运行时高危系统调用事件详细信息

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询高危系统调用事件详细信息

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 运行时高危系统调用事件详细信息

运行时高危系统调用事件详细信息

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeRiskSyscallDetail
<公共请求参数>

{
    "EventId": "ad134-cdadfa"
}

输出示例

{
    "Response": {
        "AncestorProcessInfo": {
            "ProcessParam": "containerd --config /var/run/docker/containerd/containerd.toml --log-level warn",
            "ProcessPath": "/usr/bin/containerd",
            "ProcessStartUser": "0",
            "ProcessUserGroup": "0"
        },
        "EventBaseInfo": {
            "ClientIP": "175.178.113.111",
            "ClusterID": "cls-demo1",
            "ClusterName": "web-demo",
            "ContainerId": "75D3326A-9B9C-4275-895A-16FDA1*****",
            "ContainerIsolateOperationSrc": "ContainerIsolateOperationSrc",
            "ContainerName": "/k8s_xenon_mysql-tce-cwp-mysql-2_sso_c9fdfba4-e31a-46bc-a43a-****",
            "ContainerNetStatus": "NORMAL",
            "ContainerNetSubStatus": "NONE",
            "EventCount": 130,
            "EventId": "5124493",
            "EventName": "高危系统调用",
            "EventType": "RISK_SYSCALL_EVENT_TYPE",
            "FoundTime": "2024-10-23 00:05:17",
            "HostID": "11141114-66fd-4171-93eb-2f4fc36ef1e1",
            "HostIP": "10.0.0.105",
            "ImageId": "sha256:11141114e95dce36e8455cf657e1e54d74bb8fac6111411141114",
            "ImageName": "registry.tce.com/service-vendors/mysql-xenon:8.0.32-20240524-155426-11141114.rhel.amd64",
            "LatestFoundTime": "2024-10-23 17:02:47",
            "Namespace": "default",
            "NodeID": "pod-dj4xjf***",
            "NodeName": "tcs-10-0-0-105",
            "NodeSubNetCIDR": "fe80::8132:1b51:5********",
            "NodeSubNetID": "subnet-dfj4***",
            "NodeSubNetName": "default",
            "NodeType": "NORMAL",
            "NodeUniqueID": "node-4jfjfgdnvnd****",
            "PodIP": "10.0.0.11",
            "PodName": "demonset",
            "PodStatus": "running",
            "Status": "EVENT_UNDEAL",
            "WorkloadType": "StatefulSet"
        },
        "EventDetail": {
            "Description": "sergid会导致运行进程的账号权限变更，可能带来安全风险",
            "OperationTime": "1970-01-01 00:00:01",
            "Remark": "user config",
            "Solution": "使用存在潜在风险的系统调用，可能导致容器逃逸。建议对于不常用的系统调用，禁止容器使用，并及时更新宿主机的系统漏洞",
            "SyscallName": "chroot"
        },
        "ParentProcessInfo": {
            "ProcessId": 330852,
            "ProcessName": "containerd-shim",
            "ProcessParam": "containerd-shim -namespace moby -workdir /data/kubernetes/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/ /var/run/docker/runtime-runc",
            "ProcessPath": "/usr/bin/containerd-shim",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "ProcessInfo": {
            "ProcessAuthority": "-rwxr-xr-x",
            "ProcessId": 2907621,
            "ProcessMd5": "8a5772dee965c8223aebc1225e*****",
            "ProcessName": "xenoncli",
            "ProcessParam": "xenoncli xenon ping",
            "ProcessPath": "/usr/local/bin/xenoncli",
            "ProcessStartUser": "root",
            "ProcessTree": "xenoncli(2907621)|containerd-shim(330852)|containerd(17863)|dockerd(17838)|systemd(1)",
            "ProcessUserGroup": "0"
        },
        "RequestId": "d1dd6ed1-0424-4dc8-a3e1-*******"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub, Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub, Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub, Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub, Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。