Alibaba の ActionTrail サンプル・イベント・メッセージ

IBM QRadarとの統合が正常に行われたことを確認する方法として、このサンプル・イベント・メッセージを使用します。

以下のサンプル・イベント・メッセージは、Alibaba Cloud Management コンソールへのログオンを示しています。

{"eventId":"2542222-2222-2222-2222-500d4449 ****","eventVersion":1,"eventSource":"http://account.test.com/test/login_aliyun.htm","sourceIpAddress":"10.0.0.1","userAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/11111 Ariver/1.1.0 AliApp(AP/10.2.28.6000) AlipayClient/10.2.11.6000 Language/zh-Hans Region/CN","eventType":"ConsoleSignin","userIdentity":{"accountId":"11122223333***","principalId":"11122223333***","type":"root-account","userName":"test"},"serviceName":"Customer","additionalEventData":{"loginAccount":"user1","isMFAChecked":"false"},"extend":"2","requestId":"111111-6b56-2222-5555-500d8d25***","eventTime":"2021-01-01T00:00:00Z","isGlobal":true,"acsRegion":"cn-abcd","eventName":"ConsoleSignin"}

以下のサンプル・イベント・メッセージは、 Alibaba Cloud Simple Log Service プロトコル用です。

{"owner_id":"1111111111111111","event":{"additionalEventData":{"CallerBid":"11111"},"apiVersion":"2020-06-16","datasource":"pop-test-east-1","eventSource":"alb.test-east-1.test.com","product":"Alb","requestParameters":{"stsTokenPrincipalName":"test/example","AcsProduct":"Alb","X-Acs-Public-Access":true,"MaxResults":50,"ClientPort":13230,"SignatureType":"","RegionId":"test-east-1"},"sourceIpAddress":"audit.log.test.com","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"AAAAA-AAAAA-AAAAAA-AAA-SHA384","clientProvidedHostHeader":"alb.test-east-1.test.com"},"userAgent":"audit.log.test.com","userIdentity":{"accessKeyId":"STS.N1111111111111111111111","accountId":"1111111111111111","principalId":"11111111111111111111:example","sessionContext":{"attributes":{"mfaAuthenticated":"false"}},"type":"assumed-role","userName":"test:example"},"eventId":"11151579-1111-1111-1111-CCA7EC29C6C1","eventName":"ListLoadBalancers","eventType":"AliyunServiceEvent","acsRegion":"test-east-1","serviceName":"ALB","eventTime":"2024-02-27T09:45:08Z"},"__topic__":"actiontrail_event","__source__":"log_service","__time__":"1709027108"}