[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eAsset namespacing in Google Security Operations allows users to classify and search for assets based on shared network environments, such as cloud networks or corp vs.prod segmentation.\u003c/p\u003e\n"],["\u003cp\u003eAssets in Google Security Operations are assigned to a namespace, either automatically or manually, with assets lacking a specified namespace being designated to a default "untagged" namespace.\u003c/p\u003e\n"],["\u003cp\u003eNamespaces are visible throughout the Google Security Operations UI, including in UDM Search, Raw Log Scan, Enterprise Insights, Detection views, and asset-specific views like IP Address, Domain, and Hash views.\u003c/p\u003e\n"],["\u003cp\u003eUsers can configure namespaces through the Google Security Operations Forwarder, certain normalization parsers, the Ingestion API, or Feeds Management.\u003c/p\u003e\n"],["\u003cp\u003eNamespaces allow users to segment their data further, such as utilizing ingestion labels to create separate feeds, allowing for granular control over data organization.\u003c/p\u003e\n"]]],[],null,["# Work with Asset namespaces\n==========================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nWhen you search for an asset in Google Security Operations, for example using an IP address or a\nhostname, you are able to see all the activity associated with that asset.\nSometimes there are multiple assets associated with the same IP address or\nhostname (for example, from overlapping RFC 1918 IP address assignments on\ndifferent network segments).\n\nThe asset namespacing feature lets you classify categories of assets\nsharing a common network environment, or namespace, and then conduct searches\nfor those assets within the Google SecOps user interface based on their namespace.\nFor example, you could create namespaces for cloud networks, corp versus prod\nsegmentation, merger and acquisition networks, and so on.\n\nCreate and assign namespace to data\n-----------------------------------\n\nAll assets have a namespace that is either automatically defined or manually\nconfigured. If no namespace is provided in the logs, a **default** namespace is associated with the assets which is labeled\n**untagged** in the Google SecOps UI. Logs ingested into Google SecOps before namespace\nsupport are implicitly labeled as part of the default or untagged namespace.\n\nYou can configure namespaces using the following:\n\n- Linux version of the [Google SecOps Forwarder](../install/forwarder-linux#configure_namespaces).\n- Some of the normalization parsers (for example, for Google Cloud) can automatically populate namespace (for Google Cloud, based on project and VPC identifiers).\n- [Chronicle Ingestion API](../reference/ingestion-api#unstructuredlogentries).\n- [Google SecOps Feeds Management](../administration/feed-management#add-new-feed).\n\n| **Note:** Namespaces are not applied to security data ingested prior to April 1, 2021.\n\nNamespaces in the Google SecOps UI\n----------------------------------\n\nYou will see the namespace attached to your assets throughout the Google SecOps UI,\nespecially whenever there is a list of assets, including the following:\n\n- UDM Search\n- Raw Log Scan\n- Detection views\n\n| **Note:** The following sections illustrate some of the places that namespaces appear in the UI. They also appear in many of the other views used for investigation.\n\nSearch bar\n----------\n\nWhen using the search bar, the namespaces associated with\neach asset are displayed. Selecting an asset within a specific namespace opens\nit in Asset view, showing the other activities associated with the same\nnamespace.\n\nAny asset not associated with a namespace is assigned to the default namespace.\nHowever, the default namespace is not displayed in lists.\n\n### Asset view\n\nIn Asset view, the namespace is indicated in the title of the asset at the top\nof the page. If you select the drop down menu by clicking on the down arrow, you\ncan select the other namespaces associated with the asset.\n\n\n**Asset view with namespaces**\n\n### IP Address, Domain, and Hash views\n\nThroughout the Google SecOps user interface, namespaces are shown anywhere an asset\nis referenced (except for the default or untagged namespace), including within\nthe IP address, Domain, and Hash views.\n\nFor example, in IP Address view, namespaces are included in both\nthe asset tab and in the prevalence graph.\n\n### Ingestion labels\n\nTo further narrow your search, you can use ingestion labels to set up separate feeds. For a full list of supported ingestion labels, see [Supported default parsers](../ingestion/parser-list/supported-default-parsers).\n\nExamples: three ways to add a namespace to logs\n-----------------------------------------------\n\nThe following examples illustrate three different ways you can add a namespace to the logs you ingest to your Google SecOps account.\n\n### Assign a namespace using the Google SecOps Forwarder\n\nYou can configure a namespace by adding it to the Google SecOps Forwarder configuration file as a *forwarder specific* namespace, or a *collector specific* namespace. The following example forwarder configuration illustrates both types: \n\n metadata:\n namespace: FORWARDER\n collectors:\n - syslog:\n common:\n metadata:\n namespace: CORPORATE\n batch_n_bytes: 1048576\n batch_n_seconds: 10\n data_hint: null\n data_type: NIX_SYSTEM\n enabled: true\n tcp_address: 0.0.0.0:30000\n connection_timeout_sec: 60\n - syslog:\n common:\n batch_n_bytes: 1048576\n batch_n_seconds: 10\n data_hint: null\n data_type: WINEVTLOG\n enabled: true\n tcp_address: 0.0.0.0:30001\n connection_timeout_sec: 60\n\nAs shown in this example, the logs originating from `WINEVTLOG` include the namespace tag `FORWARDER`. The logs originating from `NIX_SYSTEM` include the namespace tag `CORPORATE`.\n\nThis sets an overall namespace to the log collector. If your environment contains a mix of logs that belong to multiple namespaces and you are unable to segment these machines (or this is by design), Google recommends creating multiple collectors for the same log source that is [filtering the logs](../install/forwarder-linux#example_configuration_regular_expression_filters) to their respective namespace using regular expressions.\n\n### Assign a namespace using the Ingestion API\n\nYou can also configure a namespace when you send your logs through the `unstructuredlogentries` endpoint within the [Chronicle ingestion API](../reference/ingestion-api#unstructuredlogentries) as shown in the following example: \n\n {\n \"customer_id\": \"c8c65bfa-5f2c-42d4-9189-64bb7b939f2c\",\n \"log_type\": \"BIND_DNS\",\n \"namespace\": \"FORWARDER\"\n \"entries\": [\n {\n \"log_text\": \"26-Feb-2019 13:35:02.187 client 10.120.20.32#4238: query: altostrat.com IN A + (203.0.113.102)\",\n \"ts_epoch_microseconds\": 1551188102187000\n },\n {\n \"log_text\": \"26-Feb-2019 13:37:04.523 client 10.50.100.33#1116: query: examplepetstore.com IN A + (203.0.113.102)\",\n \"ts_rfc3339\": \"2019-26-02T13:37:04.523-08:00\"\n },\n {\n \"log_text\": \"26-Feb-2019 13:39:01.115 client 10.1.2.3#3333: query: www.example.com IN A + (203.0.113.102)\"\n },\n ]\n }\n\nIn this example, the namespace is a body parameter of the API POST call. Logs from `BIND\\_DNS` forward their log data with the `FORWARDER` namespace tag.\n\n### Assign a namespace using Google SecOps Feeds Management\n\nAs stated in the [Feed management user guide](../administration/feed-management), Google SecOps Feeds Management lets you to set up and manage various log streams within your Google SecOps tenant.\n\nIn the following example, Office 365 Logs will be ingested with the `FORWARDER` namespace tag:\n\n**Figure 1: Feed Management configuration with the FORWARDER namespace tag**\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
具有命名空间的“资产”视图