Oracle Ejemplos de mensajes de eventos de Infraestructura de Nube

El siguiente ejemplo de mensaje de evento muestra los eventos que se recogen de Oracle Infrastructure Cloud (OCI)..

Ejemplo de mensaje de evento 1

En el siguiente evento de auditoría, Oracle Cloud Infrastructure (OCI) indica que se ha procesado correctamente una solicitud para recuperar un flujo.

{"data":{"additionalDetails":{"id":"ocid1.stream.oc1.ap-region-1.<unique_ID>"},"availabilityDomain":"AD1","compartmentId":"ocid1.tenancy.oc1..<unique_ID>","compartmentName":"compartmentname1","definedTags":{"Oracle-Tags":{"CreatedBy":"default/test.user@example.com","CreatedOn":"2025-04-03T08:44:41.578Z"}},"eventGroupingId":"EB2D63DCA6C4497B82A2C408FE109FD9/3D0CCC60EA6C45F85FDEA948CF5AA79E/1658D181D6F2A313C3F32694E3FA7CA9","eventName":"getStream","freeformTags":{},"identity":{"authType":null,"callerId":null,"callerName":null,"consoleSessionId":null,"credentials":null,"ipAddress":"<IP_address>","principalId":"ocid1.serviceconnector.oc1.ap-region-1.<unique_ID>","principalName":"User Name","tenantId":"ocid1.tenancy.oc1..<unique_ID>","userAgent":"Vert.x-WebClient/3.9.13"},"message":"Stream1 getStream succeed","request":{"action":"GET","headers":{"User-Agent":["Vert.x-WebClient/3.9.13","Oracle-JavaSDK/2.78.0 (Linux/5.15.0-306.177.4.el9uek.aarch64; Java/17.0.14; Java HotSpot(TM) 64-Bit Server VM/17.0.14+8-LTS-jvmci-23.0-b54)"],"X-Forwarded-For":["<IP_address>"],"auth-info":["{\"tenantId\":\"ocid1.tenancy.oc1..<unique_ID>\",\"subjectId\":\"ocid1.serviceconnector.oc1.ap-region-1.<unique_ID>\",\"claims\":[{\"key\":\"svc\",\"value\":\"service-connector-hub\",\"issuer\":\"authService.example1.com\"},{\"key\":\"h_date\",\"value\":\"Mon, 07 Apr 2025 08:34:33 GMT\",\"issuer\":\"h\"},{\"key\":\"res_tenant\",\"value\":\"ocid1.tenancy.oc1..<unique_ID>\",\"issuer\":\"authService.example1.com\"},{\"key\":\"ptype\",\"value\":\"resource\",\"issuer\":\"authService.example1.com\"},{\"key\":\"svcTenantId\",\"value\":\"ocid1.tenancy.oc1..aaaaaaaavjqvxoth73v7tyvcu7n7hlnfijd5pcow3ioo7ac57yacvc3eb7fa\",\"issuer\":\"authService.example1.com\"},{\"key\":\"res_type\",\"value\":\"serviceconnector\",\"issuer\":\"authService.example1.com\"},{\"key\":\"authorization\",\"value\":\"Signature ***\",keyId=\\\"<key_ID>\\\",algorithm=\\\"rsa-sha256\\\",signature=\\\"<signature>\\\",version=\\\"1\\\"\",\"issuer\":\"h\"},{\"key\":\"res_id\",\"value\":\"ocid1.serviceconnector.oc1.ap-region-1.<unique_ID>\",\"issuer\":\"authService.example1.com\"},{\"key\":\"ttype\",\"value\":\"res_sp\",\"issuer\":\"authService.example1.com\"},{\"key\":\"h_(request-target)\",\"value\":\"get /20180418/streams/ocid1.stream.oc1.ap-region-1.<unique_ID>\",\"issuer\":\"h\"},{\"key\":\"res_compartment\",\"value\":\"ocid1.tenancy.oc1..<unique_ID>\",\"issuer\":\"authService.example1.com\"},{\"key\":\"h_host\",\"value\":\"streaming.ap-region-1.oci.oraclecloud.com\",\"issuer\":\"h\"},{\"key\":\"opc-dgs\",\"value\":\"V3,ocid1.tenancy.oc1..<unique_ID>,AAAAAQAAAAB/f39/AAAAjw==,AAAAAA==\",\"issuer\":\"authService.example1.com\"}]}"],"opc-request-id":["EB2D63DCA6C4497B82A2C408FE109FD9/3D0CCC60EA6C45F85FDEA948CF5111111/1658D181D6F2A313C3F32694E3FA7CA9"]},"id":"EB1111111A6C4497B82A2C408FE109FD9/CF3BC30DBB2AE4FEBFE3BD5971C503E7/EB8C5A108CBA223274DA9FDDECE07E89","parameters":{"tenancy":["ocid1.tenancy.oc1..<unique_ID>"]},"path":"/20180418/gateway/streams/ocid1.stream.oc1.ap-region-1.<unique_ID>"},"resourceId":"ocid1.stream.oc1.ap-region-1.<unique_ID>","response":{"headers":{"Content-Length":["1305"],"Content-Type":["application/json"],"Date":["Mon, 07 Apr 2025 08:34:33 GMT"],"ETag":["\"8fd6e385-d19f-49ba-8373-c99192d322c6-80a6487e-9619-471e-beba-119fc5cbcd43\""],"Vary":["Accept-Encoding"],"opc-request-id":["EB2D63DCA6C4497B82A2C408FE109FD9/CF3BC30DBB2AE4FEBFE3BD5971C503E7/EB8C5A108CBA223274DA9FDDECE07E89"]},"message":null,"payload":null,"responseTime":"2025-04-07T08:34:33.774Z","status":"200"},"stateChange":{"current":null,"previous":null}},"dataschema":"2.0","id":"cf76df7b-269f-45c7-9398-f57afe85088a","oracle":{"compartmentid":"ocid1.tenancy.oc1..<unique_ID>","ingestedtime":"2025-04-07T08:34:42.669Z","loggroupid":"_Audit","tenantid":"ocid1.tenancy.oc1..<unique_ID>"},"source":"Stream1","specversion":"1.0","time":"2025-04-07T08:34:33.766Z","type":"com.oraclecloud.Streaming-ControlPlane.getStream"}
Tabla 1. Valores destacados en el evento de ejemplo de auditoría de la infraestructura de nube Oracle (OCI)
QRadar Nombre del campo de Nombre del campo de carga útil resaltado
ID de suceso data.eventName + Estado
IP de origen data.identity.ipAddress
Nombre de usuario data.identity.principalName
time time

Ejemplo de mensaje de evento 2

En el siguiente evento de ejemplo, OCI Object Storage indica que se ha cargado correctamente un nuevo objeto en un bucket.

{"data":{"additionalDetails":{"versionId":"b6af23b3-1111-1111-bdda-e03d85b818e8"},"apiType":"native","authenticationType":"user","bucketCreator":"ocid1.user.oc1..<unique_ID>","bucketId":"ocid1.bucket.oc1.ap-region-1.<unique_ID>","bucketName":"ReadWriteBucket","bytesDownloaded":"0","bytesUploaded":"9","clientIpAddress":"<IP_address>","compartmentId":"ocid1.tenancy.oc1..<unique_ID>","compartmentName":"compartment1","credentials":"***","eTag":"38795327-5c39-4e26-a10f-d73479186a4b","endTime":"2025-04-16T06:07:16.667Z","isPar":false,"message":"Object uploaded.","namespaceName":"bmuez42w2pkg","objectName":"TestTestFile.txt","opcRequestId":"bom-1:Aie9czz-DoJX-YkHD_Ru_0le-9PMWUwblFIjxxGPrV7-YhYSJWYsVpDLua9kvR14","principalId":"***","principalName":"Test User","region":"ap-region-1","requestAction":"PUT","requestResourcePath":"/n/bmuez42w2pkg/b/ReadWriteBucket/o/TestTestFile.txt","startTime":"2025-04-16T06:07:16.641Z","statusCode":200,"tenantId":"ocid1.tenancy.oc1..<unique_ID>","tenantName":"compartment1","userAgent":"Browser2/5.0 (Macintosh; Chip Mac OS X 10_15_7) TestWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Browser/605.1.15"},"id":"4b627ac1-61a2-4d29-960a-d5c89b7f7979","oracle":{"compartmentid":"ocid1.tenancy.oc1..<unique_ID>","ingestedtime":"2025-04-16T06:07:18.182Z","loggroupid":"ocid1.loggroup.oc1.ap-region-1.amaaaaaaxwc355aaaa64eyo43kqs62ag2dqi374e55c7pd4x5fb2ec7p73kq","logid":"ocid1.log.oc1.ap-region-1.amaaaaaaxwc355aapn36bnsisyq22az2kack5m3vyglns3agkvcuty5ewgzq","tenantid":"ocid1.tenancy.oc1..<unique_ID>"},"source":"ReadWriteBucket","specversion":"1.0","subject":"TestTestFile.txt","time":"2025-04-16T06:07:16.667Z","type":"com.oraclecloud.objectstorage.putobject"}
Tabla 2. Valores destacados en el evento de muestra del servicio Oracle Cloud Infrastructure (OCI) Object Storage
QRadar Nombre del campo de Nombre del campo de carga útil resaltado
ID de suceso message
IP de origen clientIpAddress
Nombre de usuario principalName
time time

Ejemplo de mensaje de evento 3

En el siguiente evento de ejemplo, OCI Key Management indica que se ha procesado correctamente una solicitud de descifrado de datos mediante una clave de bóveda especificada, lo que confirma el uso autorizado de la clave y el acceso a los datos cifrados

{"data":{"clientIpAddress":"<IP_address>","keyVersionId":"ocid1.keyversion.oc1.eu-frankfurt-1.<unique_ID>","opcRequestId":"<unique_ID>","principalId":"ocid1.user.oc1..<unique_ID>","requestAction":"DECRYPT","statusCode":200},"id":"<unique_ID>","oracle":{"compartmentid":"ocid1.tenancy.oc1..<unique_ID>","ingestedtime":"2024-12-18T07:05:42.327Z","loggroupid":"ocid1.loggroup.oc1.eu-frankfurt-1.<unique_ID>","logid":"ocid1.log.oc1.eu-frankfurt-1.<unique_ID>","tenantid":"ocid1.tenancy.oc1..<unique_ID>"},"source":"ocid1.vault.oc1.eu-frankfurt-1.<unique_ID>","specversion":"1.0","subject":"ocid1.key.oc1.eu-frankfurt-1.<unique_ID>","time":"2024-12-18T07:05:42.026Z","type":"com.oraclecloud.keymanagementservice.vault.crypto.decrypt"}
Tabla 3. Valores destacados en el evento de ejemplo del servicio de gestión de claves de Oracle Cloud Infrastructure (OCI)
QRadar Nombre del campo de Nombre del campo de carga útil resaltado
ID de suceso requestAction + statusCode
IP de origen clientIpAddress
time time

Ejemplo de mensaje de evento 4

En el siguiente evento de muestra, OCI Network Firewall indica que se ha identificado un archivo de malware de prueba (EICAR) en el tráfico de red, lo que confirma que los mecanismos de detección de amenazas están supervisando activamente y funcionando según lo esperado

{"data":{"action":"reset-both","device_name":"<device_name>","direction":"server-to-client","dst":"192.0.1.168","dstloc":"192.0.0.10-192.0.0.11","dstuser":"no-value","firewall-id":"ocid1.networkfirewall.oc1.me-jeddah-1.<unique_ID>","proto":"tcp","receive_time":"2023/05/16 16:52:29","rule":"<rule_name>","sessionid":"11804","severity":"medium","src":"192.0.2.168","srcloc":"192.0.0.1-192.0.0.2","srcuser":"no-value","subtype":"vulnerability","thr_category":"code-execution","threatid":"Eicar File Detected"},"id":"<unique_ID>","oracle":{"compartmentid":"ocid1.compartment.oc1..<unique_ID>","ingestedtime":"2023-05-16T16:56:27.373Z","loggroupid":"ocid1.loggroup.oc1.me-jeddah-1.<unique_ID>","logid":"ocid1.log.oc1.me-jeddah-1.<unique_ID>","tenantid":"ocid1.tenancy.oc1..<unique_ID>"},"source":"ocid1.networkfirewall.oc1.me-jeddah-1.<unique_ID>","specversion":"1.0","time":"2023-05-16T16:52:29.000Z","type":"com.oraclecloud.networkfirewall.threat"}
Tabla 4. Valores resaltados en el evento de ejemplo del servicio de cortafuegos de red de Oracle Cloud Infrastructure (OCI)
QRadar Nombre del campo de Nombre del campo de carga útil resaltado
ID de suceso threatid
IP de origen thr_category
IP de destino src
Nombre de usuario dst
time time

Ejemplo de mensaje de evento 5

En el siguiente evento de ejemplo, OCI indica que un conector ha finalizado su ejecución.

{"data":{"level":"INFO","message":"Run succeeded - Read 2 messages from source and wrote 2 messages to target","messageType":"CONNECTOR_RUN_COMPLETED"},"id":"f83205ef-0bef-47d0-b6b2-362afc4a2e9a","oracle":{"compartmentid":"ocid1.compartment.oc1..<unique_ID>","ingestedtime":"2023-08-02T00:10:28.990Z","loggroupid":"ocid1.loggroup.oc1.phx.<unique_ID>","logid":"ocid1.log.oc1.phx.<unique_ID>","resourceid":"ocid1.serviceconnector.oc1.phx.<unique_ID>","tenantid":"ocid1.tenancy.oc1..<unique_ID>"},"source":"KP_SourceStream1_TargetStream1","specversion":"1.0","time":"2023-08-02T00:10:26.859Z","type":"com.oraclecloud.sch.serviceconnector.runlog"}
Tabla 5. Valores resaltados en el evento de ejemplo Oracle Cloud Infrastructure (OCI) Connector Hub Service
QRadar Nombre del campo de Nombre del campo de carga útil resaltado
ID de suceso messageType + level
time time