Docs

Torch Log Service

Cloud security center log collection

Collect Cloud Security Center logs

This document introduces the functions and collection methods related to Cloud Security Center logs.

Features overview

Cloud Security Center is a comprehensive security solution designed around workloads, providing comprehensive protection for hosts and containers. It meets high-standard security requirements for server workloads in Hybrid Cloud and multi-cloud data center infrastructures, offering consistent monitoring and management capabilities for various hosts and containers.

After Cloud Security Center is integrated with TLS, it provides precise, real-time log auditing and efficient analysis capabilities. Combined with a powerful SQL syntax analysis tool, it enables flexible report customization and alert settings, allowing for in-depth data analysis and monitoring.

The related configuration is as follows:

Configuration	Description
Log type	Security alert log. Vulnerability scan log. Login audit log. Command execution log. Port change log.
Log storage location	After purchasing TLS in the cloud security platform and enabling log analysis, the corresponding project and log topic are automatically created in TLS. For details on managing log resources, please refer to Manage Cloud Security Center log resources. Project: volc-csc-xxxx Log topic: Process start/command execution log: csc-process-start-xxxx Login audit log: csc-login-xxxx Alert log: csc-alarm-xxxx Port change log: csc-port-change-xxxx Vulnerability record log: csc-vuln-xxxx
Log storage period	Port change logs have a default log storage period of 1 day. Other logs have a default log storage period of 180 days.
Log shards	Two shards are preset. The auto split log topic shard feature is not enabled.
Index settings	Auto-configured index.
Log fields	For a detailed list of log fields, refer to Cloud Security Center log fields.

Collect Cloud Security Center logs

For usage restrictions, log collection instructions, and other information, refer to Log analysis.

Cloud Security Center log fields

Alert log fields

The following are common fields for alerts. For details, refer to Log analysis.

Field	Description
rule_name	Alert name.
hostname	Affected assets.
in_ipv4_list	Internal IPv4 list.
ex_ipv4_list	External IPv4 list.
in_ipv6_list	Internal IPv6 list.
ex_ipv6_list	Public IPv6 list.
alert_type	Alert type: Brute-force attack, privilege escalation attack, backdoor persistence, polymorphic trojan, malicious destruction. Static detection, kill chain, exploratory intrusion, code execution, credential theft. Asset discovery, information gathering, lateral movement, covert tunnel, data exfiltration. User-defined, code execution, abnormal file read/write, abnormal network, directory traversal. Abnormal behavior sequence, abnormal behavior, SQL injection, algorithm kill chain.
alert_type_us	Alert type (English).
harm_level	Severity (critical/high/medium/low).
agent_id	Host agent_id.
tags	Host tag.
alert_desc	Alert description.
alert_desc_us	Alert description (English).
suggestion	Remediation recommendation.
data_type	Data type.
attack_id	ATTCK ID.
os_type	linux/windows.
timestamp	Alert generation timestamp.
__insert_time	Alert insertion timestamp.

Vulnerability log fields

Field	Description
account_id	Account ID.
agent_id	Host ID.
region	Host region.
internet_ip	Host public IP.
intranet_ip	Host primary private network IP.
instance_name	Instance name.
op	Vulnerability operation: add: Detected vulnerability unprocessed: Unprocessed processed: Processed ignored: Ignored
level	Vulnerability severity: danger: Critical high: High mid: Medium low: Low
vuln_id	Vulnerability ID.
vuln_name	Vulnerability name.
vuln_type	Vulnerability type: linux, windows, app, webcms.
action	Vulnerability exploitability level: block: Highly exploitable vulnerability visible: Exploitable vulnerability invisible: Vulnerability that is difficult to exploit
cve_id	Vulnerability CVE number.
tag	Vulnerability tags.
create_time	Vulnerability creation timestamp.
control_time	Vulnerability operation timestamp.

Last updated: 2026.03.25 18:32:17