运行时异常进程事件详细信息

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询运行时异常进程事件详细信息

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 运行时异常进程事件详细信息

运行时异常进程事件详细信息

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeAbnormalProcessDetail
<公共请求参数>

{
    "EventId": "5202566"
}

输出示例

{
    "Response": {
        "AncestorProcessInfo": {
            "ProcessParam": "-port 22",
            "ProcessPath": "/usr/local/bin/sshd",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "EventBaseInfo": {
            "ClientIP": "106.55.163.111",
            "ClusterID": "",
            "ClusterName": "",
            "ContainerId": "111411411475fe59dbd61071f16d6165480d381e5fb3663d176d53669b",
            "ContainerIsolateOperationSrc": "",
            "ContainerName": "/adoring_ishizaka",
            "ContainerNetStatus": "NORMAL",
            "ContainerNetSubStatus": "NONE",
            "EventCount": 2,
            "EventId": "10302329",
            "EventName": "异常进程事件-告警",
            "EventType": "FILE_ABNORMAL_READ",
            "FoundTime": "2024-10-21 15:55:45",
            "HostID": "1414-18a1-4775-9e3f-cdfc89845157",
            "HostIP": "172.16.0.34",
            "ImageId": "sha256:1413413431fd9255658c128086395d3fa0aedd5a41ab6b034fd649d1a9260",
            "ImageName": "alpine:latest",
            "LatestFoundTime": "2024-10-21 20:57:12",
            "Namespace": "",
            "NodeID": "",
            "NodeName": "-",
            "NodeSubNetCIDR": "",
            "NodeSubNetID": "",
            "NodeSubNetName": "",
            "NodeType": "NORMAL",
            "NodeUniqueID": "",
            "PodIP": "",
            "PodName": "-",
            "PodStatus": "",
            "Status": "EVENT_DEALED",
            "WorkloadType": ""
        },
        "EventDetail": {
            "Description": "检测到疑似反弹shell命令执行",
            "GroupName": "SYSTEM_DEFINED_RULE",
            "MatchRule": {
                "ProcessPath": "-",
                "RuleId": "100000000000000000000004",
                "RuleLevel": "HIGH",
                "RuleMode": "RULE_MODE_ALERT"
            },
            "OperationTime": "2024-10-23 17:38:12",
            "Remark": "",
            "RuleId": "124",
            "RuleName": "REVERSE_SHELL",
            "Solution": "排查反弹shell行为及目标地址是否为业务正常需要"
        },
        "ParentProcessInfo": {
            "ProcessId": 0,
            "ProcessName": "",
            "ProcessParam": "",
            "ProcessPath": "",
            "ProcessStartUser": "",
            "ProcessUserGroup": ""
        },
        "ProcessInfo": {
            "ProcessAuthority": "-",
            "ProcessId": 0,
            "ProcessMd5": "",
            "ProcessName": "-",
            "ProcessParam": "sh -c \"bash >&1\"",
            "ProcessPath": "-",
            "ProcessStartUser": "",
            "ProcessTree": "-",
            "ProcessUserGroup": ""
        },
        "RequestId": "280ebb84-63c5-417e-95bd-e3160f6c8cdc"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。