JSON 格式告警数据解析

{
    "uin": "1000xxxxxx21",
    "nickname": "测试号",
    "server": "172.x.x.41 [测试机器]",
    "instance_id": "ins-xxxxxxxx",
    "region": "西南地区（成都）",
    "time": "2023-10-30 09:24:20"
}

{
    "event_type": "异常登录",
    "src_ip": "43.x.x.41",
    "area": "中国香港",
    "level": "高危"
}

{
    "event_type": "密码破解",
    "src_ip": "43.x.x.41",
    "area": "中国香港",
    "count": "3",
    "banned": "阻断成功"
}

{
    "event_type": "恶意文件",
    "file_type": "恶意",
    "path": "/root/bebinder_shell.jsp",
    "level": "严重，您的服务器疑似被黑客入侵，建议您及时确认，避免造成严重损失"
}

{
    "event_type": "异常进程",
    "pid": "5916",
    "path": "/root/2/ISHELL-v0.2/ishd"
}

{
    "event_type": "恶意请求",
    "url": "massdns.ran6066.com",
    "count": "1"
}

{
    "event_type": "高危命令",
    "cmd": "iptables-restore -w 5 --noflush",
    "level": "高危",
    "status": "待处理"
}

{
    "event_type": "本地提权",
    "user": "0",
    "process": "privilege"
}

{
    "event_type": "反弹Shell",
    "process": "mass_0",
    "dst_ip": "125.x.x.220",
    "dst_port": "8888"
}

{
    "event_type": "java内存马",
    "type": "Java内存马-Servlet",
    "pid": "3333",
    "argv": "masstest",
    "class_name": "massTest"
}

{
    "event_type": "核心文件",
    "rule_name": "adwqdadwqd",
    "exe_path": "/usr/bin/systemd-tmpfiles",
    "file_path": "/home",
    "count": "1",
    "level": "高危"
}

{
    "event_type": "网络攻击",
    "src_ip": "129.x.x.166",
    "city": "江苏省-南京市",
    "vul_name": "showdoc 文件上传漏洞",
    "dst_port": "80",
    "status": "尝试攻击"
}

{
    "event_type": "客户端离线",
    "offline_hour": "1"
}

{
    "event_type": "客户端卸载"
}

{
    "event_type": "漏洞",
    "category": "Linux软件漏洞",
    "vul_name": "libexpat 代码执行漏洞（CVE-2022-40674）",
    "level": "严重"
}

{
    "event_type": "基线",
    "category": "Linux系统弱口令检测",
    "rule_name": "Linux系统弱口令检测",
    "level": "高危"
}

{
    "event_type": "勒索防御",
    "file_path": "/usr/bin/vi"
}


{
    "event_type": "网页防篡改（篡改成功）",
    "protect_name": "重要文件",
    "protect_path": "/tmp",
    "recover_type": "新增文件",
    "recovered_status": "未恢复",
}

{
    "event_type": "网页防篡改（恢复失败）",
    "protect_name": "重要文件",
    "protect_path": "/tmp",
    "exception": "客户端离线"
}