# 获取安全审计日志

> 全部文档的索引见 [llms.txt](https://ark.volcengine.com/llms.txt)；在任一文档页面地址后追加 `.md` 可获取该页的 Markdown 版本。

`POST https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01`

支持对安全相关事件进行查询和审计，当前可审计事件包括安全沙箱登录、安全沙箱对外连接、安全沙箱容器逃逸、vArmor 防护、KMS 访问、TKS 访问。

## 鉴权

本接口支持鉴权方式如下，详情请参见 [Base URL 及鉴权](/docs/base-url-and-authentication)。

* Access Key 鉴权，请在 [Access Key 管理](https://console.volcengine.com/iam/keymanage) 页面，获取 Access Key。本接口仅支持 Access Key 鉴权。

---

<span id="request-parameters"></span>
## 请求参数

### Body 参数

**Filter** `object` `必选` | 筛选条件

审计日志的筛选条件，可指定时间区间、风险等级、日志类型及自定义条件。

**LogType** `string` `必选` | 日志类型

`Filter.LogType`

待筛选的审计日志类型。取值 `SshLogin` 表示 SSH 登录安全沙箱、`ContainerLogin` 表示本地登录安全沙箱、`Connection` 表示安全沙箱对外网络连接、`ContainerBreakout` 表示安全沙箱容器逃逸、`VarmorDefence` 表示 vArmor 防护、`KMSAccess` 表示 KMS 访问、`TksAccess` 表示 Trusted Key Service（TKS）密钥访问。取值：`SshLogin` / `ContainerLogin` / `Connection` / `ContainerBreakout` / `VarmorDefence` / `KMSAccess` / `TksAccess` / `AuthStatistic` / `Auth`。

> **说明**
>
> `TksAccess` 当前为内测收费功能，如有需求请联系您的销售经理启用。

**Conditions** `object[]` | 自定义筛选条件

`Filter.Conditions`

自定义筛选条件列表，按字段、操作符、值组合过滤审计日志。

**Field** `string` `必选` | 字段名

`Filter.Conditions.Field`

用于筛选的字段名。

**Operator** `string` `必选` | 操作符

`Filter.Conditions.Operator`

筛选条件使用的比较操作符。

**Value** `string` `必选` | 筛选值

`Filter.Conditions.Value`

筛选条件用于比较的目标值。

**EndTime** `integer` | 结束时间

`Filter.EndTime`

查询时间区间的结束时间，Unix 时间戳（秒）。

**RiskLevels** `string[]` | 风险等级筛选

`Filter.RiskLevels`

按风险等级筛选的列表，命中其中任一等级的日志均会返回。取值 `Info` 表示正常事件、`Low` 表示低风险事件、`Medium` 表示中风险事件、`High` 表示高风险事件、`Critical` 表示严重风险事件。

**StartTime** `integer` | 起始时间

`Filter.StartTime`

查询时间区间的起始时间，Unix 时间戳（秒）。

**ResourceId** `string` `必选` | 资源 ID

被审计资源的 ID，需与 *ResourceType* 配合使用。当 *ResourceType* 为 `endpoint` 时填推理接入点 ID（形如 `ep-**************-*****`）；当 *ResourceType* 为 `modelcustomizationjob` 时填模型精调任务 ID（形如 `mcj-**************-*****`）。

**ResourceType** `string` `必选` | 资源类型

被审计资源的类型。取值 `endpoint` 表示推理接入点、`modelcustomizationjob` 表示模型精调任务。

**PageNumber** `integer` `默认值 1` | 起始页码

分页查询时的起始页码。

**最小值**：`1`

**PageSize** `integer` `默认值 10` | 每页记录数

分页查询时每页返回的记录数。

**取值范围**：`[1, 100]`

**ProjectName** `string` `默认值 default` | 项目名称

资源所属的项目名称。若资源不在默认项目中，需填写正确的项目名称。

**SortBy** `string` `默认值 Timestamp` | 排序指标

排序指标。当前仅支持按 `Timestamp`（审计行为发生时间）排序。

**SortOrder** `string` `默认值 Desc` | 排序顺序

排序顺序。取值 `Asc` 表示升序、`Desc` 表示降序。

## 响应参数

**Items** `object[]` | 日志列表

审计日志条目列表。每个元素包含一条审计日志的详细信息。

**LogContents** `object[]` | 日志字段内容

`Items.LogContents`

审计日志的字段内容列表。每个元素是一组 Key-Value，承载日志的结构化字段。

**Key** `string` | 字段名

`Items.LogContents.Key`

日志字段的键名，标识本条 Key-Value 承载的内容。常见取值包括 `Arguments`（带参数的完整命令）、`Command`（命令）、`Process`（进程名）、`Operation`（vArmor 防护日志的 hook 命令）、`SSH`（源/目标 IP 与端口四元组）、`Tag`（日志标签）等。

**Value** `string` | 字段值

`Items.LogContents.Value`

日志字段的取值，与 *Key* 配对。例如 *Key* 为 `Arguments` 时形如 `curl 192.168.0.1`；为 `Command` 时形如 `curl`；为 `Process` 时形如 `/usr/bin/curl`；为 `Operation` 时形如 `cat`；为 `SSH` 时形如 `192.168.0.1 8122 192.168.0.2 22`；为 `Tag` 时形如 `Docker`。

**LogDetail** `string` | 日志详情

`Items.LogDetail`

审计日志的详情描述。展现内容随 *LogType* 不同而不同：`SshLogin` 展示登录方式、源/目标 IP 与端口、进程 ID；`ContainerLogin` 展示登录方式、登录命令、源/目标 IP 与端口；`Connection` 展示连接类型、连接状态、源/目标 IP 与端口、进程名与进程 ID；`ContainerBreakout` 展示具体逃逸行为、命令、进程名与进程 ID；`VarmorDefence` 展示命令、进程名、进程 ID 及触发防护的 hook；`KMSAccess` 展示用户 ID、密钥名称、加解密对象与操作类型；`TksAccess` 展示对 TKS 密钥的访问方式（如 `CreateTksKey`、`GetTksKeyinfo`、`ExportTksPubKey`、`ExportTksKey`）。

**LogType** `string` | 日志类型

`Items.LogType`

审计日志类型。取值 `SshLogin` 表示 SSH 登录安全沙箱、`ContainerLogin` 表示本地登录安全沙箱、`Connection` 表示安全沙箱对外网络连接、`ContainerBreakout` 表示安全沙箱容器逃逸、`VarmorDefence` 表示 vArmor 防护、`KMSAccess` 表示 KMS 访问、`TksAccess` 表示 Trusted Key Service（TKS）密钥访问。取值：`SshLogin` / `ContainerLogin` / `Connection` / `ContainerBreakout` / `VarmorDefence` / `KMSAcess` / `TksAccess` / `AuthStatistic` / `Auth`。

> **说明**
>
> `TksAccess` 当前为内测收费功能，如有需求请联系您的销售经理启用。

**ResourceId** `string` | 资源 ID

`Items.ResourceId`

被审计资源的 ID，与 *ResourceType* 配合标识资源。推理接入点 ID 形如 `ep-**************-*****`；模型精调任务 ID 形如 `mcj-**************-*****`。

**ResourceType** `string` | 资源类型

`Items.ResourceType`

被审计资源的类型。取值 `endpoint` 表示推理接入点、`modelcustomizationjob` 表示模型精调任务。

**RiskLevel** `string` | 风险等级

`Items.RiskLevel`

审计事件的风险等级。取值 `Info` 表示正常事件、`Low` 表示低风险事件、`Medium` 表示中风险事件、`High` 表示高风险事件、`Critical` 表示严重风险事件。

**Timestamp** `string` | 发生时间

`Items.Timestamp`

审计行为发生的时间，格式为 ISO 8601。

**PageNumber** `integer` | 当前页码

当前返回结果对应的分页页码。

**PageSize** `integer` | 每页记录数

当前返回结果每页包含的记录数。

**TotalCount** `integer` | 日志总数

符合筛选条件的审计日志总条数。


## 代码示例

## 连接审计

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
  "ResponseMetadata": {
    "RequestId": "202407052034340071951971433E0B1D",
    "Action": "ListAuditLogs",
    "Version": "2024-01-01",
    "Service": "ark",
    "Region": "cn-beijing"
  },
  "Result": {
    "TotalCount": 1,
    "PageNumber": 1,
    "PageSize": 10,
    "Items": [
      {
        "ResourceId": "ep-**************-*****",
		"ResourceType": "endpoint",
		"LogType": "Connection",
		"LogDetail": "存在从安全沙箱容器向外进行网络连接的行为。连接类型:阻塞式;连接状态:成功;源 IP/端口: 192.168.0.1:50031;目标 IP/端口: 192.168.0.4:22;进程: curl;pid: 12345",
		"LogContents": [
			{
				"Key": "ProcessID",
				"Value": "12345"
			},
			{
				"Key": "SourceIP",
				"Value": "192.168.0.1"
			},
			{
				"Key": "SourcePort",
				"Value": "50031"
			},
			{
				"Key": "DestinationIP",
				"Value": "192.168.0.4"
			},
			{
				"Key": "DestinationPort",
				"Value": "22"
			},
			{
				"Key": "Tag",
				"Value": "Whitelisted,ConnectionSucceed,Blocking"
			},
			{
				"Key": "Process",
				"Value": "curl"
			}
		],
		"RiskLevel": "Info",
		"Timestamp": "2024-10-25T12:04:33Z"
      }
    ]
  }
}
```

## 容器逃逸

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
  "ResponseMetadata": {
    "RequestId": "202411071454251712321471146B325A",
    "Action": "ListAuditLogs",
    "Version": "2024-01-01",
    "Service": "ark",
    "Region": "cn-beijing"
  },
  "Result": {
    "TotalCount": 1,
    "PageNumber": 1,
    "PageSize": 10,
    "Items": [
      {
        "ResourceId": "ep-**************-*****",
        "ResourceType": "endpoint",
		"LogType": "ContainerBreakout",
		"LogDetail": "容器上存在连接 Metadata Server 的行为,疑似进行容器逃逸准备。用户: root;命令: curl;进程: /usr/bin/curl;pid: 13483",
		"LogContents": [
			{
				"Key": "Tag",
				"Value": "MetadataServer"
			},
			{
				"Key": "Command",
				"Value": "curl"
			},
			{
				"Key": "Username",
				"Value": "root"
			},
			{
				"Key": "ProcessID",
				"Value": "13483"
			},
			{
				"Key": "Process",
				"Value": "/usr/bin/curl"
			},
			{
				"Key": "SandboxType",
				"Value": "Inference"
			}
		],
		"RiskLevel": "Low",
		"Timestamp": "2024-10-25T12:03:36Z"
      }
    ]
  }
}
```

## 容器登录

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
  "ResponseMetadata": {
    "RequestId": "2024070520320624805701201829AFC4",
    "Action": "ListAuditLogs",
    "Version": "2024-01-01",
    "Service": "ark",
    "Region": "cn-beijing"
  },
  "Result": {
    "TotalCount": 1,
    "PageNumber": 1,
    "PageSize": 10,
    "Items": [
      {
        "ResourceId": "ep-**************-*****",
        "ResourceType": "endpoint",
        "LogType": "ContainerLogin",
        "LogDetail": "存在从本地节点登录到安全沙箱容器的行为。登录方式: Docker;登录命令: docker exec -it ***** bash;源 IP/端口: 192.168.0.1:50031;目标 IP/端口: 192.168.1.2:22",
        "LogContents": [
                    {
                        "Key": "Tag",
                        "Value": "Docker"
                    },
                    {
                        "Key": "Arguments",
                        "Value": "docker exec -it ***** bash"
                    },
                    {
                        "Key": "SSH",
                        "Value": "192.168.0.1 50031 192.168.1.2 22"
                    }
        ],
        "RiskLevel": "High",
        "Timestamp": "2024-10-25T12:05:36Z"
      }
    ]
  }
}
```

## KMS 访问

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
  "ResponseMetadata": {
    "RequestId": "20241107153632061174073005C37DD8",
    "Action": "ListAuditLogs",
    "Version": "2024-01-01",
    "Service": "ark",
    "Region": "cn-beijing"
  },
  "Result": {
    "TotalCount": 1,
    "PageNumber": 1,
    "PageSize": 10,
    "Items": [
      {
        "ResourceId": "ep-**************-*****",
        "ResourceType": "endpoint",
       		"LogType": "KMSAccess",
		"LogDetail": "请求 2100466578 用户的 datapipe_keyring/datapipe_key_ml_maas 密钥，对基座模型 doubao-pro-4k | 240909 进行信封解密",
		"LogContents": [
			{
				"Key": "DataType",
				"Value": "envelope"
			},
			{
				"Key": "RequestID",
				"Value": "20240909092241172013199191AABBCC"
			},
			{
				"Key": "CreateTime",
				"Value": "2024-09-09T09:22:41Z"
			},
			{
				"Key": "Operation",
				"Value": "decrypt"
			},
			{
				"Key": "ModelID",
				"Value": "doubao-pro-4k"
			},
			{
				"Key": "ModelVersion",
				"Value": "240909"
			},
			{
				"Key": "KmsAccountID",
				"Value": "2100466578"
			},
			{
				"Key": "KeyringName",
				"Value": "datapipe_keyring"
			},
			{
				"Key": "Phase",
				"Value": "inference"
			},
			{
				"Key": "ModelType",
				"Value": "base_model"
			},
			{
				"Key": "KeyName",
				"Value": "datapipe_key_ml_maas"
			}
		],
		"RiskLevel": "Info",
		"Timestamp": "2024-09-09T09:22:41Z"
       }
    ]
  }
}
```

## SSH 登录

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
  "ResponseMetadata": {
    "RequestId": "20240627101238231161005082456C1E",
    "Action": "ListAuditLogs",
    "Version": "2024-01-01",
    "Service": "ark",
    "Region": "cn-beijing"
  },
  "Result": {
    "TotalCount": 1,
    "PageNumber": 1,
    "PageSize": 10,
    "Items": [
      {
        "ResourceId": "ep-**************-*****",
        "ResourceType": "endpoint",
        "LogType": "SshLogin",
		"LogDetail": "存在通过未知源 ssh 登录安全沙箱容器的行为。源 IP/端口: 10.0.26.52:35024;目标 IP/端口: 10.0.26.52:12222;pid: 3058688",
		"LogContents": [
			{
				"Key": "Tag",
				"Value": "Unknown"
			},
			{
				"Key": "SSH",
				"Value": "10.0.26.52 35024 10.0.26.52 12222"
			},
			{
				"Key": "ProcessID",
				"Value": "3058688"
			},
			{
				"Key": "SandboxType",
				"Value": "DataPreprocess"
			}
		],
		"RiskLevel": "Medium",
		"Timestamp": "2024-09-29T11:38:34Z"
      }
    ]
  }
}
```

## TKS 访问

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
    "ResponseMetadata": {
        "RequestId": "202509221056016566EAF5A886F22633",
        "Action": "ListAuditLogs",
        "Version": "2024-01-01",
        "Service": "ark",
        "Region": "cn-beijing"
    },
    "Result": {
        "TotalCount": 89,
        "PageNumber": 1,
        "PageSize": 10,
        "Items": [
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "GetTksKeyinfo",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "GetTksKeyinfo"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:55:43Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "GetTksKeyinfo",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "GetTksKeyinfo"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:55:41Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "CreateTksKey",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "CreateTksKey"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:55:25Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "ExportTksPubKey",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "ExportTksPubKey"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:55:22Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "GetTksKeyinfo",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "GetTksKeyinfo"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:53:57Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "ExportTksKey",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "ExportTksKey"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:53:44Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "GetTksKeyinfo",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "GetTksKeyinfo"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:53:38Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "GetTksKeyinfo",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "GetTksKeyinfo"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:52:45Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "CreateTksKey",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "CreateTksKey"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:52:42Z"
            },
            {
                "ResourceId": "ep-**************-*****",
                "ResourceType": "endpoint",
                "LogType": "TksAccess",
                "LogDetail": "GetTksKeyinfo",
                "LogContents": [
                    {
                        "Key": "method",
                        "Value": "GetTksKeyinfo"
                    }
                ],
                "RiskLevel": "Info",
                "Timestamp": "2025-09-22T02:25:13Z"
            }
        ]
    }
}
```

## VarMor 防御

### cURL

#### Request

```bash
curl 'https://ark.cn-beijing.volcengineapi.com/?Action=ListAuditLogs&Version=2024-01-01' \
  -H 'Content-Type: application/json' \
  -H 'X-Date: <X-Date>' \
  -H 'X-Content-Sha256: <X-Content-Sha256>' \
  -H 'Authorization: HMAC-SHA256 Credential=<AK>/<X-Date>/cn-beijing/ark/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=<Signature>' \
  -d '{}'  # TODO 补 request body（备份原文无有效数据）
```

#### Response

```
{
  "ResponseMetadata": {
    "RequestId": "20241107144945135212178161E8A08E",
    "Action": "ListAuditLogs",
    "Version": "2024-01-01",
    "Service": "ark",
    "Region": "cn-beijing"
  },
  "Result": {
    "TotalCount": 1,
    "PageNumber": 1,
    "PageSize": 10,
    "Items": [
      {
        "ResourceId": "ep-**************-*****",
        "ResourceType": "endpoint",
		"LogType": "VarmorDefence",
		"LogDetail": "vArmor 成功拦截了一次风险操作。命令: cat;进程: /usr/bin/cat;pid: 3659428;触发 hook: open",
		"LogContents": [
			{
				"Key": "Command",
				"Value": "cat"
			},
			{
				"Key": "Operation",
				"Value": "open"
			},
			{
				"Key": "ProcessID",
				"Value": "3659428"
			},
			{
				"Key": "Process",
				"Value": "/usr/bin/cat"
			},
			{
				"Key": "SandboxType",
				"Value": "Inference"
			}
		],
		"RiskLevel": "Info",
		"Timestamp": "2024-10-25T12:05:36Z"
      }
    ]
  }
}
```