收集 reCAPTCHA Enterprise 日志
本文档介绍了如何通过为 Google Security Operations 启用 Google Cloud 遥测数据注入来收集 reCAPTCHA Enterprise 日志，以及如何将 reCAPTCHA Enterprise 日志的日志字段映射到 Google Security Operations 统一数据模型 (UDM) 字段。
如需了解详情，请参阅 Google Security Operations 数据注入概览。
典型的部署由用于注入 Google Security Operations 的 reCAPTCHA Enterprise 日志组成。每个客户部署可能有所不同，并且可能更复杂。
假设有一个包含以下组件的部署：
Google Cloud：您可以从中收集日志的 Google Cloud 服务和产品。
reCAPTCHA Enterprise 日志：用于提取到 Google Security Operations 的 reCAPTCHA Enterprise 日志。
Google 安全运维套件：Google 安全运维套件会保留和分析 reCAPTCHA Enterprise 中的日志。
您需要使用提取标签来识别将原始日志数据标准化为结构化 UDM 格式的解析器。本文档适用于带有 GCP_RECAPTCHA_ENTERPRISE 提取标签的解析器。
准备工作
确保部署架构中的所有系统均按 UTC 时区进行配置。
确保您已专门针对以下各项启用 reCAPTCHA Enterprise 的平台日志记录：
- 评估日志
- 注解日志
配置 Google Cloud 以进行数据注入
如需将 reCAPTCHA Enterprise 日志注入到 Google Security Operations，请按照将 Google Cloud 数据注入到 Google Security Operations 页面中的步骤操作。
如果您在注入 reCAPTCHA Enterprise 日志时遇到问题，请与 Google 安全运维支持团队联系。
字段映射参考文档
字段映射参考：reCAPTCHA Enterprise - 评估
下表列出了 Assessment 日志类型的日志字段及其对应的 UDM 字段。
| Log field | UDM mapping | Logic |
|---|---|---|
|
metadata.product_name |
The metadata.product_name UDM field is set to reCAPTCHA. |
|
metadata.vendor_name |
The metadata.vendor_name UDM field is set to Google Cloud Platform. |
|
metadata.event_type |
The metadata.event_type UDM field is set to USER_UNCATEGORIZED. |
jsonPayload.@type |
metadata.product_event_type |
|
jsonPayload.name |
security_result.detection_fields[json_payload_name] |
|
insertId |
metadata.product_log_id |
|
timestamp |
metadata.event_timestamp |
|
logName |
metadata.url_back_to_product |
The http://console.cloud.go888ogle.com.fqhub.com/logs?%{logName} field is mapped to the metadata.url_back_to_product UDM field. |
receiveTimestamp |
metadata.collected_timestamp |
|
resource.labels.key_id |
target.resource.product_object_id |
|
resource.type |
target.resource.resource_subtype |
|
resource.labels.location |
target.location.name |
|
resource.labels.resource_container |
target.resource.attribute.labels[resource_labels_resource_container] |
|
labels.backend_language |
target.resource.attribute.labels[labels_backend_language] |
|
labels.demo_key |
target.resource.attribute.labels[labels_demo_key] |
|
jsonPayload.event.userAgent |
network.http.user_agent |
|
jsonPayload.event.userIpAddress |
principal.ip |
|
|
principal.resource.resource_type |
If jsonPayload.event.token log field value is not empty, then principal.resource.resource_type UDM field is set to CREDENTIAL. |
jsonPayload.event.token |
principal.resource.product_object_id |
|
jsonPayload.event.siteKey |
security_result.detection_fields[event_site_key] |
|
jsonPayload.event.hashedAccountId |
principal.user.attribute.labels[event_hashed_account_id] |
|
jsonPayload.event.expectedAction |
principal.user.attribute.labels[event_expected_action] |
|
jsonPayload.tokenProperties.action |
principal.resource.attribute.labels[token_properties_action] |
|
jsonPayload.tokenProperties.createTime |
principal.resource.attribute.creation_time |
|
jsonPayload.tokenProperties.hostname |
target.hostname |
|
jsonPayload.tokenProperties.invalidReason |
principal.resource.attribute.labels[token_properties_invalid_reason] |
|
jsonPayload.tokenProperties.valid |
principal.resource.attribute.labels[token_properties_valid] |
|
jsonPayload.tokenProperties.androidPackageName |
principal.resource.attribute.labels[token_properties_android_package_name] |
|
jsonPayload.tokenProperties.iosBundleId |
principal.resource.attribute.labels[token_properties_ios_bundle_id] |
|
|
security_result.verdict_info.verdict_type |
If the jsonPayload.riskAnalysis.reasons log field value is not empty, then the security_result.verdict_info.verdict_type UDM field is set to PROVIDER_ML_VERDICT. |
jsonPayload.riskAnalysis.reasons |
security_result.verdict_info.category_details |
If the index value is equal to 0, then the jsonPayload.riskAnalysis.reasons log field is mapped to the security_result.verdict_info.category_details UDM field.Else, the jsonPayload.riskAnalysis.reasons log field is mapped to the security_result.detection_fields.risk_analysis_reasons UDM field. |
jsonPayload.riskAnalysis.reasons |
security_result.detection_fields[risk_analysis_reasons] |
If the index value is equal to 0, then the jsonPayload.riskAnalysis.reasons log field is mapped to the security_result.verdict_info.category_details UDM field.Else, the jsonPayload.riskAnalysis.reasons log field is mapped to the security_result.detection_fields.risk_analysis_reasons UDM field. |
jsonPayload.riskAnalysis.score |
security_result.risk_score |
|
jsonPayload.riskAnalysis.extendedVerdictReasons |
security_result.detection_fields[risk_analysis_extended_verdict_reasons] |
|
jsonPayload.event.express |
additional.fields[event_express] |
|
jsonPayload.event.requestedUri |
target.url |
|
jsonPayload.event.wafTokenAssessment |
security_result.detection_fields[event_waf_token_assessment] |
|
jsonPayload.event.ja3 |
network.tls.client.ja3 |
|
jsonPayload.event.headers |
additional.fields[event_headers_%{index}] |
The jsonPayload.event.headers log field is mapped to the additional.fields[event_headers_%{index}] UDM field. |
jsonPayload.event.firewallPolicyEvaluation |
additional.fields[event_firewall_policy_evaluation] |
|
jsonPayload.event.userInfo.createAccountTime |
principal.user.attribute.creation_time |
|
jsonPayload.event.userInfo.accountId |
principal.user.userid |
If the jsonPayload.event.userInfo.accountId log field value is not empty, then the jsonPayload.event.userInfo.accountId log field is mapped to the principal.user.userid UDM field.Else, the jsonPayload.event.transactionData.user.accountId log field is mapped to the principal.user.userid UDM field. |
jsonPayload.event.userInfo.userIds.email |
principal.user.email_addresses |
|
jsonPayload.event.userInfo.userIds.phoneNumber |
principal.user.phone_numbers |
|
jsonPayload.event.userInfo.userIds.username |
principal.user.user_display_name |
If the index value is equal to 0, then the jsonPayload.event.userInfo.userIds.username log field is mapped to the principal.user.user_display_name UDM field.Else, the jsonPayload.event.userInfo.userIds.username log field is mapped to the principal.user.attribute.labels.event_user_info_user_ids_username UDM field. |
jsonPayload.event.userInfo.userIds.username |
principal.user.attribute.labels[event_user_info_user_ids_username] |
If the index value is equal to 0, then the jsonPayload.event.userInfo.userIds.username log field is mapped to the principal.user.user_display_name UDM field.Else, the jsonPayload.event.userInfo.userIds.username log field is mapped to the principal.user.attribute.labels.event_user_info_user_ids_username UDM field. |
jsonPayload.event.transactionData.transactionId |
security_result.detection_fields[event_transaction_data_transaction_id] |
|
jsonPayload.event.transactionData.paymentMethod |
security_result.detection_fields[event_transaction_data_payment_method] |
|
jsonPayload.event.transactionData.cardBin |
security_result.detection_fields[event_transaction_data_card_bin] |
|
jsonPayload.event.transactionData.cardLastFour |
security_result.detection_fields[event_transaction_data_card_last_four] |
|
jsonPayload.event.transactionData.currencyCode |
security_result.detection_fields[event_transaction_data_currency_code] |
|
jsonPayload.event.transactionData.value |
security_result.detection_fields[event_transaction_data_value] |
|
jsonPayload.event.transactionData.shippingValue |
security_result.detection_fields[event_transaction_data_shipping_value] |
|
jsonPayload.event.transactionData.shippingAddress.recipient |
principal.user.attribute.labels[event_transaction_data_shipping_address_recipient] |
|
jsonPayload.event.transactionData.shippingAddress.address |
principal.user.personal_address.name |
If the index value is equal to 0, then the jsonPayload.event.transactionData.shippingAddress.address log field is mapped to the principal.user.personal_address.name UDM field.Else, the jsonPayload.event.transactionData.shippingAddress.address log field is mapped to the principal.user.attribute.labels.event_transaction_data_shipping_address_address UDM field. |
jsonPayload.event.transactionData.shippingAddress.address |
principal.user.attribute.labels[event_transaction_data_shipping_address_address] |
If the index value is equal to 0, then the jsonPayload.event.transactionData.shippingAddress.address log field is mapped to the principal.user.personal_address.name UDM field.Else, the jsonPayload.event.transactionData.shippingAddress.address log field is mapped to the principal.user.attribute.labels.event_transaction_data_shipping_address_address UDM field. |
jsonPayload.event.transactionData.shippingAddress.locality |
principal.user.personal_address.city |
|
jsonPayload.event.transactionData.shippingAddress.administrativeArea |
principal.user.personal_address.state |
|
jsonPayload.event.transactionData.shippingAddress.regionCode |
principal.user.personal_address.country_or_region |
|
jsonPayload.event.transactionData.shippingAddress.postalCode |
principal.user.attribute.labels[event_transaction_data_shipping_address_postal_code] |
|
jsonPayload.event.transactionData.billingAddress.recipient |
about.user.attribute.labels[event_transaction_data_billing_address_recipient] |
|
jsonPayload.event.transactionData.billingAddress.address |
about.user.personal_address.name |
If the index value is equal to 0, then the jsonPayload.event.transactionData.billingAddress.address log field is mapped to the about.user.personal_address.name UDM field.Else, the jsonPayload.event.transactionData.billingAddress.address log field is mapped to the about.user.attribute.labels.event_transaction_data_billing_address_address UDM field. |
jsonPayload.event.transactionData.billingAddress.address |
about.user.attribute.labels[event_transaction_data_billing_address_address] |
If the index value is equal to 0, then the jsonPayload.event.transactionData.billingAddress.address log field is mapped to the about.user.personal_address.name UDM field.Else, the jsonPayload.event.transactionData.billingAddress.address log field is mapped to the about.user.attribute.labels.event_transaction_data_billing_address_address UDM field. |
jsonPayload.event.transactionData.billingAddress.locality |
about.user.personal_address.city |
|
jsonPayload.event.transactionData.billingAddress.administrativeArea |
about.user.personal_address.state |
|
jsonPayload.event.transactionData.billingAddress.regionCode |
about.user.personal_address.country_or_region |
|
jsonPayload.event.transactionData.billingAddress.postalCode |
about.user.attribute.labels[event_transaction_data_billing_address_postal_code] |
|
jsonPayload.event.transactionData.user.accountId |
principal.user.userid |
If the jsonPayload.event.userInfo.accountId log field value is not empty, then the jsonPayload.event.userInfo.accountId log field is mapped to the principal.user.userid UDM field.Else, the jsonPayload.event.transactionData.user.accountId log field is mapped to the principal.user.userid UDM field. |
jsonPayload.event.transactionData.user.creationMs |
principal.user.attribute.creation_time |
|
jsonPayload.event.transactionData.user.email |
principal.user.email_addresses |
|
jsonPayload.event.transactionData.user.emailVerified |
principal.user.attribute.labels[event_transaction_data_user_email_verified] |
|
jsonPayload.event.transactionData.user.phoneNumber |
principal.user.phone_numbers |
|
jsonPayload.event.transactionData.user.phoneVerified |
principal.user.attribute.labels[event_transaction_data_user_phone_verified] |
|
jsonPayload.event.transactionData.merchants.accountId |
about.user.userid |
|
jsonPayload.event.transactionData.merchants.creationMs |
about.user.attribute.creation_time |
|
jsonPayload.event.transactionData.merchants.email |
about.user.email_addresses |
|
jsonPayload.event.transactionData.merchants.emailVerified |
about.user.attribute.labels[event_transaction_data_merchants_email_verified] |
|
jsonPayload.event.transactionData.merchants.phoneNumber |
about.user.phone_numbers |
|
jsonPayload.event.transactionData.merchants.phoneVerified |
about.user.attribute.labels[event_transaction_data_merchants_phone_verified] |
|
jsonPayload.event.transactionData.gatewayInfo.name |
security_result.detection_fields[event_transaction_data_gateway_info_name] |
|
jsonPayload.event.transactionData.gatewayInfo.gatewayResponseCode |
security_result.detection_fields[event_transaction_data_gateway_info_gateway_response_code] |
|
jsonPayload.event.transactionData.gatewayInfo.avsResponseCode |
security_result.detection_fields[event_transaction_data_gateway_info_avs_response_code] |
|
jsonPayload.event.transactionData.gatewayInfo.cvvResponseCode |
security_result.detection_fields[event_transaction_data_gateway_info_cvv_response_code] |
|
jsonPayload.event.transactionData.items.name |
security_result.detection_fields[event_transaction_data_items_name] |
|
jsonPayload.event.transactionData.items.value |
security_result.detection_fields[event_transaction_data_items_value] |
|
jsonPayload.event.transactionData.items.quantity |
security_result.detection_fields[event_transaction_data_items_quantity] |
|
jsonPayload.event.transactionData.items.merchantAccountId |
security_result.detection_fields[event_transaction_data_items_merchant_account_id] |
|
jsonPayload.accountVerification.endpoints.requestToken |
principal.user.attribute.labels[account_verification_endpoint_request_token] |
|
jsonPayload.accountVerification.endpoints.lastVerificationTime |
principal.user.attribute.labels[account_verification_endpoint_last_verification_time] |
|
jsonPayload.accountVerification.endpoints.emailAddress |
principal.user.email_addresses |
|
jsonPayload.accountVerification.endpoints.phoneNumber |
principal.user.phone_numbers |
|
jsonPayload.accountVerification.languageCode |
additional.fields[account_verification_language_code] |
|
|
security_result.action |
If the jsonPayload.accountVerification.latestVerificationResult log field value is equal to SUCCESS_USER_VERIFIED, then the security_result.action UDM field is set to CHALLENGE.Else, if the jsonPayload.accountVerification.latestVerificationResult log field value is equal to ERROR_USER_NOT_VERIFIED, then the security_result.action UDM field is set to FAIL.Else, if the jsonPayload.accountVerification.latestVerificationResult log field value is equal to ERROR_RECIPIENT_NOT_ALLOWED, then the security_result.action UDM field is set to BLOCK.Else, if the jsonPayload.accountVerification.latestVerificationResult log field value is equal to ERROR_VERDICT_MISMATCH, then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.Else, the security_result.action UDM field is set to UNKNOWN_ACTION. |
jsonPayload.accountVerification.latestVerificationResult |
security_result.action_details |
|
jsonPayload.accountDefenderAssessment.labels |
security_result.detection_fields[account_defender_assessment_labels] |
|
jsonPayload.privatePasswordLeakVerification.lookupHashPrefix |
principal.user.attribute.labels[private_password_leak_verification_lookup_hash_prefix] |
|
jsonPayload.privatePasswordLeakVerification.encryptedUserCredentialsHash |
principal.user.attribute.labels[private_password_leak_verification_encrypted_user_credentials_hash] |
|
jsonPayload.privatePasswordLeakVerification.encryptedLeakMatchPrefixes |
principal.user.attribute.labels[private_password_leak_verification_encrypted_leak_match_prefixes] |
|
jsonPayload.privatePasswordLeakVerification.reencryptedUserCredentialsHash |
principal.user.attribute.labels[private_password_leak_verification_reencrypted_user_credentials_hash] |
|
|
network.http.response_code |
If the jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 0, then the network.http.response_code UDM field is set to 200.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value contains one of the following values, then the network.http.response_code UDM field is set to 400.
jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 16, then the network.http.response_code UDM field is set to 401.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 7, then the network.http.response_code UDM field is set to 403.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 5, then the network.http.response_code UDM field is set to 404.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value contains one of the following values, then the network.http.response_code UDM field is set to 409.
jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 8, then the network.http.response_code UDM field is set to 429.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 1, then the network.http.response_code UDM field is set to 499.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value contains one of the following values, then the network.http.response_code UDM field is set to 500.
jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 12, then the network.http.response_code UDM field is set to 501.Else, if the jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 14, then the network.http.response_code UDM field is set to 503. Else the jsonPayload.firewallPolicyAssessment.error.code log field value is equal to 4, then the network.http.response_code UDM field is set to 504. |
jsonPayload.firewallPolicyAssessment.error.message |
security_result.detection_fields[firewall_policy_assessment_error_message] |
|
jsonPayload.firewallPolicyAssessment.error.details |
security_result.detection_fields[firewall_policy_assessment_error_details] |
|
jsonPayload.fraudPreventionAssessment.transactionRisk |
security_result.detection_fields[fraud_prevention_assessment_transaction_risk] |
|
jsonPayload.fraudPreventionAssessment.stolenInstrumentVerdict.risk |
security_result.detection_fields[fraud_prevention_assessment_stolen_instrument_verdict_risk] |
|
jsonPayload.fraudPreventionAssessment.cardTestingVerdict.risk |
security_result.detection_fields[fraud_prevention_assessment_card_testing_erdict_risk] |
|
jsonPayload.fraudPreventionAssessment.behavioralTrustVerdict.trust |
security_result.detection_fields[fraud_prevention_assessment_behavioral_trust_verdict_trust] |
|
jsonPayload.fraudSignals.userSignals.activeDaysLowerBound |
security_result.detection_fields[fraud_signals_user_signals_active_days_lower_bound] |
|
jsonPayload.fraudSignals.userSignals.syntheticRisk |
security_result.detection_fields[fraud_signals_user_signals_synthetic_risk] |
|
jsonPayload.fraudSignals.cardSignals.cardLabels |
security_result.detection_fields[fraud_signals_card_signals_card_labels] |
|
jsonPayload.firewallPolicyAssessment.firewallPolicy.name |
intermediary.resource.name |
|
|
intermediary.resource.resource_type |
If the jsonPayload.firewallPolicyAssessment.firewallPolicy.name log field value is not empty, then the intermediary.resource.resource_type UDM field is set to FIREWALL_RULE. |
jsonPayload.firewallPolicyAssessment.firewallPolicy.description |
intermediary.resource.attribute.labels[firewall_policy_assessment_description] |
|
jsonPayload.firewallPolicyAssessment.firewallPolicy.path |
intermediary.resource.attribute.labels[firewall_policy_assessment_path] |
|
jsonPayload.firewallPolicyAssessment.firewallPolicy.conditions |
intermediary.resource.attribute.labels[firewall_policy_assessment_conditions] |
|
|
security_result.action |
If the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.allow log field value is not empty, then the security_result.action UDM field is set to ALLOW. |
|
security_result.action |
If the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.block log field value is not empty, then the security_result.action UDM field is set to BLOCK. |
|
security_result.action |
If the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.redirect log field value is not empty, then the security_result.action UDM field is set to CHALLENGE. |
jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.substitute.path |
target.url_metadata.last_final_url |
If the index value is equal to 0, then the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.substitute.path log field is mapped to the target.url_metadata.last_final_url UDM field.Else, the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.substitute.path log field is mapped to the intermediary.resource.attribute.labels.firewall_policy_assessment_firewall_policy_actions_substitute_path UDM field. |
jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.substitute.path |
intermediary.resource.attribute.labels[firewall_policy_assessment_firewall_policy_actions_substitute_path] |
If the index value is equal to 0, then the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.substitute.path log field is mapped to the target.url_metadata.last_final_url UDM field.Else, the jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.substitute.path log field is mapped to the intermediary.resource.attribute.labels.firewall_policy_assessment_firewall_policy_actions_substitute_path UDM field. |
jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.setHeader.key |
intermediary.resource.attribute.labels[firewall_policy_assessment_firewall_policy_actions_set_header_key] |
|
jsonPayload.firewallPolicyAssessment.firewallPolicy.actions.setHeader.value |
intermediary.resource.attribute.labels[firewall_policy_assessment_firewall_policy_actions_set_header_value] |
字段映射参考文档：reCAPTCHA Enterprise - 注解
下表列出了 Annotation 日志类型的日志字段及其对应的 UDM 字段。
| Log field | UDM mapping | Logic |
|---|---|---|
|
metadata.product_name |
The metadata.product_name UDM field is set to reCAPTCHA. |
|
metadata.vendor_name |
The metadata.vendor_name UDM field is set to Google Cloud Platform. |
|
metadata.event_type |
The metadata.event_type UDM field is set to GENERIC_EVENT. |
jsonPayload.@type |
metadata.product_event_type |
|
insertId |
metadata.product_log_id |
|
timestamp |
metadata.event_timestamp |
|
logName |
metadata.url_back_to_product |
The http://console.cloud.go888ogle.com.fqhub.com/logs?%{logName} field is mapped to the metadata.url_back_to_product UDM field. |
receiveTimestamp |
metadata.collected_timestamp |
|
jsonPayload.name |
security_result.detection_fields[json_payload_name] |
|
resource.labels.key_id |
target.resource.product_object_id |
|
resource.type |
target.resource.resource_subtype |
|
resource.labels.location |
target.location.name |
|
resource.labels.resource_container |
target.resource.attribute.labels[resource_labels_resource_container] |
|
labels.backend_language |
target.resource.attribute.labels[labels_backend_language] |
|
labels.demo_key |
target.resource.attribute.labels[labels_demo_key] |
|
|
security_result.verdict_info.verdict_response |
If the jsonPayload.annotation log field value is equal to LEGITIMATE, then the security_result.verdict_info.verdict_response UDM field is set to BENIGN.Else, if the jsonPayload.annotation log field value is equal to FRAUDULENT, then the security_result.verdict_info.verdict_response UDM field is set to MALICIOUS.Else, the jsonPayload.annotation log field value is equal to ANNOTATION_UNSPECIFIED, then the security_result.verdict_info.verdict_response UDM field is set to VERDICT_RESPONSE_UNSPECIFIED. |
jsonPayload.reasons |
security_result.verdict_info.category_details |
If the index value is equal to 0, then the jsonPayload.reasons log field is mapped to the security_result.verdict_info.category_details UDM field.Else, the jsonPayload.reasons log field is mapped to the security_result.detection_fields.reasons UDM field. |
jsonPayload.reasons |
security_result.detection_fields[reasons] |
If the index value is equal to 0, then the jsonPayload.reasons log field is mapped to the security_result.verdict_info.category_details UDM field.Else, the jsonPayload.reasons log field is mapped to the security_result.detection_fields.reasons UDM field. |
jsonPayload.accountId |
target.user.userid |
|
jsonPayload.hashedAccountId |
target.user.attribute.labels[hashed_account_id] |
|
jsonPayload.transactionEvent.eventType |
security_result.detection_fields[transaction_event_event_type] |
|
jsonPayload.transactionEvent.reason |
security_result.detection_fields[transaction_event_reason] |
|
jsonPayload.transactionEvent.value |
security_result.detection_fields[transaction_event_value] |
|
jsonPayload.transactionEvent.eventTime |
security_result.detection_fields[transaction_event_event_time] |