+4Is there a documented procedure for ingesting enrichment data (Assets, Identities) in the SIEM when the source is not listed in Supported log types and default parsers? Let’s say I have sources such as a CMDB, a less common identity provider, or even an EDR with context data.
Is the answer to construct my own process via this?https://docs.cloud.google.com/chronicle/docs/reference/ingestion-methods#importentities
+2Assuming you are wanting to ingest raw/unstructured entity logs to SecOps SIEM, I would actually suggest using the regular importLogs endpoint (https://docs.cloud.google.com/chronicle/docs/reference/ingestion-methods#importlog).
This does not necessarily need to be done by manually making requests to the REST endpoint, assuming you are able to route the logs from the source product through Bindplane (https://docs.cloud.google.com/chronicle/docs/ingestion/use-bindplane-agent) or Cribl or similar. Since Bindplane is bundled with SecOps license, I would suggest the Bindplane approach as easiest.
Assuming there is no existing LOG_TYPE for the source, you would want to create a custom one for this source in your SecOps tenant SIEM settings which you will use to ingest the logs to.
Once you have your raw logs into SecOps, what makes them “Entity” events is the parser. By assigning data from the raw logs to fields in the Entity data model (https://docs.cloud.google.com/chronicle/docs/reference/udm-field-list#udm_entity_data_model) in your parser, SecOps would create Entity type events from the raw logs.
- Matt
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
