Collect Google Cloud IDS logs

This document describes how you can collect Google Cloud IDS logs by enabling Google Cloud telemetry ingestion to Google Security Operations and how log fields of Google Cloud IDS logs map to Google Security Operations Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google Security Operations .

A typical deployment consists of Google Cloud IDS logs enabled for ingestion to Google Security Operations. Each customer deployment might differ from this representation and might be more complex.

The deployment contains the following components:

• Google Cloud: The Google Cloud services and products from which you collect logs.

• Google Cloud IDS logs: The Google Cloud IDS logs that are enabled for ingestion to Google Security Operations.

• Google Security Operations: Google Security Operations retains and analyzes the logs from Google Cloud IDS.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GCP_IDS ingestion label.

Before you begin

• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

Configure Google Cloud to ingest Google Cloud IDS logs

To ingest Google Cloud IDS logs to Google Security Operations, follow the steps on the Ingest Google Cloud logs to Google Security Operations page.

If you encounter issues when you ingest Google Cloud IDS logs, contact Google Security Operations support .

Supported Google Cloud IDS log formats

The Google Cloud IDS parser supports logs in JSON format.

Supported Google Cloud IDS sample logs

• JSON:

   {
    "insertId": "5cb7ac422679042bcd8f0a84700c23c0-1@a1",
    "jsonPayload": {
      "alert_severity": "INFORMATIONAL",
      "alert_time": "2021-09-08T12:10:19Z",
      "application": "ssl",
      "category": "protocol-anomaly",
      "destination_ip_address": "198.51.100.0",
      "destination_port": "443",
      "details": "This signature detects suspicious and non-RFC compliant SSL traffic on port 443. This could be associated with applications sending non SSL traffic using port 443 or indicate possible malicious activity.",
      "direction": "client-to-server",
      "ip_protocol": "tcp",
      "name": "Non-RFC Compliant SSL Traffic on Port 443",
      "network": "abcd-prod-pod111-shared",
      "repeat_count": "1",
      "session_id": "1457377",
      "source_ip_address": "198.51.100.0",
      "source_port": "62543",
      "threat_id": "56112",
      "type": "vulnerability",
      "uri_or_filename": ""
    },
    "logName": "projects/abcd-prod-mnop-pod555-infra/logs/ids.googleapis.com%2Fthreat",
    "receiveTimestamp": "2021-09-08T12:10:23.953458826Z",
    "resource": {
      "labels": {
        "id": "abcd-prod-mnop-pod555-cloudidsendpoint-info",
        "location": "us-central1-a",
        "resource_container": "projects/158110290042"
      },
      "type": "ids.googleapis.com/Endpoint"
    },
    "timestamp": "2021-09-08T12:10:19Z"
  } 
  

Field mapping reference

Field mapping reference: GCP_IDS

The following table lists the log fields of the GCP_IDS log type and their corresponding UDM fields.

What's next

• Data ingestion to Google Security Operations

Need more help? Get answers from Community members and Google SecOps professionals.