ActionTrail:Simple Log Service：SQL ステートメントによる ActionTrail イベントのクエリ

クエリ方法

クエリステートメント

分析ステートメント

イベントクエリ

• 読み取り/書き込みタイプ： * AND "event.eventCategory": Management AND "event.eventRW": Write

• ユーザー名： * AND "event.eventCategory": Management AND "event.userIdentity.userName": "xxx"

• イベント名： * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

• リソースタイプ： * AND "event.eventCategory": Management AND "event.resourceType": "ACS::ECS::Instance"

• リソース名： * AND "event.eventCategory": Management AND "event.resourceName": "i-xxx"

• サービス名： * AND "event.eventCategory": Management AND "event.serviceName": "Ecs"

• AccessKey ID： * AND "event.eventCategory": Management AND "event.userIdentity.accessKeyId": "STS.xxxx"

select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accountId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName

イベント集計クエリ

• 読み取り/書き込みタイプ： * AND "event.eventCategory": Management AND "event.eventRW": Write

• イベント名： * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

• サービス名： * AND "event.eventCategory": Management AND "event.serviceName": "ECS"

• AccessKey ID： * AND "event.eventCategory": Management AND "event.userIdentity.accessKeyId": "STS.xxxx"

SELECT "event.serviceName" AS serviceName, "event.eventName" AS eventName, "event.eventRW" AS eventRW, "event.sourceIpAddress" AS sourceIpAddress, "event.resourceName" AS resourceName, "event.resourceType" AS resourceType, "event.userIdentity.userName" AS userName, "event.userIdentity.type" AS userType, "event.userIdentity.accessKeyId" AS accessKeyId, "event.acsRegion" AS eventRegion, COUNT("event.eventId") AS n, date_trunc('hour', __time__) AS time GROUP BY time, serviceName, eventName, eventRW, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

Insight イベントクエリ

• IP アドレス： * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.insightDetails.sourceIpAddress": "10.12.XX.XX"

• Insight イベントタイプ： * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight

• イベント ID： * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.eventId": 6CE5DBDE-5D18-4BF9-BD6A-E0D2E1BA****

select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count