses, target.user.userid
resource.data.userPrincipalName	target.user.userid
resource.data.versionId	principal.resource.attribute.labels
resource.data.workloadIdentityConfig.workloadPool	additional.fields
resource.data.dnsname	target.hostname, target.asset.hostname
resource.id	principal.resource.product_object_id, additional.fields
resource.name	principal.resource.name, additional.fields
resource.region	principal.location.country_or_region, principal.location.state, additional.fields
resource.regionId	principal.resource.attribute.cloud.availability_zone, principal.location.country_or_region, additional.fields
resource.resourceApiName	target.resource.attribute.labels
resource.resourceConfigJsonAvailable	additional.fields
resource.resourceDetailsAvailable	additional.fields
resource.resourceId	principal.resource.product_object_id
resource.resourceName	principal.resource.name
resource.resourceTags.*	principal.resource.attribute.labels
resource.resourceTs	metadata.event_timestamp
resource.resourceType	target.resource.resource_subtype, additional.fields
resource.rrn	target.resource.attribute.labels
resource.unifiedAssetId	principal.asset.asset_id
resource.url	principal.url
resourceCloudService	principal.resource.attribute.labels
resourceConfigJsonAvailable	additional.fields
resourceDetailsAvailable	additional.fields
resourceId	principal.resource.product_object_id
resourceName	principal.resource.name
resourceRegion	principal.location.country_or_region
resourceRegionId	principal.resource.attribute.cloud.availability_zone
resourceType	target.resource.resource_subtype
rrn	target.resource.name
saveSearchId	security_result.detection_fields
sender	metadata.description
sentTs	metadata.event_timestamp
serialNum	additional.fields
service	observer.application
severity	security_result.severity, security_result.severity_details
shouldCollect	additional.fields
source	principal.application
source_type	metadata.product_event_type
startupProcess	principal.process.parent_process.command_line
status	security_result.detection_fields
systemDefault	additional.fields
tags	principal.resource.attribute.labels
time	metadata.event_timestamp
title	additional.fields
type	principal.resource.resource_subtype, security_result.category_details
unifiedAssetId	principal.asset.asset_id
url	security_result.url_back_to_product
user	principal.user.userid
vulnerabilities.accountIDs	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.clusters	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.collections	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.distribution	extensions.vulns.vulnerabilities.name
vulnerabilities.imageID	extensions.vulns.vulnerabilities.about.file.sha256
vulnerabilities.imageName	extensions.vulns.vulnerabilities.about.file.full_path
vulnerabilities.namespaces	extensions.vulns.vulnerabilities.about.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.cve	extensions.vulns.vulnerabilities.cve_id
vulnerabilities.newVulnerabilities.vulnerabilities.link	extensions.vulns.vulnerabilities.about.url
vulnerabilities.newVulnerabilities.vulnerabilities.packages	target.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.packageVersion	target.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.severity	extensions.vulns.vulnerabilities.severity, extensions.vulns.vulnerabilities.severity_details
vulnerabilities.newVulnerabilities.vulnerabilities.sourcePackage	target.resource.attribute.labels
vulnerabilities.newVulnerabilities.vulnerabilities.status	extensions.vulns.vulnerabilities.description

UDM 映射增量参考信息

2026 年 9 月 15 日，Google SecOps 发布了新版 Palo Alto Prisma Cloud 提醒载荷解析器，其中对 Palo Alto Prisma Cloud 提醒载荷日志字段到 UDM 字段的映射进行了重大更改。

日志字段映射增量

下表列出了 2026 年 9 月 15 日之前和之后公开的 Palo Alto Prisma Cloud 提醒载荷日志到 UDM 字段的映射增量（分别列在旧映射和当前映射列中）：

日志字段	旧映射	当前映射	更改的原因
_id	additional.fields	metadata.product_log_id	映射到商品日志 ID，用于区分不同的事件。
account.cloudType	principal.cloud.environment	principal.resource.attribute.cloud.environment	将云环境上下文与资源属性重新对齐。
accountId	target.resource.id, target.resource.product_object_id	target.resource.product_object_id	标准化的云账号标识符目标。
accountId	target1.cloud.project.id	target.resource.product_object_id	移除了已弃用的 target1 实体映射。
aggregatedAlerts.category	security_result.category_details	about.resource.attribute.labels	将通用类别属性移至 about 资源标签。
aggregatedAlerts.command	principal.process.command_line, security_result.detection_fields	about.process.command_line	将进程执行详情整合到 about.process 下。
aggregatedAlerts.complianceIssues.category	security_result.category_details	security_result.detection_fields	检测字段中保留的合规性元数据。
aggregatedAlerts.complianceIssues.description	security_result.description, security_result.detection_fields	security_result.detection_fields	简化了说明映射，以防止出现冗余字段。
aggregatedAlerts.complianceIssues.severity	security_result.severity, severity_details, security_result.detection_fields	security_result.detection_fields	在检测字段中实现标准化合规性严重程度跟踪。
aggregatedAlerts.complianceIssues.title	security_result.action_details, security_result.detection_fields	security_result.detection_fields	将标题元数据整合到检测字段中。
aggregatedAlerts.container	target.resource.name	about.resource.name	将容器详细信息从目标移到了 about 上下文中。
aggregatedAlerts.containerID	target.resource.product_object_id	about.resource.product_object_id	将容器 ID 映射重新对齐到 about 资源属性。
aggregatedAlerts.forensics	principal.url	about.url	已将取证链接目标更新为 about.url。
aggregatedAlerts.fqdn	principal.domain.name	about.domain.name	修正了网域上下文映射。
aggregatedAlerts.host	principal.hostname	about.hostname	将宿主实体上下文移至 about.hostname。
aggregatedAlerts.message	security_result.description	about.resource.attribute.labels	将原始消息字符串移到了标签键值对中。
aggregatedAlerts.region	target.cloud.availability_zone	about.resource.attribute.cloud.availability_zone	更新了云区域属性映射。
aggregatedAlerts.rule	security_result.rule_name	about.resource.attribute.labels	将汇总规则引用移至资源标签。
aggregatedAlerts.startupProcess	principal.process.parent_process.command_line	about.resource.attribute.labels	将启动进程详细信息重新归类为资源标签。
aggregatedAlerts.time	metadata.event_timestamp	about.resource.attribute.labels	在资源标签中保留原始提醒时间戳。
aggregatedAlerts.type	security_result.category_details	about.resource.attribute.labels	将提醒类型重新归类为资源标签。
aggregatedAlerts.user	principal.user.userid	about.user.userid	将用户实体引用重新对齐到 about.user。
alertTs	security_result.detection_fields	security_result.first_discovered_time	修正了检测时间戳目标字段。
audits.attackType	security_result.threat_name	security_result.threat_name, security_result.detection_fields	为检测字段添加了次要映射。
audits.command	principal.process.command_line	about.process.command_line	将进程命令行目标平台移至 about。
audits.effect	security_result.action_details	security_result.action_details, security_result.detection_fields	为检测字段添加了次要映射。
audits.msg	metadata.description	metadata.description, about.resource.attribute.labels	将审核消息跟踪范围扩大到资源标签。
audits.os	principal.platform_version	about.platform_version	已更正的操作系统平台目标。
audits.pid	principal.process.pid	about.process.pid	将进程 ID 映射重新对齐到 about.process。
audits.processPath	principal.process.file.full_path	about.process.file.full_path	将进程可执行文件路径重新对齐到 about.process。
audits.ruleName	security_result.rule_name	security_result.rule_name, security_result.detection_fields	在安全结果和检测字段中保留了规则名称。
audits.severity	security_result.severity	security_result.severity, security_result.detection_fields	在安全结果和检测字段中保留了审核严重程度。
audits.type	metadata.product_event_type	metadata.product_event_type, about.resource.attribute.labels	向资源标签添加了事件类型，以增强过滤功能。
audits.user	principal.user.userid	about.user.userid	将审核用户标识符重新对齐到 about.user。
cloudType	principal.cloud.environment	principal.resource.attribute.cloud.environment	更新了根云环境目标。
complianceMetadata.requirementId	security_result.rule_id	security_result.detection_fields	将合规性要求 ID 移至检测字段。
complianceMetadata.requirementName	security_result.summary	security_result.detection_fields	将合规性要求名称移至检测字段。
complianceMetadata.standardName	security_result.rule_name	security_result.detection_fields	将合规性标准名称移至检测字段。
containerName	principal.application, principal.resource.name	principal.resource.name	移除了不明确的应用实体映射。
imageID	principal.resource.attribute.labels	principal.process.file.sha256	直接将容器映像哈希映射到进程 SHA256。
imageName	principal.resource.attribute.labels	principal.process.file.full_path	将容器映像名称映射到进程文件路径。
policy.complianceMetadata.requirementId	security_result.rule_id	security_result.detection_fields	将政策合规性要求 ID 移至检测字段。
policy.complianceMetadata.requirementName	security_result.summary	security_result.detection_fields	将政策合规性要求名称移至检测字段。
policy.complianceMetadata.standardName	security_result.rule_name	security_result.detection_fields	将政策合规性标准名称移至检测字段。
provider	target.resource.attribute.labels	target.resource.attribute.cloud.environment	标准化的云服务提供商环境上下文。
resource.account	target.resource.product_object_id	additional.fields	将通用账号字符串移至其他字段。
resource.accountId	target.resource.id, target.resource.product_object_id	target.resource.product_object_id	标准化的资源账号 ID 映射。
resource.accountId	target1.cloud.project.id	target.resource.product_object_id	移除了旧版 target1 实体引用。
resource.cloudAccountGroups	principal.resource.attribute.labels	target.user.group_identifiers	修正了账号群组到用户组标识符的映射。
resource.cloudType	principal.cloud.environment	principal.resource.attribute.cloud.environment	标准化的资源云环境属性。
resource.data.isAttached	security_result.detection_fields	additional.fields	将资源状态标志移至其他字段。
resource.data.isDefaultVersion	security_result.detection_fields	additional.fields	将版本标志移至其他字段。
resource.data.isPermissionBoundarySet	security_result.detection_fields	additional.fields	将权限标志移至其他字段。
resource.resourceApiName	principal.resource.attribute.labels	target.resource.attribute.labels	将资源 API 标签重新对齐到目标资源。
resource.resourceId	principal.resource.attribute.labels	principal.resource.product_object_id	从推广的资源 ID 到商品对象 ID。
resource.resourceName	principal.resource.attribute.labels	principal.resource.name	从推广的资源名称到原生 UDM 资源名称。
resource.resourceTs	principal.resource.attribute.labels	metadata.event_timestamp	更正了事件时间戳来源提取字段。
resource.rrn	principal.resource.attribute.labels	target.resource.attribute.labels	将资源 RRN 重新与目标标签对齐。
resourceRegionId	principal.cloud.availability_zone	principal.resource.attribute.cloud.availability_zone	将云地区 ID 与资源属性重新对齐。
resourceType	principal.resource.resource_subtype	target.resource.resource_subtype	标准化的目标资源子类型。
type	principal.resource.type	principal.resource.resource_subtype	将映射的类型字符串设为资源子类型。

更新日志

查看相应解析器的更改日志

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。