Alibaba ActionTrail sample event message
Use this sample event message as a way of verifying a successful integration with IBM QRadar.
The following sample event message shows Logon to the Alibaba Cloud Management console.
{"eventId":"2542222-2222-2222-2222-500d4449 ****","eventVersion":1,"eventSource":"http://account.test.com/test/login_aliyun.htm","sourceIpAddress":"10.0.0.1","userAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/11111 Ariver/1.1.0 AliApp(AP/10.2.28.6000) AlipayClient/10.2.11.6000 Language/zh-Hans Region/CN","eventType":"ConsoleSignin","userIdentity":{"accountId":"11122223333***","principalId":"11122223333***","type":"root-account","userName":"test"},"serviceName":"Customer","additionalEventData":{"loginAccount":"user1","isMFAChecked":"false"},"extend":"2","requestId":"111111-6b56-2222-5555-500d8d25***","eventTime":"2021-01-01T00:00:00Z","isGlobal":true,"acsRegion":"cn-abcd","eventName":"ConsoleSignin"}
QRadar field name | Highlighted payload field name |
---|---|
Event ID | eventName |
Username | userIdentity.userName |
Source IP | sourceIpAddress |
Device Time | eventTime |
The following sample event message is for Alibaba Cloud Simple Log Service Protocol.
{"owner_id":"1111111111111111","event":{"additionalEventData":{"CallerBid":"11111"},"apiVersion":"2020-06-16","datasource":"pop-test-east-1","eventSource":"alb.test-east-1.test.com","product":"Alb","requestParameters":{"stsTokenPrincipalName":"test/example","AcsProduct":"Alb","X-Acs-Public-Access":true,"MaxResults":50,"ClientPort":13230,"SignatureType":"","RegionId":"test-east-1"},"sourceIpAddress":"audit.log.test.com","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"AAAAA-AAAAA-AAAAAA-AAA-SHA384","clientProvidedHostHeader":"alb.test-east-1.test.com"},"userAgent":"audit.log.test.com","userIdentity":{"accessKeyId":"STS.N1111111111111111111111","accountId":"1111111111111111","principalId":"11111111111111111111:example","sessionContext":{"attributes":{"mfaAuthenticated":"false"}},"type":"assumed-role","userName":"test:example"},"eventId":"11151579-1111-1111-1111-CCA7EC29C6C1","eventName":"ListLoadBalancers","eventType":"AliyunServiceEvent","acsRegion":"test-east-1","serviceName":"ALB","eventTime":"2024-02-27T09:45:08Z"},"__topic__":"actiontrail_event","__source__":"log_service","__time__":"1709027108"}
QRadar field name | Highlighted payload field name |
---|---|
Event ID | event.eventName |
Username | event.userIdentity.userName |
Source IP | event.requestParameters.ClientPort |
Device Time | event.eventTime |