JSON 格式的事件

有效的事件屬性

注意 有些事件不具備通常適用於其事件類型的所有屬性。

事件屬性的資料防護類型

資料防護類型	說明
陣列 (位元組)	JSON array , 由位元組值組成。
布林值	JSON true 或 false .
整數	JSON int . Server & Workload Security保護 不會在事件中輸出浮點數。 注意 事件中的整數可能超過 32 位元。請確認處理事件的程式碼能夠處理這種情況。例如，JavaScript 的 Number 資料型別無法安全地處理超過 32 位元的整數。
整數（枚舉）	JSON int，限制為一組列舉值。
字串	JSON string .
字串 (日期)	JSON string , 格式化為 YYYY-MM-DDThh:mm:ss.sssZ（ISO 8601）模式的日期和時間。'Z' 是時區。'sss' 是毫秒的三位數字。另請參閱 W3C 關於日期和時間格式的說明。
字串 (IP)	JSON string , 格式化為 IPv4 或 IPv6 位址。
字串 (MAC)	JSON string , 格式化為網路 MAC 位址。
字串 (URL)	JSON string , 格式化為 URL。
字串 (列舉)	JSON string , 限制為一組列舉值。

JSON 格式的範例事件

系統事件

{
  "Type" :            "Notification",
  "MessageId" :       "123abc-123-123-123-123abc",
  "TopicArn" :        "arn:aws:sns:us-west-2:123456789:DS_Events",
  "Message" :         "[
                        {
                          "ActionBy":"System",
                          "CloudOneAccountID": "012345678900"
                          "Description":"Alert: New Pattern Update is Downloaded and Available\\nSeverity: Warning\",
                          "EventID":6813,
                          "EventType":"SystemEvent",
                          "LogDate":"2018-12-04T15:54:24.086Z",
                          "ManagerNodeID":123,
                          "ManagerNodeName":"job7-123",
                          "Number":192,
                          "Origin":3,
                          "OriginString":"Manager",
                          "Severity":1,
                          "SeverityString":"Info",
                          "Tags":"\",
                          "TargetID":1,
                          "TargetName":"ec2-12-123-123-123.us-west-2.compute.amazonaws.com",
                          "TargetType":"Host",
                          "TenantID":123,
                          "TenantName":"Umbrella Corp.",
                          "Title":"Alert Ended"
                          "UniqueID": "2e447b1889e712340f6d071cebd92ea9"
                        }
                      ]",
  "Timestamp" :       "2018-12-04T15:54:25.130Z",
  "SignatureVersion" : "1",
  "Signature" :       "500PER10NG5!gnaTURE==",
  "SigningCertURL" :  "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-abc123.pem",
  "UnsubscribeURL" :  "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:123456:DS_Events:123abc-123-123-123-123abc"
}

惡意程式防護事件

{
  "Type" :            "Notification",
  "MessageId" :       "123abc-123-123-123-123abc",
  "TopicArn" :        "arn:aws:sns:us-west-2:123456789:DS_Events",
  "Message" :         "[
                        {
                          "AMTarget": "VDSO memory",
                          "AMTargetCount": 1,
                          "AMTargetType": 7,
                          "AMTargetTypeString": "Memory",
                          "ATSEDetectionLevel": 0,
                          "BehaviorRuleId": "DIRTYCOW_MADVISE_EXPL",
                          "BehaviorType": "Exploit_Detection",
                          "CloudOneAccountID": "012345678900"
                          "CommandLine": "/tmp/demo -f esiv [xxxx]",
                          "Cve": "CVE-2016-5195",
                          "ErrorCode": 0,
                          "EventID": 1179519,
                          "EventType": "AntiMalwareEvent",
                          "FileSHA1": "CEF4644713633C0864D4283FEFA0CE174D48F115",
                          "HostAgentGUID": "FF8162DF-4CB5-B158-DE42-EBD52967FCF7",
                          "HostAgentVersion": "20.0.0.1685",
                          "HostGUID": "9089E800-41D3-2CA9-FF0B-3A30A42ED650",
                          "HostID": 38,
                          "HostLastIPUsed": "172.31.21.47",
                          "HostOS": "Red Hat Enterprise 7 (64 bit) (3.10.0-957.12.2.el7.x86_64)",
                          "HostSecurityPolicyID": 11,
                          "HostSecurityPolicyName": "Linux_AM_Sensor",
                          "Hostname": "ec2-3-131-151-239.us-east-2.compute.amazonaws.com",
                          "InfectedFilePath": "/tmp/demo",
                          "LogDate": "2021-01-07T10:32:11.000Z",
                          "MajorVirusType": 14,
                          "MajorVirusTypeString": "Suspicious Activity",
                          "MalwareName": "TM_MALWARE_BEHAVIOR",
                          "MalwareType": 4,
                          "Mitre": "T1068",
                          "Origin": 0,
                          "OriginString": "Agent",
                          "PatternVersion": "1.2.1189",
                          "Process": "testsys_m64",
                          "Protocol": 0,
                          "Reason": "Default Real-Time Scan Configuration",
                          "ScanAction1": 1,
                          "ScanAction2": 0,
                          "ScanResultAction1": 0,
                          "ScanResultAction2": 0,
                          "ScanResultString": "Passed",
                          "ScanType": 0,
                          "ScanTypeString": "Real Time",
                          "Tags": "",
                          "TenantGUID": "",
                          "TenantID": 0,
                          "TenantName": "Primary",
                          "UniqueID": "2e447b1889e712340f6d071cebd92ea9"
                          "UserName": "root"  
                        }
                      ]",
  "Timestamp" :       "2018-12-04T15:57:50.833Z",
  "SignatureVersion" : "1",
  "Signature" :       "500PER10NG5!gnaTURE==",
  "SigningCertURL" :  "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-abc123.pem",
  "UnsubscribeURL" :  "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:123456:DS_Events:123abc-123-123-123-123abc"
}