查询恶意请求事件详情

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询恶意请求事件详情

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 查询恶意请求事件详情

查询恶意请求事件详情

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeRiskDnsEventDetail
<公共请求参数>

{
    "EventID": "1"
}

输出示例

{
    "Response": {
        "Address": "www.iuyiyo.cc",
        "AncestorProcessParam": "/usr/bin/containerd-shim-runc-v2 -namespace moby -id b18a9a372645caefdca4cf9a4e1078122ecf4081bfab0034f85f664b81df0da5 -address /run/containerd/containerd.sock",
        "AncestorProcessPath": "/usr/bin/containerd-shim-runc-v2",
        "AncestorProcessStartUser": "root",
        "AncestorProcessUserGroup": "0:0",
        "City": "103",
        "ClusterID": "cls-dfw3e***",
        "ClusterName": "clsfoo***",
        "ContainerID": "b18a9a372645caefdca4cf9a4e1078122ecf4081bfab0034f85f664b81df0da5",
        "ContainerIsolateOperationSrc": "运行时安全/文件查杀",
        "ContainerName": "/fervent_goodall",
        "ContainerNetStatus": "NORMAL",
        "ContainerNetSubStatus": "NONE",
        "ContainerStatus": "RUNNING",
        "Description": "发现容器存在访问恶意IP/域名的行为，您的容器可能已经失陷。\n恶意IP/域名可能是黑客的远控服务器、恶意软件下载源、矿池地址等。",
        "EventCount": 1,
        "EventID": 306602,
        "EventStatus": "EVENT_UNDEAL",
        "EventType": "DOMAIN",
        "FeatureLabel": "label1",
        "FoundTime": "2024-09-29 17:27:15",
        "HostID": "acdd5474-6360-4fd4-bfc7-843162cb8116",
        "HostIP": "10.0.1.233",
        "HostName": "k8s-node1",
        "ImageID": "sha256:eeb6ee3f44bd0b5103bb561b4c16bcb82328cfe5809ab675bb17ab3a16c517c9",
        "ImageName": "centos:7",
        "LatestFoundTime": "2024-09-29 17:27:15",
        "MatchRuleType": "USER",
        "Namespace": "tcss",
        "NodeID": "mix-GOmf****",
        "NodeName": "k8s-node1",
        "NodeSubNetCIDR": "10.0.200.0/24",
        "NodeSubNetID": "subnet-5gu2***",
        "NodeSubNetName": "subnet***",
        "NodeType": "NORMAL",
        "NodeUniqueID": "896e349d-2e7d-4151-a26f-4e9fdafe****",
        "OperationTime": "2024-09-29 17:27:17",
        "ParentProcessParam": "/bin/bash",
        "ParentProcessPath": "/usr/bin/bash",
        "ParentProcessStartUser": "root",
        "ParentProcessUserGroup": "root:root",
        "PodIP": "10.0.1.92",
        "PodName": "PodName",
        "PodStatus": "Running",
        "ProcessAuthority": "-rwxr-xr-x",
        "ProcessMd5": "b8b1ce2ef81accb7febb8ab7f56c1576",
        "ProcessParam": "curl www.iuyiyo.cc",
        "ProcessPath": "/usr/bin/curl",
        "ProcessStartUser": "root",
        "ProcessTree": "curl(2206566)_bash(2178914)_containerd-shim-runc-v2(2178890)_systemd(1)",
        "ProcessUserGroup": "root:root",
        "PublicIP": "43.138.142.208",
        "Reference": [
            "Reference"
        ],
        "Remark": "myremark***",
        "RequestId": "52fe1ea9-4826-4f8e-bc8b-61faae09683b",
        "Solution": "1.检查容器内的恶意进程及非法端口，删除可疑的启动项和定时任务；\n 2.对容器存在的风险进行排查，如进行漏洞扫描、木马扫描等；\n 3.对容器所使用的的镜像进行加固，并替换运行中的容器。",
        "WorkloadType": "DaemonSet"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub, Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub, Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub, Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub, Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。