Security Center:Log types and field descriptions

Logon logs

`__topic__`: aegis-log-login

Records user logon events on servers, including source IP address, username, and logon result. Use these logs to monitor user activity and detect abnormal logon patterns.

Repeated logons within one minute are merged into a single log entry. A login_count of 3 means three logons occurred within the last minute.

Network connection logs

`__topic__`: aegis-log-network

Records network connection activity on the server in real time, including the connection 5-tuple and associated processes. Use these logs to detect abnormal connections and potential network attacks.

Process startup logs

`__topic__`: aegis-log-process

Records startup events for all new processes, including process name, command-line parameters, and parent process. Use these logs to detect abnormal process activity, malware intrusions, and security threats. Logs are reported immediately after a process starts.

Brute-force attack logs

`__topic__`: aegis-log-crack

Records brute-force attack attempts, including logon and credential cracking attempts against systems, applications, or accounts. Use these logs to detect abnormal logons, weak passwords, and credential exposure.

Repeated logon attempts within one minute are merged into a single log entry. A login_count of 3 means three attempts within the last minute.

Account snapshot logs

`__topic__`: aegis-snapshot-host

Records detailed user account information, including username, password policy, and logon history. Compare snapshots across time to detect unauthorized access and abnormal account status changes.

Network snapshot logs

`__topic__`: aegis-snapshot-port

Records network connection information, including the connection 5-tuple, connection status, and associated processes. Use these logs to identify active connections and detect abnormal behavior.

Process snapshot logs

`__topic__`: aegis-snapshot-process

Records process activity, including process ID, name, and startup time. Use these logs to detect abnormal processes, high CPU usage, and memory leaks.

DNS query logs

`__topic__`: aegis-log-dns-query

Records DNS query requests initiated by the server, including queried domain name, query type, and source process. Use these logs to detect abnormal queries, domain hijacking, and DNS poisoning.

Client event logs

`__topic__`: aegis-log-client

Records online and offline events of the Security Center agent, letting you monitor the agent's running status.

Vulnerability logs

`__topic__`: sas-vul-log

Records vulnerabilities found in your systems or applications, including vulnerability name, status, and handling action. Use these logs to track vulnerabilities, assess risk, and monitor remediation.

CSPM - Baseline check logs

`__topic__`: sas-hc-log

Records baseline risk check results, including baseline level, category, and risk level. Use these logs to understand baseline security status and identify configuration risks.

Security alert logs

`__topic__`: sas-security-log

Records security events and alerts, including alert data source, details, and alert level. Use these logs to track security events and coordinate response actions.

CSPM - Cloud platform configuration check logs

`__topic__`: sas-cspm-log

Records cloud platform configuration check results and whitelisting operations. Use these logs to detect configuration issues and potential security risks in your cloud environment.

Network defense logs

`__topic__`: sas-net-block

Records network attack events, including attack type and source and destination IP addresses. Use these logs to understand network threats and coordinate defense actions.

Application protection logs

`__topic__`: sas-rasp-log

Records attack alerts from Runtime Application Self-Protection (RASP), including attack type, behavioral data, and attacker IP address. Use these logs to detect and respond to application-layer attacks.

Malware detection logs

`__topic__`: sas-filedetect-log

Records detection results from the Malicious File Detection SDK, including file information, detection scenario, and results. Use these logs to identify and respond to malicious programs in offline files or cloud storage.

Core file monitoring event logs

`__topic__`: aegis-file-protect-log

Records alert events from the Core File Monitoring feature, including file path, operation type, and alert level. Use these logs to detect unauthorized access or tampering with critical files.

Agentless detection logs

`__topic__`: sas-agentless-log

Records security risks detected in cloud servers, disk snapshots, and images — including vulnerabilities, baseline failures, malicious samples, and sensitive files. Use these logs to track asset risk status over time and detect potential threats.