日志分析页面提供精准、实时的日志审计和高效的分析能力，结合强大的SQL语法分析工具，可灵活定制报表和设置报警，实现深入的数据分析与监控。
本文介绍如何使用日志分析。

前提条件

您的主机资产已经接入云安全中心，关于接入的具体操作，请参见安装客户端。
您已开通日志服务TLS。

操作步骤

1. 登录云安全中心控制台。
2. 在页面左侧选择安全运营＞日志分析。

页面说明

日志分析

日志分析板块可对安全告警日志和漏洞日志进行记录。

告警日志字段

下面是告警的公共字段：

下面展示了告警相关的关键字段，根据告警的不同类型，这些字段不一定都存在：

主机告警字段（Linux）

主机告警字段（alert_type=="杀伤链"）

主机告警字段（Windows）

// 示例JSON数据
{
  "ex_ipv4_list": "-",
  "alert": true,
  "rawlog": "Failed password for invalid user admin from 180.184.85.207 port 37478 ssh2",
  "in_ipv4_list": "10.17.0.128",
  "SMITH_KEY": "3298534885129",
  "data_type": "4000",
  "rule_name_us": "Single source bruteforce",
  "SMITH_INPUT": "hids",
  "reason_ip": "180.184.85.207",
  "attack_id": "T1110",
  "suggestion": "【处置建议】\n1. 请先确认是否为业务多次失败登录触发\n2. 如果非业务行为，建议通过修改【/etc/ssh/sshd_config】配置文件并重启sshd服务来关闭密码登录\n3. 并如果【连接信息】内目的IP并非业务主要IP，建议封禁对恶意IP的访问请求\n\n【关注字段】\n攻击源IP，登陆用户名",
  "psm_name": "-",
  "type": "HIDS_WARN",
  "rule_version": "2.1.0.1",
  "sip": "180.184.85.207",
  "SMITH_ALERT_DATA": {
    "HIT_DATA": [
      "critical_brute_single_login_black sip:[NI]:-",
      "critical_brute_single_login_black status:[INCL]:false",
      "critical_brute_single_login_black rawlog:[NI]:receive identification",
      "critical_brute_single_login_black sip:[CUSTOM]::[NotLocalIP]:180.184.85.207",
      "critical_brute_single_login_black Frequency:19"
    ],
    "RULE_INFO": {
      "DesignateNode": null,
      "Action": null,
      "Threshold": "",
      "HarmLevel": "medium",
      "FreqCountType": "",
      "Desc": "【敏感行为】主机存在被单一外部来源IP发起的爆破，2分钟内登录失败19次",
      "AffectedTarget": "service",
      "FreqCountField": "",
      "RuleType": "Detection",
      "FreqHitReset": false,
      "Author": "lez",
      "RuleID": "critical_brute_single_login_alert",
      "KillChainID": "init_attack",
      "RuleName": "单一来源暴力破解",
      "FreqRange": 0
    }
  },
  "timestamp": "2023-09-17T06:13:40Z",
  "sport": "37478",
  "os_type": "linux",
  "in_ipv6_list": "-",
  "pid": "812179",
  "psm_path": "-",
  "highlight_fields": "sip,status,rawlog",
  "alert_detail": "VolcTest 机器上存在 [单一来源暴力破解] 的中危告警; admin 通过 password 尝试登陆失败，源IP为 180.184.85.207, 关联访问 180.184.85.207",
  "time": "1694931213",
  "time_pkg": "1694931213",
  "types": "password",
  "ex_ipv6_list": "-",
  "status": "false",
  "hostname": "VolcTest",
  "alert_type": "暴力破解",
  "version": "1.8.2.1",
  "enhanced": "false",
  "user": "admin",
  "alert_type_us": "bruteforce",
  "risk": 2,
  "exposure": "true",
  "tags": "-",
  "data_type_str": "SSH登陆",
  "connect_info": "No Data <- 180.184.85.207:37478",
  "alert_detail_us": "There is a medium level alert for [Single source bruteforce] on the VolcTest machine. admin successfully logged in to the machine through password, the source IP is 180.184.85.207, correlated network access 180.184.85.207",
  "alert_desc": "【敏感行为】主机存在被单一外部来源IP发起的爆破，2分钟内登录失败19次",
  "harm_level": "medium",
  "ip": "10.17.0.128",
  "extra": "-",
  "agent_id": "42bdf78e-d1f7-58a9-adaf-24859999ccf7",
  "alert_desc_us": "[Sensitive behavior] The host has been attacked by a single-source IP, and the login failed 19 times within 1 minute",
  "product": "elkeid-agent",
  "invalid": "false",
  "SMITH_TIMESTAM": 1694931221261438000,
  "rule_name": "单一来源暴力破解",
  "docker": "-"
}
{
    "dip":"-",
    "sid":"825998",
    "SMITH_INPUT":"hids",
    "pgid_argv":"nc -e /bin/bash",
    "container_net_mode":"bridge",
    "reason_comm":"nc<bash<containerd-shim<systemd",
    "alert_desc_us":"[Sensitive behavior] There are reverse shells based on common shell commands",
    "highlight_fields":"argv,exe",
    "tracing_id":"825998",
    "run_path":"/",
    "enhanced":"false",
    "timestamp":"2023-09-17T07:15:45Z",
    "username":"root",
    "sa_family":"-",
    "ip":"10.17.0.128",
    "ssh":"-5",
    "pod_name":"-",
    "container_host_name":"aced05645b32",
    "container_id":"aced05645b323b2f3f85dc851456207a622f0ab7d54cfa6c74777acd6ebbe6d9",
    "rule_name":"反弹shell",
    "pod_id":"-",
    "exe":"/bin/nc.openbsd",
    "exe_hash":"cf9479de201f247a",
    "alert_detail_us":"There is a critical level alert for [Reverse shell] on the VolcTest machine. Parent Process 825998 created new process /bin/nc.openbsd (pid is 825998, command line is nc -e /bin/bash) with user root, correlated processID 825998",
    "pid_tree":"826013.nc<825998.bash<825860.containerd-shim<1.systemd",
    "root_pns":"16903108491974017025",
    "tty":"pts1",
    "product":"elkeid-agent",
    "pns":"16903107783304413926",
    "uid":"0",
    "alert":true,
    "in_ipv4_list":"10.17.0.128",
    "time":"1694934942",
    "tgid":"826013",
    "psm":"-",
    "sip":"-",
    "ppid_argv":"/bin/bash",
    "tags":"-",
    "time_pkg":"1694934942",
    "stdin":"/dev/pts/1",
    "container_create_time":"1694934895",
    "psm_path":"-",
    "pgid":"826013",
    "suggestion":"【处置建议】\n1. 请先确认是否存在已知渗透测试行为\n2. 如果非业务行为请通过root登陆，使用【ps aux | grep $PID】命令（此处$PID为告警内的的进程ID）查看进程是否存活\n3. 清理【rm】启动进程的文件，并关闭反弹shell进程【kill -9 $PID】\n4. 如果【连接信息】内目的IP并非业务主要IP，建议封禁对恶意IP的访问请求\n5.请结合从属事件内的关联告警与当前告警的溯源数据作为上下文来判断入侵入口来源与受影响范围\n\n【关注字段】\n进程命令行，进程组命令行，外链进程命令行，连接信息",
    "dport":"-",
    "rule_version":"2.1.0.1",
    "container_runtime":"docker",
    "res":"0",
    "stdout":"/dev/pts/1",
    "data_type":"59",
    "is_honeypot":"-",
    "ppid":"825998",
    "container_query_result":"success",
    "risk":4,
    "container_name":"ypb_test",
    "reason_sid":"825998|1694934942",
    "ld_preload":"-5",
    "alert_type":"代码执行",
    "data_type_str":"进程启动",
    "alert_detail":"VolcTest 机器上存在 [反弹shell] 的严重告警; 父进程 825998 使用 root 用户创建了新进程 /bin/nc.openbsd (pid为 825998, 命令行为 nc -e /bin/bash ), 关联进程 825998",
    "ld_library_path":"-5",
    "alert_type_us":"execution",
    "ex_ipv4_list":"-",
    "hostname":"VolcTest",
    "psm_name":"-",
    "comm":"nc",
    "type":"HIDS_WARN",
    "argv":"nc -e /bin/bash",
    "rule_name_us":"Reverse shell",
    "docker":"true",
    "pid":"825998",
    "image_id":"23173282a8d401e153f2991d8edeef1b2fe5d9a11142e002c018dd2318c13d6f",
    "sport":"-",
    "nodename":"aced05645b32",
    "in_ipv6_list":"-",
    "SMITH_KEY":"4398046595252",
    "os_type":"linux",
    "socket_argv":"-",
    "container_ip":"172.17.0.3",
    "SMITH_ALERT_DATA":{
        "RULE_INFO":{
            "DesignateNode":null,
            "Author":"lez",
            "AffectedTarget":"host_process",
            "FreqCountType":"",
            "HarmLevel":"critical",
            "FreqRange":0,
            "Threshold":"",
            "Desc":"【敏感行为】存在利用常见shell命令的反弹shell",
            "RuleID":"critical_sensitive_command_alert",
            "RuleName":"反弹shell",
            "RuleType":"Detection",
            "Action":null,
            "FreqCountField":"",
            "FreqHitReset":false,
            "KillChainID":"execution"
        },
        "HIT_DATA":[
            "critical_sensitive_command_black2 argv:[INCL]:nc",
            "critical_sensitive_command_black2 argv:[REGEX]:nc -e",
            "critical_sensitive_command_black2 exe:[REGEX]:nc"
        ]
    },
    "agent_id":"42bdf78e-d1f7-58a9-adaf-24859999ccf7",
    "alert_desc":"【敏感行为】存在利用常见shell命令的反弹shell",
    "version":"1.8.2.1",
    "attack_id":"T1059",
    "SMITH_TIMESTAM":1694934945997967991,
    "image_name":"tafthorne/netcat-debian",
    "container_pns":"4026532582",
    "container_state":"running",
    "ex_ipv6_list":"-",
    "harm_level":"critical",
    "socket_pid":"-",
    "connect_info":"-"
}

漏洞日志字段

{
    "Checked": "false",
    "__package_offset__": "2097152",
    "__source__": "vuln",
    "__tag____client_ip__": "192.168.1.67",
    "__tag____receive_time__": "1710290787041",
    "__time__": "1710290784000",
    "account_id": "2100001101",
    "action": "invisible",
    "agent_id": "i-ycsf1m0tmor9cxxachs3",
    "control_time": "1709037809",
    "create_time": "1709037809",
    "cve_id": "CVE-2022-42011",
    "drop_status": "using",
    "flag_id": "8c6ab9ce-71cf-47c5-a150-404283ab30c0",
    "instance_name": "shared-4c16g-c-f97lfz",
    "internet_ip": "",
    "intranet_ip": "66.3.0.36",
    "level": "mid",
    "op": "add",
    "operate_reason": "",
    "region": "cn-guilin-boe",
    "status": "unprocessed",
    "tag": "["数组索引验证不当","存在EXP"]",
    "update_time": "1710290770",
    "vuln_id": "202768",
    "vuln_name": "D-bus_project d-bus 数组索引验证不当漏洞",
    "vuln_type": "linux"
}