ActionTrail:Kueri event ActionTrail di Simple Log Service menggunakan pernyataan SQL

Metode kueri

Pernyataan kueri

Pernyataan analitik

Event query

• Kueri berdasarkan tipe baca/tulis: * AND "event.eventCategory": Management AND "event.eventRW": Write

• Kueri berdasarkan username: * AND "event.eventCategory": Management AND "event.userIdentity.userName": "xxx"

• Kueri berdasarkan nama event: * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

• Kueri berdasarkan tipe resource: * AND "event.eventCategory": Management AND "event.resourceType": "ACS::ECS::Instance"

• Nama Resource: * AND "event.eventCategory": Management AND "event.resourceName": "i-xxx"

• Nama layanan: * AND "event.eventCategory": Management AND "event.serviceName": "Ecs"

• Kueri berdasarkan AccessKey ID: * AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"

• Kueri berdasarkan alamat IP sumber: * AND "event.eventCategory": Management AND "event.sourceIpAddress": "10.12.XX.XX"

select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accontId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName

Event summary query

• Tipe baca/tulis: * AND "event.eventCategory": Management AND "event.eventRW": Write

• Nama Event: * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

• Nama layanan: * AND "event.eventCategory": Management AND "event.serviceName": "ECS"

• Kueri berdasarkan AccessKey ID: * AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"

SELECT"event.serviceName"AS servieName,"event.eventName"AS eventName,"event.eventRw"AS eventRw,"event.sourceIpAddress"AS sourceIpAddress,"event.resourceName"AS resourceName,"event.resourceType"AS resourceType,"event.userIdentity.userName"AS userName,"event.userIdentity.type"AS userType,"event.userIdentity.accessKeyId"AS accessKeyId,"event.acsRegion"AS eventRegion,COUNT("event.eventId")AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

Insight event query

• Kueri berdasarkan alamat IP: * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.insightDetails.sourceIpAddress": "10.12.XX.XX"

• Kueri berdasarkan tipe event insight: * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight

• Kueri berdasarkan ID event: * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.eventId": 6CE5DBDE-5D18-4BF9-BD6A-E0D2E1BA****

select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count