Log ingestion
This topic describes how to send logs to Security Center for security risk detection.
Log ingestion
This section shows the availability status, number of identified assets, and detected threat information for each log source.
Parameter | Description |
Log source | A custom name that indicates the source of the logs. |
Number of identified assets | The total number of assets identified by analyzing the logs from this source. |
Total analyses | The total number of security checks performed on the assets identified from this log source. |
Unprocessed threat alerts | Threat alerts discovered from the logs of the current log source. |
Status | Indicates whether the most recent log retrieval from this source was successful. |
Enable log ingestion and detection
If you have not enabled this feature, you can click Buy Now.
Add a log source
You can configure a log source to specify how raw logs are obtained, the format of the raw logs, and the field mappings required for threat detection.
1. Click Add Log Source to create a new log source.
2. In the dialog box that appears, set the log source name and the log retrieval method. Then, click Next.
You can import logs from Simple Log Service (SLS) or Kafka.
3. Configure the required information to obtain raw logs. Then, click Next.
4. Parse the retrieved logs and map the log keys to the required fields. Click OK to add the new log source.
5. Security Center periodically retrieves and analyzes the logs. The analysis results are displayed and summarized on the Log Ingestion page.
Supported log types
The required fields are Time, Device ID, and Log Type.
Log Source Type | Log Type | Log Field | Example |
Network access log | Device network access log | Time | The time of the event, such as 2021-10-14 11:05:30. Specify the time format during ingestion. |
Device ID | The unique identifier of the device, such as the MAC address 4a:83:e7:3f:9****. | ||
Source IP address | The source IP address, such as 192.168.0.2. | ||
Source port | The source port, such as 22432. | ||
Target IP address | The destination IP address, such as 8.8.xx.xx. | ||
Destination port | The destination port, such as 80. | ||
Destination URL | The destination URL, such as www.aliyun.com. | ||
Third-party IoT Platform log | Device connection | Time | The time of the event, such as 2021-10-14 11:05:30. Specify the time format during ingestion. |
Device ID | The device identifier, such as the MAC address 4a:83:e7:3f:9****. | ||
Device IP address | The device IP address, such as 120.xx.xx.18. | ||
Transport protocol | The transport protocol, such as TCP or TLS. | ||
Result | Indicates whether the connection was successful. You must specify the field mapping for success and failure. | ||
Reason | The reason for connection failure. You must specify the description that corresponds to an authentication failure. Authentication failure: auth_failure | ||
Device offline | Time | The time of the event, such as 2021-10-14 11:05:30. Specify the time format during ingestion. | |
Device ID | The device identifier, such as the MAC address 4a:83:e7:3f:9****. | ||
Device IP address | The device IP address, such as 120.xx.xx.18. | ||
Reason | The reason for going offline. You must specify the description that corresponds to being kicked offline by a connection with the same device identity. | ||
Device sends message | Time | The time of the event, such as 2021-10-14 11:05:30. Specify the time format during ingestion. | |
Device ID | The device identifier, such as the MAC address 4a:83:e7:3f:9****. | ||
Device IP address | The device IP address, such as 120.xx.xx.18. | ||
Data size | The size of the sent data, such as 1000. Select the data unit during ingestion. | ||
Message sent to device | Time | The time of the event, such as 2021-10-14 11:05:30. Specify the time format during ingestion. | |
Device ID | The device identifier, such as the MAC address 4a:83:e7:3f:9****. | ||
Device IP address | The device IP address, such as 120.xx.xx.18. | ||
Data size | The size of the sent data, such as 1000. Select the data unit during ingestion. |
Supported threat detections
To enable a threat detection item, you must provide all the required fields for the log source and complete the field mapping. The following table lists the required fields for different check items.
Log Type | Log Field | Threat Detection Category | Threat Detection Item | Required Fields | Description |
Network access log | Custom format. For supported fields, see the table above. | Network access | Malicious IP connection detection | Time, Device ID, Log Type (network access), Destination IP address. | Detects malicious IP addresses in network access. |
Malicious domain/URL access detection | Time, Device ID, Log Type (network access), Destination URL. | Detects malicious domain names or URLs in network access. | |||
Third-party IoT Platform log | Custom format. For supported fields, see the table above. | Platform-side threats | Insecure connection detection | Time, Device ID, Log Type (device online), Transport protocol. | Detects whether the connection between a device and the IoT Platform is secure. |
Abnormal device online behavior detection | Time, Device ID, Log Type (device online). | Detects an abnormal number of times a device goes online within a specific period. | |||
Abnormal device offline behavior detection | Time, Device ID, Log Type (device offline). | Detects an abnormal number of times a device goes offline within a specific period. | |||
Frequent device authentication failure detection | Time, Device ID, Log Type (device online), Result. | Detects an abnormal number of device authentication errors within a specific period. | |||
Device identity brute-force attack detection | Time, Device ID, Log Type (device online), Result, Reason (authentication failure). | Detects brute-force attacks against devices. | |||
Detection of malicious IP addresses connecting to the platform | Time, Device ID, Log Type (device online), Source IP. | Detects if any malicious IP addresses are connecting to the platform. | |||
Abnormal device message reporting frequency detection | Time, Device ID, Log Type (device sends message). | Detects an abnormal number of messages reported by a device within a specific period. | |||
Abnormal device message reporting data volume detection | Time, Device ID, Log Type (device sends message), Data size. | Detects an abnormal average data volume of messages reported by a device within a specific period. | |||
Abnormal platform message push frequency detection | Time, Device ID, Log Type (message sent to device). | Detects an abnormal number of messages pushed to a device within a specific period. | |||
Abnormal platform message push data volume detection | Time, Device ID, Log Type (message sent to device), Data size. | Detects an abnormal average data volume of messages pushed to a device within a specific period. |
Details
This section displays all asset and threat information for the log source.
You must manually respond to threats that are identified from the log source. For example, you can close insecure interfaces or services, uninstall unnecessary components or applications, and configure network access policies for endpoints.