运行时访问控制事件详细信息

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询运行时访问控制事件的详细信息

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 运行时访问控制事件详细信息

运行时访问控制事件详细信息

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeAccessControlDetail
<公共请求参数>

{
    "EventId": "5202566"
}

输出示例

{
    "Response": {
        "AncestorProcessInfo": {
            "ProcessParam": "/usr/bin/containerd-shim-runc-v2 -namespace moby -address /run/containerd/containerd.sock",
            "ProcessPath": "/usr/bin/containerd-shim-runc-v2",
            "ProcessStartUser": "0",
            "ProcessUserGroup": "0"
        },
        "EventBaseInfo": {
            "ClientIP": "43.138.142.111",
            "ClusterID": "",
            "ClusterName": "",
            "ContainerId": "111411141114758f9ec06e76011da529da15bafdc83f2012d95ffa6382",
            "ContainerIsolateOperationSrc": "",
            "ContainerName": "/sweet_darwin",
            "ContainerNetStatus": "NORMAL",
            "ContainerNetSubStatus": "NONE",
            "EventCount": 1,
            "EventId": "5202566",
            "EventName": "访问控制-告警",
            "EventType": "ACCESS_CONTROL_ALERT",
            "FoundTime": "2024-10-11 11:03:00",
            "HostID": "11141114-6360-4fd4-bfc7-843162cb8116",
            "HostIP": "10.0.1.233",
            "ImageId": "sha256:11141114111403bb561b4c16bcb82328cfe5809ab675bb17ab3a16c517c9",
            "ImageName": "centos:7",
            "LatestFoundTime": "2024-10-11 11:03:00",
            "Namespace": "",
            "NodeID": "",
            "NodeName": "k8s-node1",
            "NodeSubNetCIDR": "",
            "NodeSubNetID": "",
            "NodeSubNetName": "",
            "NodeType": "NORMAL",
            "NodeUniqueID": "",
            "PodIP": "",
            "PodName": "--",
            "PodStatus": "",
            "Status": "EVENT_UNDEAL",
            "WorkloadType": ""
        },
        "EventDetail": {
            "Description": "检测到系统命令被篡改",
            "MatchRule": {
                "ProcessPath": "/home/yunjing_testing_x86/events_trigger_x86",
                "RuleId": "200000000000000000000002",
                "RuleMode": "RULE_MODE_ALERT",
                "TargetFilePath": "/home/yunjing_testing_x86/GCONV_PATH=./pwnkit.so:."
            },
            "OperationTime": "1970-01-01 00:00:01",
            "Remark": "",
            "RuleId": "222222222222222222222222",
            "RuleName": "系统策略",
            "Solution": "排查是否为正常业务需要的系统命令替换"
        },
        "ParentProcessInfo": {
            "ProcessParam": "",
            "ProcessPath": "",
            "ProcessStartUser": "",
            "ProcessUserGroup": ""
        },
        "ProcessInfo": {
            "ProcessAuthority": "-rwxr-xr-x",
            "ProcessId": 2252097,
            "ProcessMd5": "",
            "ProcessName": "",
            "ProcessParam": "./events_trigger_x86 tamper_sys",
            "ProcessPath": "/home/yunjing_testing_x86/events_trigger_x86",
            "ProcessStartUser": "",
            "ProcessTree": "events_trigger_x86(2252097)|bash(2247285)|containerd-shim-runc-v2(2247257)|systemd(1)",
            "ProcessUserGroup": "0"
        },
        "RequestId": "a8db49cf-2c9a-492c-96e0-a87dcf75be23",
        "TamperedFileInfo": {
            "FileCreateTime": "2024-10-11 11:02:58",
            "FileDiff": "",
            "FileName": "pwnkit.so:.",
            "FilePath": "/home/yunjing_testing_x86/GCONV_PATH=./pwnkit.so:.",
            "FileSize": 24,
            "FileType": "UNKNOWN",
            "LatestTamperedFileMTime": "2024-10-11 11:02:58",
            "NewFile": ""
        }
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。