You need to enable JavaScript to run this app.
Torch Log Service

Torch Log Service

Copy page
Download PDF
Multi-cloud security platform log collection
Collect multi-cloud security platform logs
Copy page
Download PDF
Collect multi-cloud security platform logs
This document introduces the features and collection methods related to multi-cloud security platform logs.​
Features overview​
Volcengine Multi-Cloud Security Platform provides enterprise customers with a SaaS-based, one-stop multi-cloud security management service, enhancing customers' security in network protection, compliance, and data loss prevention, and supporting healthy, high-quality business development in the multi-cloud era.​
Multi-cloud platform log management relies on Volcengine TLS to provide log query and analysis functionality. You can perform log query and analysis based on the platform's preset index fields and locate corresponding logs according to specified conditions.​
The related configuration is as follows:​
​
Configuration​
Description​
Log type​
Multi-cloud security platform logs.​
Log storage location​
After enabling the log service in the multi-cloud security platform, the corresponding project and log topics are automatically created in TLS. For details on managing log resources, please refer to Managing multi-cloud security platform log resources.​
  • Project: mcs-project-<account_id>-<region_id>​
  • Log topics:​
  • ocsf-other-activity​
  • ocsf-discovery​
  • ocsf-application-activity​
  • ocsf-findings​
  • ocsf-system-activity​
  • ocsf-identity-and-access-management​
  • ocsf-network-activity​
Log storage period​
  • The default is 30 days.​
Log shards​
  • 10 shards are preset.​
  • Auto split of log topic shards is enabled by default. When write traffic is high, shards are split to meet data write requirements.​
Index settings​
Indexes are configured automatically.​
Log fields​
For a detailed list of log fields, please refer to Multi-cloud security platform log fields.​
​
Collect multi-cloud security platform logs​
For usage restrictions and the process of enabling multi-cloud security platform logs in TLS, please refer to Log management overview.​
Multi-cloud security platform log fields​
The multi-cloud security platform log module involves the following log topics. For details on log fields, please refer to Log topics and field descriptions.​
​
Topic​
Description​
OCSF-Findings​
OCSF-Findings events are reported for discovery, detection, Exception, alert, or other operations performed by security protection products.​
OCSF-System-Activity​
OCSF-System-Activity reports system activity events.​
  • File system activity.​
  • Kernel extension activity.​
  • Storage activity.​
OCSF-Network-Activity​
OCSF-Network-Activity reports network activity events.​
  • Network activity: network connection status, traffic conditions, and more.​
  • HTTP activity: HTTP connection and traffic information.​
  • Email activity.​
  • FTP activity: File transfers between server and client, and so on.​
OCSF-Application-Activity​
Details of behavioral information reported by OCSF-Application-Activity for applications and services.​
  • Web resource activity: Actions performed on web resources.​
  • Application lifecycle: Installation, removal, activation, and stopping of applications or services.​
  • API activity: Creation, reading, updating, and deletion of APIs.​
  • Web resource access activity: Successful or failed attempts to access web resources via HTTP, and so on.​
​
​
Last updated: 2026.02.06 10:12:25