全部产品
Search
文档中心

操作审计:Insights事件结构定义

更新时间:Jul 27, 2023

本文为您介绍Insights事件的关键字段和示例。

关键字段

名称

描述

eventVersion

Insights事件格式的版本,当前版本为1。

eventType

产生的事件类型。取值:ActionTrailInsight(Insights事件)。

eventCategory

事件分类。取值:Insight(Insights事件)。

eventId

事件ID。

eventTime

事件产生时间(UTC格式)。

acsRegion

事件归属地域。

recipientAccountId

接收事件的阿里云账号ID。

sharedEventId

Insights事件的关联事件ID。

insightDetails

Insights事件的具体信息。

更多信息,请参见InsightDetails包含的字段

表 1. InsightDetails包含的字段

名称

描述

state

Insights事件状态。

insightType

Insights事件类型。取值:

  • IpInsight:可能发生显著变化的IP调用事件。

  • ApiCallRateInsight:API调用率发生显著变化的事件。

  • ApiErrorRateInsight:API错误率发生显著变化的事件。

  • AkInsight:AccessKey调用率发生显著变化的事件。

  • PolicyChangeInsight:权限变更事件。

  • PasswordChangeInsight:密码变更事件。

  • TrailConcealmentInsight:隐匿行踪事件。

insightObject

Insights事件分析对象。取值如下:

  • insightTypeIpInsight时,取值为IP地址。

  • insightTypeApiCallRateInsight时,取值为云产品名称或事件名称。

  • insightTypeApiErrorRateInsight时,取值为云产品名称、事件名称或错误码。

  • insightTypeAkInsight时,取值为AccessKey ID。

  • insightTypePolicyChangeInsightPasswordChangeInsightTrailConcealmentInsight时,取值为云产品名称。

insightContext

Insights相关信息。

更多信息,请参见insightContext包含的字段

表 2. insightContext包含的字段

名称

描述

attributions

多维度聚合分析。

更多信息,请参见attributions包含的字段

statistics

统计分析。

更多信息,请参见statistics包含的字段

表 3. attributions包含的字段

名称

描述

attribution

多维度聚合分析。不同事件类型包含信息如下:

  • IpInsight事件包含userAgent、principalId、apiRelated和errorCode等信息。

  • ApiCallRateInsight事件包含userAgent、principalId和errorCode等信息。

  • ApiErrorRateInsight事件包含userAgent和principalId等信息。

  • AkInsight事件包含userAgent、apiRelated、ipRelated和errorCode等信息。

  • PolicyChangeInsight事件、PasswordChangeInsight事件和TrailConcealmentInsight事件包含userAgent、principalId、apiRelated、ipRelated和errorCode等信息。

insight

Insights事件实际测量数据。

baseline

Insights事件基准测量数据。

表 4. statistics包含的字段

名称

描述

insight

Insights事件实际测量数据。

insightDuration

Insights事件的持续时间。

单位:分钟。

baseline

Insights事件基准测量数据。

baselineDuration

Baseline持续时间。

单位:分钟。

insightCount

Insights持续时间内涉及的管控事件数。

示例

  • IpInsight

    {
          "eventId": "493C2E32-F83B-4267-8050-314C8E77094A",
          "eventCategory": "Insight",
          "sharedEventId": "5A72E7C7-95A8-4213-9AA1-6138492977A3",
          "eventVersion": "1",
          "eventTime": "2023-07-24T03:27:00Z",
          "insightDetails": {
            "insightContext": {
              "attributions": [
                {
                  "insight": [
                    {
                      "average": 2,
                      "value": "JavaSDK Revision:9760a99 Version:0.43.3 JavaVersion:1.8.0_212 CLT(0.43.2 : 9226976); Linux(169.254.224.20/cn-hangzhou-99x4c3iojty1by1bb6x3if2****)"
                    }
                  ],
                  "attribute": "userAgent"
                },
                {
                  "insight": [
                    {
                      "average": 2,
                      "value": "28413042062885****"
                    }
                  ],
                  "attribute": "principalId"
                },
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "MaxCompute/JobChange"
                    },
                    {
                      "average": 1,
                      "value": "MaxCompute/InsertJob"
                    }
                  ],
                  "attribute": "apiRelated"
                },
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "ODPS-0130071"
                    },
                    {
                      "average": 1,
                      "value": "null"
                    }
                  ],
                  "attribute": "errorCode"
                }
              ],
              "statistics": {
                "insight": {
                  "average": 2,
                  "predict": 0
                },
                "insightDuration": 1,
                "baseline": {
                  "threshold": 0.6
                },
                "insightCount": 2
              }
            },
            "sourceIpAddress": "22.17.XX.XX",
            "state": "Start",
            "insightType": "IpInsight"
          },
          "acsRegion": "cn-hangzhou",
          "eventType": "ActionTrailInsight"
        }
  • ApiCallRateInsight

    {
          "eventId": "2AA62459-79F4-4AA4-B729-F6C90369E91F",
          "eventCategory": "Insight",
          "sharedEventId": "5A3499B4-5446-40B3-87BF-7D1603CA4ED0",
          "eventVersion": "1",
          "eventTime": "2023-07-25T00:31:00Z",
          "insightDetails": {
            "insightContext": {
              "attributions": [
                {
                  "insight": [
                    {
                      "average": 364,
                      "value": "JavaSDK Revision:046519a Version:0.40.14 JavaVersion:1.8.0_212 DATAX"
                    }
                  ],
                  "attribute": "userAgent",
                  "baseline": [
                    {
                      "average": 526.2147,
                      "value": "JavaSDK Revision:046519a Version:0.40.14 JavaVersion:1.8.0_212 DATAX"
                    },
                    {
                      "average": 125.13071,
                      "value": "JavaSDK Revision:dc3569f Version:0.40.4 JavaVersion:1.8.0_212 DATAX"
                    },
                    {
                      "average": 0.13817,
                      "value": "JavaSDK Revision:046519a Version:0.40.14 JavaVersion:1.8.0_112 DATAX"
                    },
                    {
                      "average": 0.03728,
                      "value": "JavaSDK Revision:dc3569f Version:0.40.4 JavaVersion:1.8.0_112 DATAX"
                    },
                    {
                      "average": 0.04539,
                      "value": "others"
                    }
                  ]
                },
                {
                  "insight": [
                    {
                      "average": 364,
                      "value": "21781321968501****"
                    }
                  ],
                  "attribute": "principalId",
                  "baseline": [
                    {
                      "average": 651.50726,
                      "value": "21781321968501****"
                    },
                    {
                      "average": 0.04539,
                      "value": "29645888701658****"
                    },
                    {
                      "average": 0.01359,
                      "value": "116214297662****"
                    }
                  ]
                },
                {
                  "insight": [
                    {
                      "average": 364,
                      "value": "null"
                    }
                  ],
                  "attribute": "errorCode",
                  "baseline": [
                    {
                      "average": 651.5663,
                      "value": "null"
                    }
                  ]
                }
              ],
              "statistics": {
                "baselineDuration": 6036,
                "insight": {
                  "average": 364
                },
                "insightDuration": 1,
                "baseline": {
                  "average": 8.35901
                }
              }
            },
            "state": "Start",
            "insightType": "ApiCallRateInsight",
            "insightObject": "MaxCompute/UploadTable"
          },
          "acsRegion": "cn-shanghai",
          "eventType": "ActionTrailInsight"
        }
  • ApiErrorRateInsight

    {
          "eventId": "D8A2E554-6030-4759-AC86-39D9A6657141",
          "eventCategory": "Insight",
          "sharedEventId": "1D5E87F8-74BD-4602-A46F-15D121A40076",
          "eventVersion": "1",
          "eventTime": "2023-07-24T05:55:00Z",
          "insightDetails": {
            "insightContext": {
              "attributions": [
                {
                  "insight": [
                    {
                      "average": 10,
                      "value": "pre-actiontrail.console.aliyun.com"
                    }
                  ],
                  "attribute": "userAgent",
                  "baseline": [
                    {
                      "average": 0.00128,
                      "value": "actiontrail.console.aliyun.com"
                    },
                    {
                      "average": 0.00035,
                      "value": "pre-actiontrail.console.aliyun.com"
                    }
                  ]
                },
                {
                  "insight": [
                    {
                      "average": 10,
                      "value": "29228928693846****"
                    }
                  ],
                  "attribute": "principalId",
                  "baseline": [
                    {
                      "average": 0.00055,
                      "value": "29228928693846****"
                    },
                    {
                      "average": 0.00036,
                      "value": "22849585603625****"
                    },
                    {
                      "average": 0.00029,
                      "value": "20760722332912****"
                    },
                    {
                      "average": 0.00024,
                      "value": "28162628619075****"
                    },
                    {
                      "average": 0.00018,
                      "value": "others"
                    }
                  ]
                }
              ],
              "statistics": {
                "baselineDuration": 82210,
                "insight": {
                  "average": 10
                },
                "insightDuration": 1,
                "baseline": {
                  "average": 0.00081
                }
              }
            },
            "state": "Start",
            "insightType": "ApiErrorRateInsight",
            "insightObject": "Actiontrail/GetTrailStatus/TrailNotFoundException"
          },
          "acsRegion": "cn-shanghai",
          "eventType": "ActionTrailInsight"
        }
  • AkInsight

    {
          "eventId": "36DD0E98-00C4-42F5-9FE9-6E4EDCD69C0B",
          "eventCategory": "Insight",
          "sharedEventId": "7E31028F-9C6F-4BDF-83C7-68A70930CEBD",
          "eventVersion": "1",
          "eventTime": "2023-07-24T20:06:00Z",
          "insightDetails": {
            "insightContext": {
              "attributions": [
                {
                  "insight": [
                    {
                      "average": 194,
                      "value": "Tunnel C++ SDK, ee4d58de889e126667fdc13608058f3487596b72."
                    }
                  ],
                  "attribute": "userAgent",
                  "baseline": [
                    {
                      "average": 0.44587,
                      "value": "Tunnel C++ SDK, ee4d58de889e126667fdc13608058f3487596b72."
                    }
                  ]
                },
                {
                  "insight": [
                    {
                      "average": 194,
                      "value": "MaxCompute/DownloadTable"
                    }
                  ],
                  "attribute": "apiRelated",
                  "baseline": [
                    {
                      "average": 0.44587,
                      "value": "MaxCompute/DownloadTable"
                    }
                  ]
                },
                {
                  "insight": [
                    {
                      "average": 194,
                      "value": "null"
                    }
                  ],
                  "attribute": "errorCode",
                  "baseline": [
                    {
                      "average": 0.44587,
                      "value": "null"
                    }
                  ]
                },
                {
                  "insight": [
                    {
                      "average": 194,
                      "value": "Internal"
                    }
                  ],
                  "attribute": "ipRelated",
                  "baseline": [
                    {
                      "average": 0.44587,
                      "value": "Internal"
                    }
                  ]
                }
              ],
              "statistics": {
                "baselineDuration": 9976,
                "insight": {
                  "average": 194
                },
                "insightDuration": 1,
                "baseline": {
                  "average": 0.2066
                }
              }
            },
            "state": "Start",
            "insightType": "AkInsight",
            "insightObject": "LTAI4FyADTcgMMZa61mE****"
          },
          "acsRegion": "cn-shanghai",
          "eventType": "ActionTrailInsight"
        }
  • PasswordChangeInsight、PolicyChangeInsight和TrailConcealmentInsight

    {
          "eventId": "B0DB3701-3438-41D4-9AA5-CABE8F20AEE0",
          "eventCategory": "Insight",
          "sharedEventId": "1003F2A8-B4B4-4AFC-8F3C-07FD45886F47",
          "eventVersion": "1",
          "eventTime": "2023-07-24T05:55:00Z",
          "insightDetails": {
            "insightContext": {
              "attributions": [
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "pre-actiontrail.console.aliyun.com"
                    }
                  ],
                  "attribute": "Actiontrail/DeleteTrail/userAgent"
                },
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "null"
                    }
                  ],
                  "attribute": "Actiontrail/DeleteTrail/accessKeyId"
                },
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "29228928693846****"
                    }
                  ],
                  "attribute": "Actiontrail/DeleteTrail/principalId"
                },
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "null"
                    }
                  ],
                  "attribute": "Actiontrail/DeleteTrail/errorCode"
                },
                {
                  "insight": [
                    {
                      "average": 1,
                      "value": "Internal"
                    }
                  ],
                  "attribute": "Actiontrail/DeleteTrail/ipRelated"
                }
              ]
            },
            "state": "Start",
            "insightType": "TrailConcealmentInsight",
            "insightObject": "Actiontrail"
          },
          "acsRegion": "cn-shanghai",
          "eventType": "ActionTrailInsight"
        }