Log fields

Parameter

Description

Example

ndr_log_type

The protocol log type for Agentic NDR. The value depends on the protocol. For a list of valid values, see Supported protocol types.

HTTP

start_time

The session's start time, as a Unix timestamp in seconds.

1750157428

end_time

The session's end time, as a Unix timestamp in seconds.

1750157428

src_ip

The source IP address of the session.

8.153.XX.XXX

src_port

The source port of the session.

33321

dst_ip

The destination IP address of the session.

203.119.XXX.XXX

dst_port

The destination port of the session.

80

net_connect_dir

The direction of session traffic relative to your assets.

• in: Inbound. Traffic that accesses your asset from the internet or other ECS instances in the internal network.

• out: Outbound. Your asset accesses resources on the internet or other ECS instances in the internal network.

in

l3_protocol

The Layer 3 protocol type.

ipv4, ipv6, other

l4_protocol

The Layer 4 protocol type.

tcp, udp, icmp, other

l7_protocol

The Layer 7 protocol type.

HTTP

tcp_flags

A decimal value derived from a bitwise OR operation on the TCP flags of all packets in the session's traffic.

26

new_conn

Whether the traffic is a new connection.

• 0: The traffic is not a new connection.

• 1: The traffic is a new connection.

0

app_id_extend

The application ID that uniquely identifies the network application.

72

app_name_extend

The application name that corresponds to the application ID.

HTTP_POST

category_id

An ID that classifies the application by use case.

5

category_name

The name of the application category.

WEB

country_id

The two-letter ISO 3166-1 code for the country or region.

Note:

• An empty value indicates an unrecognized country or region.

• If net_connect_dir is in, this is the country or region where the traffic originated.

• If net_connect_dir is out, this is the country or region of the traffic's destination.

CN

city_id

A unique six-digit administrative division code for a city in China (county-level or higher). You can look up the city that corresponds to this code.

110000

req_trans_data

The raw request data. Note: Long payloads may be truncated.

L7PROTODATAL7PROTODATAL7PROTODATAL7PROTODATA

resp_trans_data

The raw response data. Note: Long payloads may be truncated.

L7PROTODATAL7PROTODATAL7PROTODATA

req_trans_offsets

The starting position (byte offset in req_trans_data) of each request data segment.

0,700,2472,3177,3935

resp_trans_offsets

The starting position (byte offset in resp_trans_data) of each response data segment.

0,329,1003

req_trans_lens

The actual length of each request data segment before truncation.

700,1772,705,758,374

resp_trans_lens

The actual length of each response data segment before truncation.

329,674,1002

Parameter

Description

Example value

type

The standard type code for an ICMP message.

8

code

The code for the ICMP message.

0

type_str

A human-readable description (in English) of the ICMP message type.

Echo (ping) reply

id

The identifier in an ICMP message used to match requests with replies (e.g., a ping session ID). The sender typically generates this identifier, and the receiver must echo it.

24367

seq

The sequence number in an ICMP message that specifies the order of messages within a session (e.g., the sequence number for consecutive ping packets).

256

inner_src_ip

The source IP address of the inner packet encapsulated in the ICMP payload. This field applies only when the ICMP payload contains an inner packet.

8.8.X.X

inner_src_port

The source port of the inner packet (e.g., the original TCP or UDP port). This field applies only when the ICMP payload contains an inner packet.

22546

inner_dest_ip

The destination IP address of the inner packet encapsulated in the ICMP payload. This field applies only when the ICMP payload contains an inner packet.

1.1.X.X

inner_dest_port

The destination port of the inner packet (e.g., the original TCP or UDP port). This field applies only when the ICMP payload contains an inner packet.

50988

inner_l4_proto

The transport layer protocol of the inner packet (e.g., TCP=6, UDP=17). This field applies only when the ICMP payload contains an inner packet.

17

Parameter

Description

Example

host

The target hostname and port number from the Host request header.

aliyun.com:8080

request_uri

• The full request URI, including the path and query parameters (e.g., /api/data?id=123), used for route matching, resource location, and auditing the complete request path.

• The difference from request_path is: request_uri contains query parameters, while request_path contains only the path part.

/api?key=value

request_method

The HTTP request method, such as GET, POST, PUT, or DELETE.

POST

http_referer

The complete URL of the referring page, from the Referer request header.

https://aliyun.com/workplace

http_user_agent

The client identifier string from the User-Agent request header.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36

querystring

The query parameters after the ? in a URL.

key=value

request_path

The path component of the URI, which excludes query parameters.

/api

http_x_forwarded_for

The original client IP in the reverse proxy chain (X-Forwarded-For header). Format: A comma-separated list of IP addresses.

11.11.XX.XX, 22.22.XX.XX

status

The three-digit HTTP response status code.

200

response_set_cookie

The session identifier set by the server in the Set-Cookie header.

user=sincerexia; state1=180; state2=135; Secure

content_type

The media type of the request body, as specified in the Content-Type request header.

application/x-www-form-urlencoded; charset=UTF-8

response_content_type

The media type of the response body, as specified in the Content-Type response header.

text/plain;charset=UTF-8

proxy_connection

A connection control directive for a proxy server that manages the reuse of persistent connections.

keep-alive

proxy_authorization

Credentials for authenticating a client to a proxy server, from the Proxy-Authorization request header.

Basic Yxxxxxxxxxxxxxxxxxx==

location

The target URL for a redirection, from the Location response header.

http://relocation.com

request_header

The complete, raw HTTP request header, including the request line and all header fields.

POST /api?key=value HTTP/1.1
X-Real-IP: 8.8.8.8
X-Forwarded-For: 11.11.XX.XX, 22.22.XX.XX
Host: aliyun.com：3080
Connection: close
Content-Length: 123

request_body

The raw HTTP request body, typically included in methods such as POST, PUT, and PATCH.

&user=sincerexia

response_header

The complete, raw HTTP response header.

HTTP/1.1 200 OK
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 18 Jun 2025 08:25:56 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Date: Wed, 18 Jun 2025 08:25:56 GMT
Connection: close

response_info

The raw HTTP response body.

{
  "result"："OK"
 }

Parameter

Description

Example value

version

The SSL/TLS protocol version used for encrypted communication.

TLS 1.3

sni

The target server's domain name, which the client sends during the handshake.

aliyun.com

state

The state of the TLS handshake. Valid values:

• IN_PROGRESS: TLS handshake started.

• TLS_STATE_CERT_READY: Certificate transmission completed.

• HANDSHAKE_DONE: TLS handshake completed.

HANDSHAKE_DONE

cert_subject

The subject information of the certificate in X.500 format, including details such as domain name, organization, and location.

C=CN, ST=ZheJiang, L=HangZhou, O=Alibaba (China) Technology Co., Ltd., CN=aliyuncs.com

cert_issuer

The certification authority (CA) that issued the certificate.

C=BE, O=GlobalSign nv-sa, CN=GlobalSign GCC R3 OV TLS CA 2024

cert_serial

The unique serial number that the certification authority (CA) assigns to the certificate.

45:33:16:59:11:9B:XX:XX:XX:XX:XX:XX

cert_fingerprint

A hash digest that uniquely identifies the certificate.

14:2e:56:4b:8f:b1:c2:0f:8c:8b:ce:36:XX:XX:XX:XX:XX:XX:XX:XX

ja3_str_client

A fingerprint generated from TLS handshake characteristics to identify client behavior.

771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2

ja3_str_server

A fingerprint generated from TLS handshake characteristics to identify server behavior.

771,4866,43-51

ja3_hash_client

A 32-character hexadecimal MD5 hash of the client JA3 string.

40adfd923eb82b89d8836ba37a19bca1

ja3_hash_server

A 32-character hexadecimal MD5 hash of the server JA3 string.

15af977ce25de452b96affa2addb1036

cipher_suite

A combination of algorithms for key exchange, authentication, symmetric encryption, and message authentication code (MAC).

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

Parameter

Description

Example

type

The DNS message type. Valid values:

• query: A DNS query.

• response: A DNS response.

query

id

The transaction ID, a 16-bit unique identifier that matches a query to its response.

40125

rcode

The response code indicating the DNS query's status.

NOCODE

query_name

The fully qualified domain name (FQDN) that the client queried.

oss-cn-hangzhou.aliyuncs.com

query_type

The requested resource record (RR) type, which determines the type of data returned.

A

answers

The response's answer section, a JSON array containing resource records that directly answer the query.

[
  {
    "name":"oss-cn-hangzhou.aliyuncs.com",
    "type":"A",
    "data":"118.31.XX.XX",
    "ttl":131
  }
]

additional

The response's additional section, a JSON array containing extra data related to the query.

[ ]

authority

The response's authority section, a JSON array providing information about authoritative DNS servers for the domain, such as NS records.

[
  {
    "name":"",
    "type":"SOA",
    "data":"ns1.alidns.com",
    "ttl":600
  }
]

Parameter

Description

Example value

db_type

Identifies the database engine type. Valid values:

• MySQL: MySQL database.

• PostgreSQL: PostgreSQL database.

MySQL

type

The log type. Valid values:

• Server Greeting: A server handshake log.

• Login Request: A client login request log.

• Server Greeting & Login Request: A log containing both a server handshake and a client login request.

• Request: A general request log.

• Unknown: Other log types.

Server Greeting & Login Request

user

The username that initiated the operation.

root

db

The target database name (the default database specified on connection).

test_db

protocol_version

The database protocol version number.

10

salt

The random salt value generated by the server during the authentication phase.

x!2k7Gg^9TqL

server_version

The database server version string.

5.7.40-log

server_status

The server status flags.

2

auth_response

The encrypted authentication response from the client.

5f28eeab88bfc739938db314591ff3f9501e8cd5

command_type

The SQL command type.

Query

sql

The raw SQL statement.

SELECT * FROM users;

fail

Indicates whether the operation failed. Valid values:

• 0: Success.

• 1: Failure.

• -1: Unknown.

0

result

A summary of the operation result.

SUCCESS

error_code

The database-specific error code.

0

error_message

A human-readable description of the error.

You have an error in your SQL syntax

return_rows

The number of rows the query returned.

1

return_rows_data

The content of the result set, in CSV format.

admin,123456

affect_rows

The number of rows affected by DML operations.

3

last_insert_id

The last inserted value for an auto-increment primary key.

42

Parameter

Description

Example value

user

The username for FTP authentication. It identifies the client that initiates the session.

user

password

The plaintext password the client submits during authentication.

password

cwd

The client's current working directory. The CWD (Change Working Directory) command dynamically updates this path.

/test

request_command

The FTP protocol command from the client (defined in RFC 959). It specifies the requested operation, such as:

• USER/PASS: Authentication

• LIST/NLST: Directory listing

• RETR: File download

• STOR: File upload

• DELE: File deletion

• PORT/PASV: Data connection mode

USER

request_arg

The argument for the client's FTP command. Combined with request_command, it defines the complete operation.

username

response_code

The three-digit server response status code (defined in RFC 959). The first digit indicates the response category:

• 1xx: Preliminary reply (e.g., 150 File status okay)

• 2xx: Success (e.g., 226 Transfer complete)

• 3xx: Requires further action (e.g., 331 Password required)

• 4xx: Temporary error (e.g., 425 Can't open data connection)

• 5xx: Permanent error (e.g., 530 Not logged in)

331

response_arg

A human-readable message that explains the server's response status code or provides other details.

Anonymous access granted, restrictions apply

Parameter

Description

Example value

opcode

A 4-bit unsigned integer in bits 4–7 of the WebSocket frame header, identifying the frame type and data processing logic.

1

masking_key

A 4-byte (32-bit) random number that masks the payload data byte by byte. Clients typically include this key in frames sent to the server. This field contains the masking key as a hexadecimal value.

pb37e1b69

payload_len

The length of the payload data in bytes.

15

payload

The application-layer data carried in the frame. If a masking_key is present, this field contains the data after being unmasked.

{
  "request": true
 }

Parameter

Description

Example value

client

The name and version of the client software that initiated the SSH connection, such as OpenSSH. This information is used for compatibility analysis, vulnerability assessment, client behavior analysis, and security policy management.

OpenSSH_8.4p1

server

The name and version of the server software receiving the SSH connection, such as an OpenSSH server. This information helps identify the server, manage vulnerabilities, and track security patches.

OpenSSH_8.4p1 Ubuntu-4ubuntu0.3

version

The version of the SSH protocol (1, 2, or unset) negotiated at the start of the connection.

2

cipher_alg

The symmetric encryption algorithm used in the SSH session to encrypt data in transit and ensure data confidentiality. Common algorithms include AES-CTR and ChaCha20. Selecting a strong algorithm, such as AES-256, helps prevent eavesdropping attacks.

AES-128-GCM

compression_alg

The data compression algorithm used in SSH to reduce network bandwidth usage. The value can be none (no compression) or a specific algorithm like zlib. Enabling compression can affect performance, requiring a balance between efficiency and security.

none

host_key

The fingerprint of the SSH server's public key, used to verify the server's identity and prevent man-in-the-middle attacks. The fingerprint is a digest of the public key that a user can compare to confirm they are connecting to a legitimate server.

cc:aa:aa:b7:********:cc:50:11:2d:71:f0:ee

host_key_alg

The public key algorithm used for the SSH server's host key, such as RSA or ECDSA. The strength of the algorithm directly impacts authentication security. Selecting a strong algorithm, like RSA-SHA2, helps prevent forgery attacks.

ECDSA-SHA2-NISTP256

kex_alg

The key exchange algorithm used during SSH connection initialization to negotiate a session key and provide forward secrecy. Common algorithms include Curve25519 and Diffie-Hellman. A secure implementation helps prevent key compromise.

Curve25519-SHA256

mac_alg

The message authentication code (MAC) algorithm used in SSH to ensure data integrity and authenticity, and to prevent data tampering. Common examples include the HMAC-SHA2 family. A strong MAC algorithm is fundamental to secure data transfer.

HMAC-SHA2-256-ETM

auth_attempts

The number of authentication attempts during the SSH authentication process, including attempts using methods such as username/password or a public key. A value greater than 1 might indicate multiple failed attempts or that the server requires two-factor authentication. This field helps monitor for brute-force attacks and audit security events.

3

auth_success

Indicates the final result of the SSH authentication as a boolean value (true or false). As a critical indicator for preventing account hijacking, this information helps detect unauthorized access, populate audit logs, and trigger security alerts.

false

Parameter

Description

Value

cert_count

The number of digital certificates used for server authentication and secure communication in an RDP session.

2

cert_type

The type of certificate, such as a self-signed certificate or one issued by a certification authority (CA). This determines the security level of authentication.

RSA

encryption_level

The encryption strength of the RDP connection, which determines the level of confidentiality and integrity for data transmission.

Client compatible

encryption_method

The encryption method for the RDP connection.

56bit

result

The outcome of the RDP connection attempt, indicating successful establishment or the reason for termination.

Success

client_build

The build version of the RDP client.

RDP 5.1

client_channels

The channels supported by the RDP client for features like clipboard sharing and printer redirection.

rdpdr, cliprdr, rdpsnd

client_dig_product_id

The unique identifier for the RDP client software, used to track its origin.

76487-OEM-******-00107

client_name

The client computer name or host identifier that initiated the RDP connection.

UserPC

cookie

The cookie used in an RDP connection for session management or state persistence. It provides security context and continuity.

session_token

Parameter

Description

Example value

ack

Indicates whether the server has acknowledged the subscription message. The server sends this flag upon accepting a subscription request.

true

action

The type of subscription operation, such as SUBSCRIBE or UNSUBSCRIBE.

SUBSCRIBE

topics

The topics a client subscribes to, which define the scope of messages it receives.

sensor/temperature

client_id

Unique identifier for the client, used for session management and authentication.

client123

connect_status

The connection status between the client and the server.

Connection Accepted

proto_name

The name of the protocol used, typically MQTT (Message Queuing Telemetry Transport).

MQTT

proto_version

MQTT protocol version, such as 3.1.1 or 5.0, used for compatibility management.

3.1.1

will_payload

The content of the will message, automatically published when the client disconnects unexpectedly.

offline

will_topic

The topic to which the will message is published.

status/offline

from_client

Indicates whether the message was published by the client instead of the server.

TRUE

payload

The content of the message, which can be in any data format, such as text or binary.

Hello World

payload_len

The length of the payload in bytes, used to monitor data size.

11

qos

Quality of Service (QoS), which defines the delivery guarantee for a message.

at most once

retain

Indicates whether the server retains the message for immediate delivery to new subscribers.

false

status

Publication status of the message.

ok

topic

The topic to which the message is published, used for routing and filtering.

sensor/data

Parameter

Description

Example

facility

The source type of the log message (such as the kernel, a user program, or the mail system), which helps in filtering and analyzing logs.

USER

message

The content of the log message, which contains details about an event, error, or operation used to diagnose and monitor system behavior.

System rebooted unexpectedly

severity

The severity level of the log message (emergency, alert, critical, error, warning, notice, info, or debug), which indicates urgency and helps prioritize events.

INFO

Parameter

Description

Example value

call_id

The value of the Call-ID header field in the SIP protocol. It uniquely identifies a call session and associates all requests and responses within the session.

101365e0-7e65-****-****-00163e10aabd

method

The method of a SIP request, which defines the requested operation. Examples include INVITE (to establish a session), ACK (to confirm a final response), BYE (to terminate a session), and CANCEL (to cancel a pending request).

INVITE

seq

The value of the CSeq field in a SIP message, which contains the command sequence number and method. This field matches requests with responses, ensuring message order and integrity.

12345 INVITE

uri

The Uniform Resource Identifier (URI) in the SIP request line that specifies the destination address for the request.

sip:bob@example.com

content_type

The media type of the response message body, such as application/sdp (Session Description Protocol), which describes the format of the message content.

application/sdp

response_body_len

The length of the response message body in bytes. This field indicates the data size and helps diagnose network transmission issues.

256

response_from

The source address of the response message. This field typically corresponds to the SIP From header and identifies the originator of the message.

"66666" <sip:66666@example.com>

response_to

The destination address of the response message. This field typically corresponds to the SIP To header, identifies the recipient, and may include a tag parameter.

<sip:777777@example.com>;tag=aaaaaaaaaa

status_code

The SIP response status code, which indicates the result of a request. Examples include 200 (OK), 404 (Not Found), and 500 (Server Error).

180

status_msg

The text description associated with the status code, such as "OK" or "Not Found". It provides a human-readable explanation of the status.

Ringing

warning

Warning text that indicates a potential issue or non-critical error, such as a session timeout or a compatibility problem.

399 example.com Session expired

reply_to

The address to which reply messages are sent. It redirects responses and typically corresponds to the SIP Reply-To header field.

sip:carol@example.com

request_body_len

The length of the request message body in bytes. This field indicates the data size and helps monitor bandwidth usage and transmission efficiency.

128

request_from

The source address of the request message. This field typically corresponds to the SIP From header and identifies the originator of the message.

"66666" <sip:66666@example.com>

request_to

The destination address of the request message. This field typically corresponds to the SIP To header and identifies the recipient of the message.

<sip:777777@example.com>;tag=aaaaaaaaaa

user_agent

An identifier for the client software or device that sent the request. This field enables user agent identification and compatibility checks.

Zoiper/2.0

Field name

Description

Example value

request_type

Specifies the Kerberos message type: authentication service (AS) or ticket granting service (TGS).

AS

client

The principal name of the user or service initiating the Kerberos request. The format is typically username@REALM or service/hostname@REALM.

user2/EXAMPLE.COM

service

The principal name of the target service. In a TGS-REQ, the client requests a service ticket for this service. In an AP-REQ, the client presents a service ticket to this service for authentication.

krbtgt/EXAMPLE.COM

forwardable

Indicates whether the FORWARDABLE flag is set in the ticket granting ticket (TGT).

true 

renewable

Indicates whether the RENEWABLE flag is set in the ticket.

true 

success

Indicates whether the Kerberos request succeeded.

true 

error_code

The protocol-defined error code if the request fails.

24

error_msg

A human-readable error description corresponding to the error_code if the request fails.

PREAUTH_FAILED

from

The start of the ticket's validity period.

0

till

The expiration time of the ticket.

1763692488

cipher

The encryption algorithm used in the Kerberos ticket or protocol message. Common identifiers include aes256-cts-hmac-sha1-96, arcfour-hmac-md5, or des3-cbc-sha1-kd.

aes256-cts-hmac-sha1-96

Parameter

Description

Example value

version

The version of the SOCKS protocol used, such as 4 for SOCKS4 or 5 for SOCKS5.

5

user

The username for proxy authentication (optional).

admin

status

The response status from the proxy server.

success

bound_host

The IP address the proxy server is bound to.

0.0.0.0

bound_name

The hostname the proxy server is bound to.

localhost

bound_p

The port the proxy server is bound to.

1080

request.host

The requested destination server's IP address.

0.0.0.0

request.name

The requested destination server's domain name.

alibaba.com

request_p

The requested destination server's port.

80

Field category

Parameter

Basic information

aliuid, member_uid, alert_uuid, log_time, start_time, end_time, region_id, net_type

Asset information

src_instance_id, dst_instance_id, src_network_instance_id, dst_network_instance_id

Session information

obj_id, src_ip, src_port, dst_ip, dst_port, net_connect_dir, l3_protocol, l4_protocol, l7_protocol, app_id_extend, app_name_extend, flow_decrypted

Attack information

attacker_dir, attacker_ip, attacker_port, victim_ip, victim_port, attack_result, client_real_ip, private_ip, private_port

Rule information

rule_id, vul_id, ips_rule_name, ips_rule_name_en, rule_result, rule_source, attack_type, attack_type_name, attack_type_name_en, sub_attack_type, vul_level, rule_class, is_white

Geolocation information

country_id, city_id, isp_id

Hit and payload information

match_data, match_data_type, match_data_endoffset, match_data_cstype, req_data, resp_data

HTTP information

domain, request_uri, http_x_forwarded_for

Associated resource information

alert_resource_type, alert_resource_uuid

Parameter

Description

Example value

aliuid

The UID of the Alibaba Cloud account that generated the alert.

1234567890123456

member_uid

The UID of the member account that generated the alert. This value is 0 in single-account environments or when the account cannot be identified.

1234567890123456

alert_uuid

The UUID of the alert log.

5e0155a9-bca3-4616-b4d9-ce0ac612da10

log_time

The time the alert was generated, as a Unix timestamp in seconds.

1750157428

start_time

The start time of the associated network session, as a Unix timestamp in seconds.

1750157428

end_time

The end time of the associated network session, as a Unix timestamp in seconds.

1750157430

region_id

The ID of the region where the alert was generated.

cn-hangzhou

net_type

The network type.

• 0: Public network NDR.

• 1: Private network NDR.

0

Parameter

Description

Example value

src_instance_id

The ID of the resource instance associated with the source IP. This field is empty if no matching asset is found.

i-bp1example

dst_instance_id

The ID of the resource instance associated with the destination IP. This field is empty if no matching asset is found.

lb-bp1example

src_network_instance_id

The ID of the network instance, such as a VPC or VBR, associated with the source address.

vpc-bp1example

dst_network_instance_id

The ID of the network instance, such as a VPC or VBR, associated with the destination address.

vpc-bp2example

Parameter

Description

Example value

obj_id

The unique identifier for the transaction associated with the alert. This ID is used to correlate the request and response of the same transaction.

182736451

src_ip

The source IP of the original network session. For TCP, this is the IP that initiated the connection. For UDP, this is typically the source IP of the first packet.

8.153.XX.XXX

src_port

The source port of the original network session.

56420

dst_ip

The destination IP of the original network session.

121.40.XX.XX

dst_port

The destination port of the original network session.

443

net_connect_dir

The direction of the network session relative to the protected asset.

• in: An external resource is accessing the protected asset.

• out: The protected asset is accessing an external resource.

in

l3_protocol

The network layer (Layer 3) protocol, such as ipv4 or ipv6.

ipv4

l4_protocol

The transport layer (Layer 4) protocol, such as tcp, udp, icmp, or other.

tcp

l7_protocol

The application layer (Layer 7) protocol, such as HTTP, TLS, or DNS.

HTTP

app_id_extend

The ID of the extended application. The value is 0 if the application is not identified.

72

app_name_extend

The name of the application that corresponds to the extended application ID. This field is Unknown if the application cannot be identified.

HTTP_POST

flow_decrypted

Indicates whether the traffic was decrypted.

• 0: Not decrypted.

• 1: Decrypted.

1

Parameter

Description

Example value

attacker_dir

The role of the attacker in the original network session.

• 0: The source IP is the attacker.

• 1: The destination IP is the attacker.

0

attacker_ip

The attacker's IP address. This value may be adjusted based on the X-Forwarded-For header or private IP source tracing results.

45.153.XX.XX

attacker_port

The port used by the attacker.

56420

victim_ip

The victim's IP address. This value may be adjusted based on private IP source tracing results.

121.40.XX.XX

victim_port

The port on which the victim provides services.

443

attack_result

The result of the attack. For details about the values, see Attack result values.

2

client_real_ip

The first valid, non-loopback client IP address extracted from the HTTP X-Forwarded-For header. This field is empty if the IP address cannot be identified.

203.0.113.10

private_ip

The private IP address identified through successful private IP source tracing.

192.168.1.10

private_port

The port corresponding to private_ip.

8080

Parameter

Description

Example value

rule_id

The UUID of the matched rule, used to correlate rule details.

8d2d3e90-example

vul_id

The numeric identifier for the matched rule or vulnerability. This field is available only for certain detection types.

10004636

ips_rule_name

The Chinese name of the matched rule.

Struts2 Remote Command Execution

ips_rule_name_en

The English name of the matched rule.

Struts2 Remote Code Execution

rule_result

The action taken by the rule. For alert logs, the value is 1, which indicates that an alert was generated.

1

rule_source

The source of the rule or detection result.

• 4: Threat intelligence.

• 11: Signature rule.

• 12: Malicious file detection.

• 21: Behavioral analysis.

11

attack_type

The ID of the main category for the attack type.

1

attack_type_name

The Chinese name of the attack type.

vulnerability exploitation

attack_type_name_en

The English name of the attack type.

Vulnerability Exploitation

sub_attack_type

The ID of the subcategory for the attack type.

12

vul_level

The risk level.

• 0: No vulnerability exploitation detected.

• 1: Low.

• 2: Medium.

• 3: High.

3

rule_class

The rule detection mode.

• 1: Loose.

• 2: Medium.

• 3: Strict.

2

is_white

Indicates whether the alert matches an allowlist entry.

• 0: No match.

• 1: Match.

0

Parameter

Description

Example value

country_id

The country or region of the public-facing IP address, represented by the ISO 3166-1 two-letter code. This field is empty if the location cannot be identified. For in traffic, this field corresponds to the source IP. For out traffic, it corresponds to the destination IP.

US

city_id

The city code. In Chinese mainland, this is typically the six-digit administrative division code. The value is 0 if the city cannot be identified.

110000

isp_id

The ID of the Internet Service Provider (ISP). The value is 0 if the ISP cannot be identified.

100017

Parameter

Description

Example value

match_data

The content that matched the rule. In threat intelligence scenarios, this can be an IP address, a domain name, or a URL.

cmd.exe

match_data_type

The type of matched content or its location, such as the URI, request header, or request body.

http_uri

match_data_endoffset

The ending byte offset of the matched content within the corresponding payload.

128

match_data_cstype

The direction of the traffic that contained the matched content.

• 0: No direction.

• 1: Request only.

• 2: Response only.

• 3: Both request and response.

1

req_data

The request payload associated with the alert, usually a hexadecimal string. This field may be empty or truncated.

474554202F20485454502F312E31

resp_data

The response payload associated with the alert, usually a hexadecimal string. This field may be empty or truncated.

485454502F312E3120323030204F4B

Parameter

Description

Example value

domain

The destination hostname of the HTTP request.

api.example.com

request_uri

The HTTP request URI. It typically includes the path and query parameters but excludes the protocol and destination hostname.

/api/data?id=123

http_x_forwarded_for

The raw content of the X-Forwarded-For header in the HTTP request. Multiple IP addresses are separated by commas.

203.0.113.10, 198.51.100.20

Parameter

Description

Example value

alert_resource_type

The type of the associated resource. This field is present only if an associated resource exists.

file

alert_resource_uuid

The unique identifier of the associated resource, such as the UUID of an associated malicious file alert.

2d17c5b8-example