Collect Cloud SQL context logs

This document describes how fields of Cloud SQL context logs map to Google Security Operations Unified Data Model (UDM) fields.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GCP_SQL_CONTEXT ingestion label.

For information about other context parsers that Google SecOps supports, see Google SecOps context parsers .

Supported Cloud SQL log formats

The Cloud SQL parser supports logs in JSON format.

Supported Cloud SQL sample logs

• JSON:

   {
    "name": "//cloudsql.googleapis.com/projects/cloudsql-experiment-target/instances/target-exfil-mysql/backupRuns/1684933200000",
    "assetType": "dummy.googleapis.com/BackupRun",
    "resource": {
      "version": "v1beta4",
      "discoveryDocumentUri": "https://www.googleapis.com/discovery/v1/apis/sqladmin/v1beta4/rest",
      "discoveryName": "BackupRun",
      "parent": "//cloudsql.googleapis.com/projects/cloudsql-experiment-target/instances/target-exfil-mysql",
      "data": {
        "backupKind": "SNAPSHOT",
        "endTime": "2023-05-24T13:14:54.196Z",
        "enqueuedTime": "2023-05-24T13:13:32.856Z",
        "id": "1684933200000",
        "instance": "target-exfil-mysql",
        "kind": "sql#backupRun",
        "location": "us",
        "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/cloudsql-experiment-target/instances/target-exfil-mysql/backupRuns/1684933200000",
        "startTime": "2023-05-24T13:13:32.913Z",
        "status": "SUCCESSFUL",
        "type": "AUTOMATED",
        "windowStartTime": "2023-05-24T13:00:00Z"
      }
    },
    "ancestors": [
      "projects/687904117202",
      "organizations/299419016487"
    ]
  } 
  

Field mapping reference

This section explains how the Google SecOps parser maps fields of Cloud SQL context logs to Google SecOps Unified Data Model (UDM) fields.