Docs

Torch Log Service

NTA log collection

Collect NTA logs

This topic describes features and collection methods for NTA logs.

Features overview

Volcengine Network Traffic Analysis System (NTA) is a SaaS-based full traffic threat detection system focused on offense and defense, leveraging out-of-band traffic. It employs behavioral analysis, signature detection, correlation analysis, threat intelligence, and machine learning to accurately identify both known advanced network attacks and unknown new intrusion threats.

NTA audits and stores all alert logs and traffic logs. It also supports storing alert data packets. Alert logs are kept for 180 days to meet compliance requirements.

Alert log: Alert logs of all network attacks detected by NTA via network traffic.

Traffic log: Logs of access behavior for all cloud assets entering or leaving the internet, recorded by NTA.

The related configuration is as follows:

Configuration	Description
Log type	Alert logs. Traffic logs.
Log storage location	After NTA enables log management, TLS automatically creates a project and a topic for logs. For details about managing log resources, see Manage NTA log resources. Project: nta-project--<account_id>-<region_id> Topic: nta-log
Log storage period	The default value is 180 days.
Log shards	Preset to 9 shards. Auto split for log topic shards is enabled by default. When the write traffic increases rapidly, shards are split to meet data writing requirements.
Index settings	Configure indexes are automatically configured.
Log fields	For a detailed list of log fields, see NTA log fields.

Collect NTA logs

For usage restrictions and steps to enable collection of NTA logs to TLS, see Log Analysis.

NTA log fields

The advanced network threat detection system records detailed network traffic logs and attack alert logs. The logs contain multiple fields. You can select the relevant log fields as needed for query and analysis.

Log fields	Description
timestamp	Log reporting time.
log_type	Log type. Log type includes session (Internet perimeter traffic log), alert (Internet perimeter alert log), and vpc_alert (VPC alert log).
src_ip	Source IP address.
src_port	Source port.
dst_ip	Target IP.
dst_port	Target port.
dir_flag	Internet boundary access direction: in (inbound) / out (outbound).
country_name	Country or region of the external IP.
province_name	City where the external IP is located.
asset_name	Name of the asset in internet boundary traffic.
app_protocol	Application or transport layer protocol, such as HTTP, FTP, TCP, etc.
protocol	IP protocol type, such as tcp/udp/icmp.
host	The requested domain.
session_begintime	Start time of access.
session_endtime	End time of access.
reqpkts	Number of request packets.
rsppkts	Number of response packets.
reqflow	Request traffic (bytes).
rspflow	Response traffic (bytes).
src_vpc	Source vpc id or dcgw id for vpc traffic
dst_vpc	Target vpc id or dcgw id for vpc traffic.
src_vpc_name	Source vpc name or dcgw name for vpc traffic.
dst_vpc_name	Target vpc name or dcgw name for vpc traffic.
alert_basetype	Detection source of intrusion prevention alarm
rule_type	Threat type of intrusion prevention alarm.
sub_type	Detailed threat type of intrusion prevention alarm.
rule_thread_level	Risk level of intrusion prevention alarm.
payload_ascii	Attack payload.
hidsinfo_json	Mining alert associated host process information.
uri	Request path.
httpstat	HTTP response status code.
attack_result	Intrusion prevention alert attack result: success, failure, attempt, interception, or compromised.

Last updated: 2026.06.18 15:16:16