Domain name for API request: tcss.intl.tencentcloudapi.com.
This API is used to query the details of a high-risk syscall event.
A maximum of 20 requests can be initiated per second for this API.
The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.
| Parameter Name | Required | Type | Description |
|---|---|---|---|
| Action | Yes | String | Common Params. The value used for this API: DescribeRiskSyscallDetail. |
| Version | Yes | String | Common Params. The value used for this API: 2020-11-01. |
| Region | No | String | Common Params. This parameter is not required. |
| EventId | Yes | String | Unique event ID |
| Parameter Name | Type | Description |
|---|---|---|
| EventBaseInfo | RunTimeEventBaseInfo | Basic information of the event |
| ProcessInfo | ProcessDetailInfo | Process information |
| ParentProcessInfo | ProcessDetailBaseInfo | Parent process information |
| EventDetail | RiskSyscallEventDescription | Event description |
| AncestorProcessInfo | ProcessBaseInfo | Ancestor process information |
| RequestId | String | The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem. |
This example shows you how to query details of a high-risk system call event at runtime.
POST / HTTP/1.1
Host: tcss.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeRiskSyscallDetail
<Common request parameters>
{
"EventId": "ad134-cdadfa"
}
{
"Response": {
"AncestorProcessInfo": {
"ProcessParam": "containerd --config /var/run/docker/containerd/containerd.toml --log-level warn",
"ProcessPath": "/usr/bin/containerd",
"ProcessStartUser": "0",
"ProcessUserGroup": "0"
},
"EventBaseInfo": {
"ClientIP": "175.178.113.111",
"ClusterID": "cls-demo1",
"ClusterName": "web-demo",
"ContainerId": "75D3326A-9B9C-4275-895A-16FDA1*****",
"ContainerIsolateOperationSrc": "ContainerIsolateOperationSrc",
"ContainerName": "/k8s_xenon_mysql-tce-cwp-mysql-2_sso_c9fdfba4-e31a-46bc-a43a-****",
"ContainerNetStatus": "NORMAL",
"ContainerNetSubStatus": "NONE",
"EventCount": 130,
"EventId": "5124493",
"EventName": "High-risk syscall"
"EventType": "RISK_SYSCALL_EVENT_TYPE",
"FoundTime": "2024-10-23 00:05:17",
"HostID": "11141114-66fd-4171-93eb-2f4fc36ef1e1",
"HostIP": "10.0.0.105",
"ImageId": "sha256:11141114e95dce36e8455cf657e1e54d74bb8fac6111411141114",
"ImageName": "registry.tce.com/service-vendors/mysql-xenon:8.0.32-20240524-155426-11141114.rhel.amd64",
"LatestFoundTime": "2024-10-23 17:02:47",
"Namespace": "default",
"NodeID": "pod-dj4xjf***",
"NodeName": "tcs-10-0-0-105",
"NodeSubNetCIDR": "fe80::8132:1b51:5********",
"NodeSubNetID": "subnet-dfj4***",
"NodeSubNetName": "default",
"NodeType": "NORMAL",
"NodeUniqueID": "node-4jfjfgdnvnd****",
"PodIP": "10.0.0.11",
"PodName": "demonset",
"PodStatus": "running",
"Status": "EVENT_UNDEAL",
"WorkloadType": "StatefulSet"
},
"EventDetail": {
"Description": "sergid can cause permission change for the running process account, which may pose a security risk"
"OperationTime": "1970-01-01 00:00:01",
"Remark": "user config",
"Solution": "Using potentially risky system calls may cause container escape. It is advisable to forbid containers from using uncommon system calls and apply timely updates to the host machine's system vulnerabilities."
"SyscallName": "chroot"
},
"ParentProcessInfo": {
"ProcessId": 330852,
"ProcessName": "containerd-shim",
"ProcessParam": "containerd-shim -namespace moby -workdir /data/kubernetes/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/ /var/run/docker/runtime-runc",
"ProcessPath": "/usr/bin/containerd-shim",
"ProcessStartUser": "root",
"ProcessUserGroup": "root"
},
"ProcessInfo": {
"ProcessAuthority": "-rwxr-xr-x",
"ProcessId": 2907621,
"ProcessMd5": "8a5772dee965c8223aebc1225e*****",
"ProcessName": "xenoncli",
"ProcessParam": "xenoncli xenon ping",
"ProcessPath": "/usr/local/bin/xenoncli",
"ProcessStartUser": "root",
"ProcessTree": "xenoncli(2907621)|containerd-shim(330852)|containerd(17863)|dockerd(17838)|systemd(1)",
"ProcessUserGroup": "0"
},
"RequestId": "d1dd6ed1-0424-4dc8-a3e1-*******"
}
}
TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.
The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.
| Error Code | Description |
|---|---|
| AuthFailure | A CAM signature/authentication error occurred. |
| FailedOperation.DataValueNotCorrect | The response data value is incorrect. |
| InternalError | An internal error occurred. |
| InvalidParameter | The parameter is incorrect. |
| InvalidParameter.InvalidFormat | The parameter format is incorrect. |
| InvalidParameter.MissingParameter | The required parameter is missing. |
| InvalidParameterValue | The parameter value is incorrect. |
| InvalidParameterValue.DataNotFound | The current data was not found. |
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback