Collect Corelight Sensor logs

This document describes how you can collect Corelight Sensor logs by configuring the Corelight Sensor and a Chronicle forwarder. This document also lists the supported log types and supported Corelight versions.

For more information, see Data ingestion to Chronicle.

Before you begin

Verify the version of Corelight Sensor. The Corelight Google SecOps parser was designed for version 27.13 and earlier. Later versions of the Corelight Sensor might have additional logs that the parser won't recognize, and those logs might receive limited or no field parsing. However, the log content will still be available in the raw log format in Google SecOps.
Ensure that all systems in the deployment architecture are configured with the UTC time zone.

Deployment and Log Ingestion Methods

The following deployment architecture diagram illustrates how a Corelight Sensor is set up to send logs to Google Security Operations using two different ingestion architectures. It's important to note that each customer deployment may vary from this representation and could be more complex.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the CORELIGHT ingestion label.

Ingesting Logs into Google SecOps using Corelight Exporters

Deployment architecture

The architecture diagram shows the following components:

Corelight Sensor: The system running the Corelight Sensor .
Corelight Sensor exporters: The Corelight Sensor exporter collects log data from the Sensor, and forwards it to Google Security Operations.
Google Security Operations: Google Security Operations retains and analyzes the logs from Corelight Sensor.

Configure the Google SecOps exporter in Corelight

Use the Sensor or Fleet Manager web interface to configure the Google SecOps exporter. This configuration uses the API credentials from your Google SecOps instance to establish the secure connection.

Log in to the Fleet Manager or Sensor web interface of Corelight Sensor as an administrator.
Navigate to the exporter configuration area:
- Fleet Manager: Navigate to Policies, select a policy, and click the Export tab.
- Standalone Sensor: Navigate to Configuration | Export | Export Configuration.
In the Create Exporter section, click Google SecOps.

Deployment architecture

Configure the following input parameters:

Name*: A unique name for this exporter instance (for example, SecOps).
Google SecOps Customer ID*: Your unique customer identifier provided by Google.
Google SecOps Namespace: The logical namespace for your Sensor logs in Google SecOps.
Credentials*: The Google SecOps Service Account Credentials (JSON). (Paste the full JSON content).
Google SecOps Labels: User-configured labels to identify the data domain.
Region*: The GCP region name used by Google SecOps.
Batch Max Events: The maximum batch size.
Batch Timeout Seconds: The maximum age of a batch.
Proxy URL: The network proxy URL, if required.
Exporter Log Filter: Select a filter to apply to this exporter instance.
Log Type Filter: Include or exclude specific log files by name.
- Exclude: Removes specified logs. New log types (for example, from packages) will still be exported.
- Include: Exports only the specified logs. New log types will NOT be exported unless manually added.

Deployment architecture

Click Done.

Deployment architecture

Click Apply Changes.

Ingesting Logs into Google SecOps Using a Forwarder

Deployment architecture

The architecture diagram shows the following components:

Corelight Sensor: The system running the Corelight Sensor .
Corelight Sensor exporter: The Corelight Sensor exporter collects log data from the Sensor, and forwards it to the Google Security Operations forwarder.
Google Security Operations forwarder: The Google Security Operations forwarder is a lightweight software component, deployed in the customer's network, that supports syslog. The Google Security Operations forwarder forwards the logs to Google Security Operations.
Google Security Operations: Google Security Operations retains and analyzes the logs from Corelight Sensor.

Configure the Google Security Operations forwarder

To configure the Google Security Operations forwarder, do the following:

Set up a Google Security Operations forwarder. See Install and configure the forwarder on Linux.
Configure the Google Security Operations forwarder to send logs to Google Security Operations.

  collectors:
    - syslog:
        common:
          enabled: true
          data_type:  CORELIGHT
          data_hint:
          batch_n_seconds: 10
          batch_n_bytes: 1048576
        tcp_address: <Chronicle forwarder listening IP:Port>
        tcp_buffer_size: 524288
        udp_address: <Chronicle forwarder listening IP:Port>
        connection_timeout_sec: 60

Configure the Corelight Sensor exporter

Log into Corelight Sensor as an administrator.
Select the Export tab.
Find and enable EXPORT TO SYSLOG option.
Under EXPORT TO SYSLOG, configure the following fields:

SYSLOG SERVER: Specify the IP address and port of the Google Security Operations forwarder syslog listener.
Navigate to Advanced Settings > SYSLOG FORMAT, and change the setting to Legacy.

Corelight Sensor Configuration

Click Apply Changes.

Supported Corelight log types

The Corelight parser supports the following log types:

Log Type

asset_classification
conn
conn_long
conn_red
conn_agg
dce_rpc
dns
dns_red
files
files_red
http
http2
http_red
intel
irc
notice
rdp
sip
smb_files
smb_mapping
smtp
smtp_links
ssh
ssl
ssl_red
suricata_corelight
bacnet
cip
corelight_burst
corelight_metrics_bro
corelight_metrics_disk
corelight_metrics_iface
corelight_metrics_memory
corelight_metrics_system
corelight_metrics_zeek_doctor
corelight_overall_capture_loss
corelight_profiling
datared
dga
dhcp
dnp3
dpd
encrypted_dns
enip
enip_debug
enip_list_identity
etc_viz
ftp
generic_dns_tunnels
generic_icmp_tunnels
icmp_specific_tunnels
ipsec
iso_cotp
kerberos
known_certs
known_devices
known_domains
known_hosts
known_names
known_remotes
known_services
known_users
ldap
ldap_search
local_subnets
local_subnets_dj
local_subnets_graphs
log4shell
modbus
mqtt_connect
mqtt_publish
mqtt_subscribe
mysql
napatech_shunting
ntlm

Field mapping reference

This section explains how the Google Security Operations parser maps Google Security Operations fields to Google Security Operations Unified Data Model (UDM) fields.

Field mapping reference: CORELIGHT - Common Fields

The following table lists common fields of the CORELIGHT log and their corresponding UDM fields.

Field mapping reference: CORELIGHT - asset_classification

The following table lists the log fields of the asset_classification log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - conn, conn_red, conn_long, conn_agg

The following table lists the log fields of the conn, conn_red, conn_long, conn_agg log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - dce_rpc

The following table lists the log fields of the dce_rpc log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - dns, dns_red, dns_agg

The following table lists the log fields of the dns, dns_red, dns_agg log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - http, http_red, http2, http_agg

The following table lists the log fields of the http, http_red, http2, http_agg log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - smtp_links

The following table lists the log fields of the smtp_links log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - irc

The following table lists the log fields of the irc log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - files, files_red, files_agg

The following table lists the log fields of the files, files_red, files_agg log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - notice

The following table lists the log fields of the notice log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - smb_files

The following table lists the log fields of the smb_files log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - smb_mapping

The following table lists the log fields of the smb_mapping log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - ssl, ssl_red, ssl_agg

The following table lists the log fields of the ssl, ssl_red, ssl_agg log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - rdp

The following table lists the log fields of the rdp log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - sip

The following table lists the log fields of the sip log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - intel

The following table lists the log fields of the intel log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - smtp

The following table lists the log fields of the smtp log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - ssh

The following table lists the log fields of the ssh log type and their corresponding UDM fields.

Field mapping reference: CORELIGHT - suricata_corelight

The following table lists the log fields of the suricata_corelight log type and their corresponding UDM fields.

	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Corelight`.
`_path (string)`	`metadata.product_event_type`
`_system_name (string)`	`observer.hostname`
`ts (time)`	`metadata.event_timestamp`
`uid (string)`	`about.labels [uid], network.session_id`
`id.orig_h (string - addr)`	`principal.ip`
`id.orig_p (integer - port)`	`principal.port`
`id.resp_h (string - addr)`	`target.ip`
`id.resp_p (integer - port)`	`target.port`
`_write_ts`	`metadata.collected_timestamp`
`id.vlan (integer - int)`	`additional.fields [id_vlan]`
`id.vlan_inner (integer - int)`	`additional.fields [id_vlan_inner]`
`id.orig_ep_cid (string)`	`additional.fields [id_orig_ep_cid]`
`id.orig_ep_source (string)`	`additional.fields [id_orig_ep_source]`
`id.orig_ep_status (string)`	`additional.fields [id_orig_ep_status]`
`id.orig_ep_uid (string)`	`additional.fields [id_orig_ep_uid]`
`id.resp_ep_cid (string)`	`additional.fields [id_resp_ep_cid]`
`id.resp_ep_source (string)`	`additional.fields [id_resp_ep_source]`
`id.resp_ep_status (string)`	`additional.fields [id_resp_ep_status]`
`id.resp_ep_uid (string)`	`additional.fields [id_resp_ep_uid]`
`uids (array[string] - vector of string)`	`additional.fields [uid]`
`count (integer - int)`	`additional.fields [count]`
`ts_last`	`additional.fields [ts_last]`

	`metadata.event_type`	The `metadata.event_type` UDM field is set to `STATUS_UPDATE`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Zeek`.
`ip (string - addr)`	`principal.ip`
`mac`	`principal.mac`
`vendor_mac (string)`	`about.asset.hardware.manufacturer`
`device_type (string)`	`about.asset.category`
`os_name (string)`	`about.platform`
`os_name (string)`	`about.asset.attribute.labels`
`type_group (string)`	`about.group.group_display_name`
`type_name (string)`	`about.resource.resource_subtype`	The `about.resource.resource_type` UDM field is set to `DEVICE`
`brand (string)`	`about.user.company_name`
`model (string)`	`about.asset.hardware.model`
`confidence (integer)`	`about.security_result.confidence_score`
`os_ver (string)`	`about.platform_version`
`sources (array[string])`	`about.ip_geo_artifact.tags`

	`metadata.event_type`	The `metadata.event_type` UDM field is set to `NETWORK_CONNECTION`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Zeek`.
`proto (string - enum)`	`network.ip_protocol`
`service (string)`	`network.application_protocol`
`duration (number - interval)`	`network.session_duration`
`orig_bytes (integer - count)`	`network.sent_bytes`
`resp_bytes (integer - count)`	`network.received_bytes`
`conn_state (string)`	`metadata.description`	If the `conn_state` log field value is equal to `S0`, then the `metadata.description` UDM field is set to `S0: Connection attempt seen, no reply`. Else, if the `conn_state` log field value is equal to `S1`, then the `metadata.description` UDM field is set to `S1: Connection established, not terminated`. Else, if the `conn_state` log field value is equal to `S2`, then the `metadata.description` UDM field is set to `S2: Connection established and close attempt by originator seen (but no reply from responder)`. Else, if the `conn_state` log field value is equal to `S3`, then the `metadata.description` UDM field is set to `S3: Connection established and close attempt by responder seen (but no reply from originator)`. Else, if the `conn_state` log field value is equal to `SF`, then the `metadata.description` UDM field is set to `SF: Normal SYN/FIN completion`. Else, if the `conn_state` log field value is equal to `REJ`, then the `metadata.description` UDM field is set to `REJ: Connection attempt rejected`. Else, if the `conn_state` log field value is equal to `RSTO`, then the `metadata.description` UDM field is set to `RSTO: Connection established, originator aborted (sent a RST)`. Else, if the `conn_state` log field value is equal to `RSTOS0`, then the `metadata.description` UDM field is set to `RSTOS0: Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder`. Else, if the `conn_state` log field value is equal to `RSTOSH`, then the `metadata.description` UDM field is set to `RSTOSH: Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator`. Else, if the `conn_state` log field value is equal to `RSTR`, then the `metadata.description` UDM field is set to `RSTR: Established, responder aborted`. Else, if the `conn_state` log field value is equal to `SH`, then the `metadata.description` UDM field is set to `SH: Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was "half" open)`. Else, if the `conn_state` log field value is equal to `SHR`, then the `metadata.description` UDM field is set to `SHR: Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator`. Else, if the `conn_state` log field value is equal to `OTH`, then the `metadata.description` UDM field is set to `OTH: No SYN seen, just midstream traffic (a partial connection that was not later closed)`.
`local_orig (boolean - bool)`	`about.labels [local_orig]`
`local_resp (boolean - bool)`	`about.labels [local_resp]`
`missed_bytes (integer - count)`	`about.labels [missed_bytes]`
`history (string)`	`about.labels [history]`
`orig_pkts (integer - count)`	`network.sent_packets`
`orig_ip_bytes (integer - count)`	`principal.labels [orig_ip_bytes]`
`resp_pkts (integer - count)`	`network.received_packets`
`resp_ip_bytes (integer - count)`	`target.labels [resp_ip_bytes]`
`tunnel_parents (array[string] - set[string])`	`intermediary.labels [tunnel_parent]`
`orig_cc (string)`	`principal.ip_geo_artifact.location.country_or_region`
`resp_cc (string)`	`target.ip_geo_artifact.location.country_or_region`
`suri_ids (array[string] - set[string])`	`security_result.rule_id`
`spcap.url (string)`	`security_result.url_back_to_product`
`spcap.rule (integer - count)`	`security_result.rule_labels [spcap_rule]`
`spcap.trigger (string)`	`security_result.detection_fields [spcap_trigger]`
`app (array[string] - vector of string)`	`about.application`
`corelight_shunted (boolean - bool)`	`about.labels [corelight_shunted]`
`orig_shunted_pkts (integer - count)`	`principal.labels [orig_shunted_pkts]`
`orig_shunted_bytes (integer - count)`	`principal.labels [orig_shunted_bytes]`
`resp_shunted_pkts (integer - count)`	`target.labels [resp_shunted_pkts]`
`resp_shunted_bytes (integer - count)`	`target.labels [resp_shunted_bytes]`
`orig_l2_addr (string)`	`principal.mac`
`resp_l2_addr (string)`	`target.mac`
`id_orig_h_n.src (string)`	`principal.labels [id_orig_h_n_src]`
`id_orig_h_n.vals (array[string] - set[string])`	`principal.labels [id_orig_h_n_val]`
`id_resp_h_n.src (string)`	`target.labels [id_resp_h_n_src]`
`id_resp_h_n.vals (array[string] - set[string])`	`target.labels [id_resp_h_n_val]`
`vlan (integer - int)`	`intermediary.labels [vlan]`
`inner_vlan (integer - int)`	`intermediary.labels [inner_vlan]`
`community_id (string)`	`network.community_id`
	`security_result.severity`	The `security_result.severity` UDM field is set to `INFORMATIONAL`.
`service (string)`	`about.labels [service]`
`orig_ep_cid (string)`	`additional.fields [orig_ep_cid]`
`orig_ep_source (string)`	`additional.fields [orig_ep_source]`
`orig_ep_status (string)`	`additional.fields [orig_ep_status]`
`orig_ep_uid (string)`	`additional.fields [orig_ep_uid]`
`resp_ep_cid (string)`	`additional.fields [resp_ep_cid]`
`resp_ep_source (string)`	`additional.fields [resp_ep_source]`
`resp_ep_status (string)`	`additional.fields [resp_ep_status]`
`resp_ep_uid (string)`	`additional.fields [resp_ep_uid]`
`id_orig_h_n`	`principal.ip`
`id_resp_h_n`	`target.ip`
`netskope_site_ids`	`additional.fields[netskope_site_ids]`	Iterate through log field `netskope_site_ids`, then `netskope_site_id_%{index}` log field is mapped to the `additional.fields.key` UDM field and `netskope_site_id` log field is mapped to the `additional.fields.value` UDM field.
`netskope_user_ids`	`additional.fields[netskope_user_ids]`	Iterate through log field `netskope_user_ids`, then `netskope_user_id_%{index}` log field is mapped to the `additional.fields.key` UDM field and `netskope_user_id` log field is mapped to the `additional.fields.value` UDM field.
`write_ts`	`additional.fields[write_ts]`
`spcap.urls (array[string] - vector of string)`	`security_result.url_back_to_product`	Iterate through log field `spcap.urls`, then `spcap.urls` log field is mapped to the `security_result.url_back_to_product` UDM field.
`community_ids (array[string] - vector of string)`	`network.community_id`	Iterate through log field `community_ids`, then if index is equal to `0` then, `community_id` log field is mapped to the `network.community_id` UDM field. Else, `community_id_%{index}` log field is mapped to the `additional.fields.key` UDM field and `community_id` log field is mapped to the `additional.fields.value` UDM field.
`capture_metadata.vpc.version`	`about.resource.attribute.labels[vpc_version]`
`capture_metadata.vpc.vpc_id`	`about.resource.product_object_id`
	`about.resource.resource_type`	If `capture_metadata.vpc.vpc_id` is present, then `about.resource.resource_type` UDM field is set to `VPC_NETWORK`.
`capture_source`	`about.resource.attribute.labels[capture_source]`
`orig_inst.az`	`principal.location.name`
`orig_inst.id`	`principal.resource.product_object_id`
`orig_inst.name`	`principal.resource.name`
`orig_inst.org_id`	`principal.resource.attribute.labels[org_id]`
`orig_inst.sg_ids`	`principal.resource.attribute.labels[sg_id]`
`orig_inst.subnet_id`	`principal.resource.attribute.labels[subnet_id]`
`orig_inst.vpc_id`	`principal.resource.attribute.labels[vpc_id]`
	`principal.resource.resource_type`	If `orig_inst.vpc_id` is present, then `principal.resource.resource_type` UDM field is set to `VPC_NETWORK`.
`orig_inst.profile`	`principal.resource.attribute.labels[profile]`
`resp_inst.az`	`target.location.name`
`resp_inst.id`	`target.resource.product_object_id`
`resp_inst.name`	`target.resource.name`
`resp_inst.org_id`	`target.resource.attribute.labels[org_id]`
`resp_inst.sg_ids`	`target.resource.attribute.labels[sg_id]`
`resp_inst.subnet_id`	`target.resource.attribute.labels[subnet_id]`
`resp_inst.vpc_id`	`target.resource.attribute.labels[vpc_id]`
	`target.resource.resource_type`	If `resp_inst.vpc_id` is present, then `target.resource.resource_type` UDM field is set to `VPC_NETWORK`.
`resp_inst.profile`	`target.resource.attribute.labels[profile]`
`local_orig` and `local_resp`	`additional.fields[direction]`	If the `local_orig` log field value is equal to `true` and `local_resp` log field value is equal to `true`, then the `additional.fields[direction]` UDM field is set to `internal`. Else, if the `local_orig` log field value is equal to `true` and `local_resp` log field value is equal to `false`, then the `additional.fields[direction]` UDM field is set to `outbound`. Else, if the `local_orig` log field value is equal to `false` and `local_resp` log field value is equal to `false`, then the `additional.fields[direction]` UDM field is set to `external`. Else, if the `local_orig` log field value is equal to `false` and `local_resp` log field value is equal to `true`, then the `additional.fields[direction]` UDM field is set to `inbound`.

	`metadata.event_type`	The `metadata.event_type` UDM field is set to `NETWORK_CONNECTION`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Zeek`.
`rtt (number - interval)`	`network.session_duration`
`named_pipe (string)`	`intermediary.resource.name`
	`intermediary.resource.resource_type`	If the `named_pipe` log field value is not empty, then the `intermediary.resource.resource_type` UDM field is set to `PIPE`.
`endpoint (string)`	`target.labels [endpoint]`
`operation (string)`	`target.labels [operation]`
	`network.application_protocol`	The `network.application_protocol` UDM field is set to `DCERPC`.
	`security_result.severity`	The `security_result.severity` UDM field is set to `INFORMATIONAL`.
`operation, endpoint, named_pipe (string)`	`metadata.description`	The `metadata.description` UDM field is set with `operation`, `endpoint`, `named_pipe` log fields as "operation `operation` on `endpoint` using named pipe `named_pipe`".
	`network.ip_protocol`	The `network.ip_protocol` UDM field is set to `TCP`.

	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Zeek`.
	`metadata.event_type`	The `metadata.event_type` UDM field is set to `NETWORK_DNS`.
	`network.application_protocol`	The `network.application_protocol` UDM field is set to `DNS`.
`proto (string - enum)`	`network.ip_protocol`
`trans_id (integer - count)`	`network.dns.id`
`rtt (number - interval)`	`network.session_duration`
`query (string)`	`network.dns.questions.name`
`qclass (integer - count)`	`network.dns.questions.class`
`qclass_name (string)`	`about.labels [qclass_name]`
`qtype (integer - count)`	`network.dns.questions.type`
`qtype_name (string)`	`about.labels [qtype_name]`
`rcode (integer - count)`	`network.dns.response_code`
`rcode (integer - count)`	`network.dns.response`	If the `rcode` log field value is not empty, then the `network.dns.response` UDM field is set to `true`.
`rcode_name (string)`	`about.labels [rcode_name]`
`AA (boolean - bool)`	`network.dns.authoritative`
`TC (boolean - bool)`	`network.dns.truncated`
`RD (boolean - bool)`	`network.dns.recursion_desired`
`RA (boolean - bool)`	`network.dns.recursion_available`
`Z (integer - count)`	`about.labels [Z]`
`answers (array[string] - vector of string)`	`network.dns.answers.name`
`TTLs (array[number] - vector of interval)`	`network.dns.answers.ttl`
`rejected (boolean - bool)`	`about.labels [rejected]`
`is_trusted_domain (string)`	`about.labels [is_trusted_domain]`
`icann_host_subdomain (string)`	`about.labels [icann_host_subdomain]`
`icann_domain (string)`	`network.dns_domain`
`icann_tld (string)`	`about.labels [icann_tld]`
`num (integer - count)`	`security_result.detection_fields [num]`

CorelightForSecOps

Most Popular

	`metadata.event_type`	If the `action` log field value is equal to `SMB::FILE_READ`, then the `metadata.event_type` UDM field is set to `FILE_READ`. Else, if the `action` log field value is equal to `SMB::FILE_WRITE`, then the `metadata.event_type` UDM field is set to `FILE_MODIFICATION`. Else, if the `action` log field value is equal to `SMB::FILE_OPEN`, then the `metadata.event_type` UDM field is set to `FILE_OPEN`. Else, if the `action` log field value is equal to `SMB::FILE_CLOSE`, then the `metadata.event_type` UDM field is set to `FILE_UNCATEGORIZED`. Else, if the `action` log field value is equal to `SMB::FILE_DELETE`, then the `metadata.event_type` UDM field is set to `FILE_DELETION`. Else, if the `action` log field value is equal to `SMB::FILE_RENAME`, then the `metadata.event_type` UDM field is set to `FILE_MOVE`. Else, if the `action` log field value is equal to `SMB::FILE_SET_ATTRIBUTE`, then the `metadata.event_type` UDM field is set to `FILE_UNCATEGORIZED`. Else, the `metadata.event_type` UDM field is set to `FILE_UNCATEGORIZED`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Zeek`.
	`network.application_protocol`	The `network.application_protocol` UDM field is set to `SMB`.
	`network.ip_protocol`	The `network.ip_protocol` UDM field is set to `TCP`.
`action, name`	`metadata.description`	The `metadata.description` UDM field is set with `action`, `name` log fields as "action: `action` on: `name`".
	`security_result.severity`	The `security_result.severity` UDM field is set to `INFORMATIONAL`.
	`security_result.action`	The `security_result.action` UDM field is set to `ALLOW`.
`fuid (string)`	`about.labels [fuid]`
`action (string - enum)`	`target.labels [action]`
`path (string)`	`target.file.full_path`
`name (string)`	`target.file.names`
`size (integer - count)`	`target.file.size`
`prev_name (string)`	`src.file.names`
`times.modified (time)`	`target.file.last_modification_time`
`times.accessed (time)`	`target.file.last_seen_time`
`times.created (time)`	`target.file.first_seen_time`
`times.changed (time)`	`target.labels [times_changed]`
`data_offset_req (integer - count)`	`target.labels [data_offset_req]`
`data_len_req (integer - count)`	`target.labels [data_len_req]`
`data_len_rsp (integer - count)`	`target.labels [data_len_rsp]`