本頁面由 Cloud Translation API 翻譯而成。

Resource Manager 內容記錄

本文說明 Resource Manager 背景記錄的欄位如何對應至 Google Security Operations 統一資料模型 (UDM) 欄位。

擷取標籤會標示剖析器，將原始記錄資料正規化為具結構性的 UDM 格式。本文中的資訊適用於使用 GCP_RESOURCE_MANAGER_CONTEXT 攝入標籤的剖析器。

如要瞭解 Google Security Operations 支援的其他內容剖析器，請參閱「Google Security Operations 內容剖析器」。

支援的 Resource Manager 內容記錄記錄格式

Resource Manager 結構定義記錄剖析器支援 JSON 格式的記錄。

支援的 Resource Manager 內容記錄記錄檔範例

JSON：

{
  "name": "//cloudresourcemanager.googleapis.com/folders/722926615140",
  "assetType": "cloudresourcemanager.googleapis.com/Folder",
  "resource": {
    "version": "v2",
    "discoveryDocumentUri": "https://cloudresourcemanager.googleapis.com/$discovery/rest?version=v2",
    "discoveryName": "Folder",
    "parent": "//cloudresourcemanager.googleapis.com/organizations/299419016487",
    "data": {
      "createTime": "2022-06-08T22:40:08.491Z",
      "displayName": "OrgChangeSourceFolder",
      "lifecycleState": "ACTIVE",
      "name": "folders/dummy",
      "parent": "organizations/dummy"
    }
  },
  "ancestors": [
    "folders/722926615140",
    "organizations/299419016487"
  ]
}

欄位對應參考資料

下表說明 Google Security Operations 剖析器如何將 Resource Manager 內容記錄欄位對應至 Google Security Operations 統一資料模型 (UDM) 欄位。

Log field	UDM mapping	Logic
`resource.data.tagValueNamespacedName`	`entity.namespace`
`resource.data.namespacedName`	`entity.namespace`
`resource.data.createTime`	`entity.resource.attribute.creation_time`
`resource.data.updateTime`	`entity.resource.attribute.last_update_time`
`name`	`entity.resource.name`
`resource.data.name`	`entity.resource.name`
`resource.data.displayName`	`entity.resource.product_object_id`
`resource.data.projectId`	`entity.resource.product_object_id`
	`entity.resource.resource_type`	If the `assetType` matches the regular expression pattern `Project`, then the `entity.resource.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if the `assetType` matches the regular expression pattern `Organizations`, then the `entity.resource.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if the `assetType` matches the regular expression pattern `Folder`, then the `entity.resource.resource_type` UDM field is set to `STORAGE_OBJECT`. Else, the `entity.resource.resource_type` UDM field is set to `SETTING`.
`assetType`	`entity.resource.resource_subtype`
`resource.data.owner.directoryCustomerId`	`entity.user.userid`
`resource.data.directoryCustomerId`	`entity.user.userid`
`resource.data.description`	`metadata.description`
	`metadata.entity_type`	The `metadata.entity_type` UDM field is set to `RESOURCE`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `GCP Resource Manager`.
`resource.version`	`metadata.product_version`
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Google Cloud Platform`.
	`relations.entity.resource_ancestors.attribute.cloud.environment`	If the `ancestors` log field value is not empty or the `resource.parent` log field value is not empty or the `resource.data.parent.type` log field value is not empty, then the `relations.entity.resource_ancestors.attribute.cloud.environment` UDM field is set to `GOOGLE_CLOUD_PLATFORM`.
`ancestors`	`relations.entity.resource_ancestors.name`
`resource.data.parent.id`	`relations.entity.resource_ancestors.product_object_id`
	`relations.entity.resource_ancestors.resource_type`	If the `ancestors` matches the regular expression pattern `organizations`, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if the `ancestors` matches the regular expression pattern `projects`, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if the `ancestors` matches the regular expression pattern `folder`, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `STORAGE_OBJECT`.
`resource.data.parent.type`	`relations.entity.resource_ancestors.resource_type`	If the `resource.data.parent.type` matches the regular expression pattern `project`, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `CLOUD_PROJECT`. Else, if the `resource.data.parent.type` matches the regular expression pattern `folder`, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `STORAGE_OBJECT`. Else, if the `resource.data.parent.type` matches the regular expression pattern `organization`, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `CLOUD_ORGANIZATION`. Else, if the `resource.data.parent.type` log field value is not empty, then the `relations.entity.resource_ancestors.resource_type` UDM field is set to `SETTING`.
	`relations.entity.resource_ancestors.resource_subtype`	If the `ancestors` matches the regular expression pattern `organizations`, then the `relations.entity.resource_ancestors.resource_subtype` UDM field is set to `organizations`. Else, if the `ancestors` matches the regular expression pattern `projects`, then the `relations.entity.resource_ancestors.resource_subtype` UDM field is set to `projects`. Else, if the `ancestors` matches the regular expression pattern `folder`, then the `relations.entity.resource_ancestors.resource_subtype` UDM field is set to `folders`.
`resource.data.parent.type`	`relations.entity.resource_ancestors.resource_subtype`
	`entity.resource.attribute.cloud.environment`	The `entity.resource.attribute.cloud.environment` UDM field is set to `GOOGLE_CLOUD_PLATFORM`.
	`relations.entity_type`	The `relations.entity_type` UDM field is set to `RESOURCE`.
	`relations.relationship`	The `relations.relationship` UDM field is set to `MEMBER`.
	`relations.direction`	The `relations.direction` UDM field is set to `UNIDIRECTIONAL`.
`resource.parent`	`relations.entity.resource.name`
`resource.data.parent`	`relations.entity.resource.name`
`resource.data.labels`	`entity.resource.attribute.labels.key/value`
`resource.data.purposeData`	`entity.resource.attribute.labels.key/value`
`resource.discoveryDocumentUri`	`entity.resource.attribute.labels[discovery_document]`
`resource.discoveryName`	`entity.resource.attribute.labels[discovery_name]`
`resource.data.purpose`	`entity.resource.attribute.labels[purpose]`
`resource.data.deleteTime`	`entity.resource.attribute.last_update_time`
`resource.data.etag`	`entity.resource.attribute.labels[resource_etag]`
`resource.data.projectNumber`	`entity.resource.attribute.labels[resource_project_number]`
`resource.data.lifecycleState`	`entity.resource.attribute.labels[resource_state]`
`resource.data.state`	`entity.resource.attribute.labels[resource_state]`
`resource.data.tagValue`	`entity.resource.attribute.labels[resource_tag_value]`
`resource.data.shortName`	`entity.resource.attribute.labels[short_name]`

還有其他問題嗎？向社群成員和 Google SecOps 專家尋求答案。