运行时异常进程事件详细信息

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询运行时异常进程事件详细信息

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 运行时异常进程事件详细信息

运行时异常进程事件详细信息

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeAbnormalProcessDetail
<公共请求参数>

{
    "EventId": "5202566"
}

输出示例

{
    "Response": {
        "AncestorProcessInfo": {
            "ProcessParam": "-port 22",
            "ProcessPath": "/usr/local/bin/sshd",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "EventBaseInfo": {
            "ClientIP": "106.55.163.***",
            "ClusterID": "cls-13nfdn****",
            "ClusterName": "demo-dev",
            "ContainerId": "1***5fe59dbd61071f16d6165480d381********",
            "ContainerIsolateOperationSrc": "system",
            "ContainerName": "/adoring_ishizaka",
            "ContainerNetStatus": "NORMAL",
            "ContainerNetSubStatus": "NONE",
            "EventCount": 2,
            "EventId": "10302329",
            "EventName": "异常进程事件-告警",
            "EventType": "FILE_ABNORMAL_READ",
            "FoundTime": "2024-10-21 15:55:45",
            "HostID": "1414-18a1-4775-9e3f-cdfc898********",
            "HostIP": "172.16.0.34",
            "ImageId": "sha256:1413413431fd9255658c128086395d3********",
            "ImageName": "alpine:latest",
            "LatestFoundTime": "2024-10-21 20:57:12",
            "Namespace": "default",
            "NodeID": "d41d8cd98f00******",
            "NodeName": "d41d8cd98f00*****",
            "NodeSubNetCIDR": "fe80::8132:1b51:52******",
            "NodeSubNetID": "sub-fn4nf***",
            "NodeSubNetName": "dev",
            "NodeType": "NORMAL",
            "NodeUniqueID": "fe8dfjf2d2****",
            "PodIP": "1.1.1.1",
            "PodName": "pod-dev",
            "PodStatus": "RUNNING",
            "Status": "EVENT_DEALED",
            "WorkloadType": "StatefulSet"
        },
        "EventDetail": {
            "Description": "检测到疑似反弹shell命令执行",
            "GroupName": "SYSTEM_DEFINED_RULE",
            "MatchRule": {
                "ProcessPath": "/usr/bin",
                "RuleId": "100000000000000000000004",
                "RuleLevel": "HIGH",
                "RuleMode": "RULE_MODE_ALERT"
            },
            "OperationTime": "2024-10-23 17:38:12",
            "Remark": "for dev",
            "RuleId": "124",
            "RuleName": "REVERSE_SHELL",
            "Solution": "排查反弹shell行为及目标地址是否为业务正常需要"
        },
        "ParentProcessInfo": {
            "ProcessId": 330852,
            "ProcessName": "containerd-shim",
            "ProcessParam": "containerd-shim -namespace moby -workdir /data/kubernetes/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/ /var/run/docker/runtime-runc",
            "ProcessPath": "/usr/bin/containerd-shim",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "ProcessInfo": {
            "ProcessAuthority": "-rwxr-xr-x",
            "ProcessId": 2907621,
            "ProcessMd5": "8a5772dee965c8223aebc1225e*****",
            "ProcessName": "xenoncli",
            "ProcessParam": "xenoncli xenon ping",
            "ProcessPath": "/usr/local/bin/xenoncli",
            "ProcessStartUser": "root",
            "ProcessTree": "xenoncli(2907621)|containerd-shim(330852)|containerd(17863)|dockerd(17838)|systemd(1)",
            "ProcessUserGroup": "0"
        },
        "RequestId": "280ebb84-63c5-417e-95bd-e3160f6c8cdc"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub, Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub, Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub, Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub, Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。