Geração de registros de auditoria do Cloud NGFW

Neste documento, descrevemos a geração de registros de auditoria do Cloud Next Generation Firewall.Os serviços do Google Cloud geram registros de auditoria das atividades administrativas e de acesso nos recursos do Google Cloud . Para mais informações sobre os Registros de Auditoria do Cloud, confira:

Nome do serviço

Os registros de auditoria do Cloud Next Generation Firewall usam o nome de serviço networksecurity.googleapis.com. Filtrar por este serviço:

    protoPayload.serviceName="networksecurity.googleapis.com"
  

Métodos por tipo de permissão

Cada permissão do IAM tem uma propriedade type, que tem o valor de um tipo enumerado que pode ser um dos quatro valores: ADMIN_READ, ADMIN_WRITE, DATA_READ ou DATA_WRITE. Quando você chama um método, o Cloud Next Generation Firewall gera um registro de auditoria com categoria dependente da propriedade type da permissão necessária para executar o método. Métodos que exigem uma permissão do IAM com o valor da propriedade type de DATA_READ, DATA_WRITE ou ADMIN_READ geram registros de auditoria de acesso aos dados. Métodos que exigem uma permissão do IAM com o valor da propriedade type de ADMIN_WRITE geram registros de auditoria de atividade do administrador.

Os métodos de API na lista a seguir marcados com (LRO) são operações de longa duração. Em geral, esses métodos geram duas entradas de registro de auditoria: uma quando a operação começa e outra quando ela termina. Para mais informações, consulte Registros de auditoria para operações de longa duração.
Tipo de permissão Métodos
ADMIN_READ google.cloud.networksecurity.v1.AddressGroupService.GetAddressGroup
google.cloud.networksecurity.v1.AddressGroupService.ListAddressGroupReferences
google.cloud.networksecurity.v1.AddressGroupService.ListAddressGroups
google.cloud.networksecurity.v1.FirewallActivation.GetFirewallEndpoint
google.cloud.networksecurity.v1.FirewallActivation.GetFirewallEndpointAssociation
google.cloud.networksecurity.v1.FirewallActivation.ListFirewallEndpointAssociations
google.cloud.networksecurity.v1.FirewallActivation.ListFirewallEndpoints
google.cloud.networksecurity.v1.Intercept.GetInterceptDeployment
google.cloud.networksecurity.v1.Intercept.GetInterceptDeploymentGroup
google.cloud.networksecurity.v1.Intercept.GetInterceptEndpointGroup
google.cloud.networksecurity.v1.Intercept.GetInterceptEndpointGroupAssociation
google.cloud.networksecurity.v1.Intercept.ListInterceptDeploymentGroups
google.cloud.networksecurity.v1.Intercept.ListInterceptDeployments
google.cloud.networksecurity.v1.Intercept.ListInterceptEndpointGroupAssociations
google.cloud.networksecurity.v1.Intercept.ListInterceptEndpointGroups
google.cloud.networksecurity.v1.Mirroring.GetMirroringDeployment
google.cloud.networksecurity.v1.Mirroring.GetMirroringDeploymentGroup
google.cloud.networksecurity.v1.Mirroring.GetMirroringEndpointGroup
google.cloud.networksecurity.v1.Mirroring.GetMirroringEndpointGroupAssociation
google.cloud.networksecurity.v1.Mirroring.ListMirroringDeploymentGroups
google.cloud.networksecurity.v1.Mirroring.ListMirroringDeployments
google.cloud.networksecurity.v1.Mirroring.ListMirroringEndpointGroupAssociations
google.cloud.networksecurity.v1.Mirroring.ListMirroringEndpointGroups
google.cloud.networksecurity.v1.NetworkSecurity.GetAuthorizationPolicy
google.cloud.networksecurity.v1.NetworkSecurity.GetAuthzPolicy
google.cloud.networksecurity.v1.NetworkSecurity.GetBackendAuthenticationConfig
google.cloud.networksecurity.v1.NetworkSecurity.GetClientTlsPolicy
google.cloud.networksecurity.v1.NetworkSecurity.GetGatewaySecurityPolicy
google.cloud.networksecurity.v1.NetworkSecurity.GetGatewaySecurityPolicyRule
google.cloud.networksecurity.v1.NetworkSecurity.GetServerTlsPolicy
google.cloud.networksecurity.v1.NetworkSecurity.GetTlsInspectionPolicy
google.cloud.networksecurity.v1.NetworkSecurity.GetUrlList
google.cloud.networksecurity.v1.NetworkSecurity.ListAuthorizationPolicies
google.cloud.networksecurity.v1.NetworkSecurity.ListAuthzPolicies
google.cloud.networksecurity.v1.NetworkSecurity.ListBackendAuthenticationConfigs
google.cloud.networksecurity.v1.NetworkSecurity.ListClientTlsPolicies
google.cloud.networksecurity.v1.NetworkSecurity.ListGatewaySecurityPolicies
google.cloud.networksecurity.v1.NetworkSecurity.ListGatewaySecurityPolicyRules
google.cloud.networksecurity.v1.NetworkSecurity.ListServerTlsPolicies
google.cloud.networksecurity.v1.NetworkSecurity.ListTlsInspectionPolicies
google.cloud.networksecurity.v1.NetworkSecurity.ListUrlLists
google.cloud.networksecurity.v1.OrganizationAddressGroupService.GetAddressGroup
google.cloud.networksecurity.v1.OrganizationAddressGroupService.ListAddressGroups
google.cloud.networksecurity.v1.OrganizationSecurityProfileGroupService.GetSecurityProfile
google.cloud.networksecurity.v1.OrganizationSecurityProfileGroupService.GetSecurityProfileGroup
google.cloud.networksecurity.v1.OrganizationSecurityProfileGroupService.ListSecurityProfileGroups
google.cloud.networksecurity.v1.OrganizationSecurityProfileGroupService.ListSecurityProfiles
google.cloud.networksecurity.v1alpha1.Intercept.GetInterceptDeployment
google.cloud.networksecurity.v1alpha1.Intercept.GetInterceptDeploymentGroup
google.cloud.networksecurity.v1alpha1.Intercept.GetInterceptEndpointGroup
google.cloud.networksecurity.v1alpha1.Intercept.GetInterceptEndpointGroupAssociation
google.cloud.networksecurity.v1alpha1.Intercept.ListInterceptDeploymentGroups
google.cloud.networksecurity.v1alpha1.Intercept.ListInterceptDeployments
google.cloud.networksecurity.v1alpha1.Intercept.ListInterceptEndpointGroupAssociations
google.cloud.networksecurity.v1alpha1.Intercept.ListInterceptEndpointGroups
google.cloud.networksecurity.v1alpha1.Mirroring.GetMirroringDeployment
google.cloud.networksecurity.v1alpha1.Mirroring.GetMirroringDeploymentGroup
google.cloud.networksecurity.v1alpha1.Mirroring.GetMirroringEndpointGroup
google.cloud.networksecurity.v1alpha1.Mirroring.GetMirroringEndpointGroupAssociation
google.cloud.networksecurity.v1alpha1.Mirroring.ListMirroringDeploymentGroups
google.cloud.networksecurity.v1alpha1.Mirroring.ListMirroringDeployments
google.cloud.networksecurity.v1alpha1.Mirroring.ListMirroringEndpointGroupAssociations
google.cloud.networksecurity.v1alpha1.Mirroring.ListMirroringEndpointGroups
google.cloud.networksecurity.v1alpha1.SSEGatewayService.GetPartnerSSEGateway
google.cloud.networksecurity.v1alpha1.SSERealmService.ListSACAttachments
google.cloud.networksecurity.v1beta1.Intercept.GetInterceptDeployment
google.cloud.networksecurity.v1beta1.Intercept.GetInterceptDeploymentGroup
google.cloud.networksecurity.v1beta1.Intercept.GetInterceptEndpointGroup
google.cloud.networksecurity.v1beta1.Intercept.GetInterceptEndpointGroupAssociation
google.cloud.networksecurity.v1beta1.Intercept.ListInterceptDeploymentGroups
google.cloud.networksecurity.v1beta1.Intercept.ListInterceptDeployments
google.cloud.networksecurity.v1beta1.Intercept.ListInterceptEndpointGroupAssociations
google.cloud.networksecurity.v1beta1.Intercept.ListInterceptEndpointGroups
google.cloud.networksecurity.v1beta1.Mirroring.GetMirroringDeployment
google.cloud.networksecurity.v1beta1.Mirroring.GetMirroringDeploymentGroup
google.cloud.networksecurity.v1beta1.Mirroring.GetMirroringEndpointGroup
google.cloud.networksecurity.v1beta1.Mirroring.GetMirroringEndpointGroupAssociation
google.cloud.networksecurity.v1beta1.Mirroring.ListMirroringDeploymentGroups
google.cloud.networksecurity.v1beta1.Mirroring.ListMirroringDeployments
google.cloud.networksecurity.v1beta1.Mirroring.ListMirroringEndpointGroupAssociations
google.cloud.networksecurity.v1beta1.Mirroring.ListMirroringEndpointGroups
google.cloud.networksecurity.v1beta1.SSERealmService.ListSACAttachments
google.cloud.networksecurity.v1beta1.SSERealmService.ListSACRealms
GetIamPolicy
google.longrunning.Operations.GetOperation
google.longrunning.Operations.ListOperations
ADMIN_WRITE google.cloud.networksecurity.v1.AddressGroupService.AddAddressGroupItems (LRO)
google.cloud.networksecurity.v1.AddressGroupService.CloneAddressGroupItems (LRO)
google.cloud.networksecurity.v1.AddressGroupService.CreateAddressGroup (LRO)
google.cloud.networksecurity.v1.AddressGroupService.DeleteAddressGroup (LRO)
google.cloud.networksecurity.v1.AddressGroupService.RemoveAddressGroupItems (LRO)
google.cloud.networksecurity.v1.AddressGroupService.UpdateAddressGroup (LRO)
google.cloud.networksecurity.v1.FirewallActivation.CreateFirewallEndpoint (LRO)
google.cloud.networksecurity.v1.FirewallActivation.CreateFirewallEndpointAssociation (LRO)
google.cloud.networksecurity.v1.FirewallActivation.DeleteFirewallEndpoint (LRO)
google.cloud.networksecurity.v1.FirewallActivation.DeleteFirewallEndpointAssociation (LRO)
google.cloud.networksecurity.v1.FirewallActivation.UpdateFirewallEndpoint (LRO)
google.cloud.networksecurity.v1.FirewallActivation.UpdateFirewallEndpointAssociation (LRO)
google.cloud.networksecurity.v1.Intercept.CreateInterceptDeployment (LRO)
google.cloud.networksecurity.v1.Intercept.CreateInterceptDeploymentGroup (LRO)
google.cloud.networksecurity.v1.Intercept.CreateInterceptEndpointGroup (LRO)
google.cloud.networksecurity.v1.Intercept.CreateInterceptEndpointGroupAssociation (LRO)
google.cloud.networksecurity.v1.Intercept.DeleteInterceptDeployment (LRO)
google.cloud.networksecurity.v1.Intercept.DeleteInterceptDeploymentGroup (LRO)
google.cloud.networksecurity.v1.Intercept.DeleteInterceptEndpointGroup (LRO)
google.cloud.networksecurity.v1.Intercept.DeleteInterceptEndpointGroupAssociation (LRO)
google.cloud.networksecurity.v1.Intercept.UpdateInterceptDeployment (LRO)
google.cloud.networksecurity.v1.Intercept.UpdateInterceptDeploymentGroup (LRO)
google.cloud.networksecurity.v1.Intercept.UpdateInterceptEndpointGroup (LRO)
google.cloud.networksecurity.v1.Intercept.UpdateInterceptEndpointGroupAssociation (LRO)
google.cloud.networksecurity.v1.Mirroring.CreateMirroringDeployment (LRO)
google.cloud.networksecurity.v1.Mirroring.CreateMirroringDeploymentGroup (LRO)
google.cloud.networksecurity.v1.Mirroring.CreateMirroringEndpointGroup (LRO)
google.cloud.networksecurity.v1.Mirroring.CreateMirroringEndpointGroupAssociation (LRO)
google.cloud.networksecurity.v1.Mirroring.DeleteMirroringDeployment (LRO)
google.cloud.networksecurity.v1.Mirroring.DeleteMirroringDeploymentGroup (LRO)
google.cloud.networksecurity.v1.Mirroring.DeleteMirroringEndpointGroup (LRO)
google.cloud.networksecurity.v1.Mirroring.DeleteMirroringEndpointGroupAssociation (LRO)
google.cloud.networksecurity.v1.Mirroring.UpdateMirroringDeployment (LRO)
google.cloud.networksecurity.v1.Mirroring.UpdateMirroringDeploymentGroup (LRO)
google.cloud.networksecurity.v1.Mirroring.UpdateMirroringEndpointGroup (LRO)
google.cloud.networksecurity.v1.Mirroring.UpdateMirroringEndpointGroupAssociation (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateAuthorizationPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateAuthzPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateBackendAuthenticationConfig (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateClientTlsPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateGatewaySecurityPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateGatewaySecurityPolicyRule (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateServerTlsPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.CreateUrlList (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteAuthorizationPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteAuthzPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteBackendAuthenticationConfig (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteClientTlsPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteGatewaySecurityPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteGatewaySecurityPolicyRule (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteServerTlsPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.DeleteUrlList (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.UpdateAuthorizationPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.UpdateAuthzPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.UpdateBackendAuthenticationConfig (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.UpdateClientTlsPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.UpdateGatewaySecurityPolicy (LRO)
google.cloud.networksecurity.v1.NetworkSecurity.UpdateGatewaySecurityPolicyRule (LRO)