Log processing system and method, computer equipment and storage medium

Abstract

The invention relates to the technical field of cloud security, and discloses a log processing system and method, computer equipment and a storage medium, the system comprises a log management engine, a log processing engine and a queue: the log management engine is used for accessing a log of a single-point cloud native security product to a cloud platform; the log processing engine is used for receiving a log sent by the single-point cloud native security product; forwarding the log to a target queue; the queue is used for storing logs; and the log management engine is also used for providing statistical information query of logs for the platform type cloud native security product. The log processing engine forwards the logs to the target queue for storage, the log management engine provides a log query function, and the platform-type cloud native security product queries the target logs on the log management engine and consumes the target logs, so that the logs of all cloud native security products are observed and managed at a unified perspective, and the safety of the platform-type cloud native security products is improved. The method is suitable for various scenes such as online, iteration and offline of the security product, and the research and development efficiency of the security product is improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud security technology, and in particular to a log processing system, method, computer equipment and storage medium. Background Art

[0002] The development of platform-based cloud native security products relies on single-point cloud native security products to provide various data, such as logs, which is a typical type of data. From the perspective of the cloud platform, single-point cloud native security products and platform-based cloud native security products are both cloud native security products, and the two are parallel, not superior or subordinate. Therefore, when developing platform-based cloud native security products, they need to be connected with specific single-point cloud native security products. The launch of single-point cloud native security products is an ongoing process, with new products being launched continuously and logs of existing products being updated continuously.

[0003] In the related technologies, according to the existing docking method, a large amount of east-west data flow will appear, and it is impossible to flexibly respond to various scenarios such as the launch, iteration, and offline of security products. Summary of the invention

[0004] In view of this, the present invention provides a log processing system, method, computer device and storage medium to solve the problems existing in the connection between existing single-point cloud native security products and platform-type cloud native security products.

[0005] In a first aspect, the present invention provides a log processing system, the system comprising: a log management engine, a log processing engine and a queue:

[0006] A log management engine, for responding to a registration request of a single-point cloud native security product and connecting the log of the single-point cloud native security product to the cloud platform;

[0007] The log processing engine is set up on the cloud platform to receive logs sent by single-point cloud native security products; based on the logs, it forwards the logs to the target queue;

[0008] Queue, used to store logs;

[0009] The log management engine is also used to provide log statistics query for platform-based cloud native security products, so that platform-based cloud native security products can use logs.

[0010] In the present invention, a log processing system is composed of a log management engine, a log processing engine and a queue. A single-point cloud native security product is registered on the log management engine and sends the log to the log processing engine. The log processing engine forwards the log to the target queue for storage. The log management engine provides a log query function. The platform-type cloud native security product queries the target log on the log management engine and consumes the target log, thereby realizing the observation and management of the logs of all cloud native security products from a unified perspective, adapting to various scenarios such as the launch, iteration, and offline of security products, and improving the R&D efficiency of security products.

[0011] In an optional implementation, the log management engine is used to register the log ID of the single-point cloud native security product to the log management engine before the log of the single-point cloud native security product is accessed to the cloud platform, to determine the log access method, target queue information for log output, and log format of the single-point cloud native security product.

[0012] In this method, the log management engine registers the log ID of the single-point cloud native security product to the log management engine, determines the log access method, target queue information and log format of the single-point cloud native security product, and facilitates the log access management of the single-point cloud native security product.

[0013] In an optional implementation, the log management engine is also used to provide the platform-based cloud native security product with log ID, log access method, target queue information for log output, and statistical information on the log format, so that the platform-based cloud native security product can query the target log based on the statistical information; obtain the target log; and parse the target log based on the log format of the target log to obtain a parsing result.

[0014] In this method, the log management engine provides the platform-based cloud native security product with log ID, log access method, target queue information for log output, and statistical information on the log format. The platform-based cloud native security product can obtain the target log and parse the target log to obtain the parsing result, which makes it easier for the platform-based cloud native security product to query and consume the target log on the log management engine.

[0015] In an optional implementation, the log processing engine is also used to determine whether the log is registered in the log management engine based on the log ID and log access method of the log when receiving the log sent by the single-point cloud native security product; when the log is not registered in the log management engine, reject the log; when the log is registered in the log management engine, forward the log to the target queue according to the target queue information of the log output registered in the log management engine.

[0016] In this method, the log processing engine verifies the logs when receiving logs sent by single-point cloud native security products. Logs that have not been requested in the log management engine will be rejected. After receiving the logs, they will be forwarded to the target queue according to the log output queue information registered in the log management engine, further improving the security and reliability of log processing.

[0017] In a second aspect, the present invention provides a log processing method, which is applied to a log processing system as in any one of the first aspects, the system comprising: a log management engine, a log processing engine and a queue, and the method comprising:

[0018] Using the log management engine to respond to the registration request of the single-point cloud native security product, the log of the single-point cloud native security product is connected to the cloud platform;

[0019] Use the log processing engine to receive logs sent by single-point cloud-native security products;

[0020] Based on the log, forward the log to the target queue;

[0021] Use queues to store logs;

[0022] The log management engine is used to provide log statistical information query for platform-based cloud native security products, so that platform-based cloud native security products can use logs.

[0023] In the present invention, by utilizing a log processing system composed of a log management engine, a log processing engine and a queue, a single-point cloud native security product sends logs to the log processing engine, the log processing engine forwards the logs to the target queue for storage, the log management engine provides a log query function, and the platform-type cloud native security product queries the target logs on the log management engine and consumes the target logs, thereby realizing the observation and management of the logs of all cloud native security products from a unified perspective, adapting to various scenarios such as the launch, iteration, and offline of security products, and improving the research and development efficiency of all types of security products.

[0024] In an optional implementation, before the logs of the single-point cloud native security product are connected to the cloud platform, the method further includes:

[0025] Register the log ID of the single-point cloud native security product to the log management engine to determine the log access method, target queue information for log output, and log format of the single-point cloud native security product.

[0026] In this method, the log ID of the single-point cloud native security product is registered to the log management engine through the log management engine, and the log access method, target queue information and log format of the single-point cloud native security product are determined, so as to facilitate the log access management of the single-point cloud native security product, and then facilitate the forwarding of the log to the target queue, so that the platform-type cloud native security product can obtain the target log through the queue.

[0027] In an optional implementation, receiving a log sent by a single-point cloud native security product includes:

[0028] Based on the log ID and log access method of the log, determine whether the log is registered in the log management engine;

[0029] When the log is not registered in the log management engine, the log is rejected;

[0030] When a log is registered in the log management engine, the log will be forwarded to the target queue according to the target queue information of the log output registered in the log management engine.

[0031] In this method, the logs sent by single-point cloud native security products are verified through the log processing engine, and logs that have not been applied for in the log management engine will be rejected, further improving the security and reliability of log processing. After receiving the logs, they will be forwarded to the target queue according to the log output queue information registered in the log management engine, realizing the forwarding of logs to the target queue.

[0032] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the log processing method of the above-mentioned second aspect or any corresponding embodiment thereof by executing the computer instructions.

[0033] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the log processing method of the second aspect or any corresponding embodiment thereof.

[0034] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the log processing method of the second aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 Schematic diagram of the structure of a log processing system according to an embodiment of the present invention.

[0037] Figure 2 1 is a schematic diagram of the architecture of a log processing system for cloud-native security products according to an embodiment of the present invention.

[0038] Figure 3 The figure is a flow chart of a log processing method according to an embodiment of the present invention.

[0039] Figure 4 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0041] In related technologies, the development of platform-based cloud native security products relies on single-point cloud native security products to provide various data, such as logs, which are a typical type of data. From the perspective of the cloud platform, single-point cloud native security products and platform-based cloud native security products are both cloud native security products, and the two are in a parallel relationship, without a superior-female relationship. Therefore, when developing platform-based cloud native security products, they need to be connected with specific single-point cloud native security products. The launch of single-point cloud native security products is an ongoing process, new products will continue to be launched, and the logs of existing products will continue to be updated. According to the existing docking method, there will be a large number of east-west data flows, and it is impossible to flexibly respond to various scenarios such as the launch, iteration, and offline of security products.

[0042] To solve the above problems, a log processing system is provided in an embodiment of the present invention. The log processing system in this embodiment is suitable for the use scenario of cloud native security product development. The log processing system provided by the present invention is composed of a log management engine, a log processing engine and a queue. The single-point cloud native security product is registered on the log management engine, and the log is sent to the log processing engine. The log processing engine forwards the log to the target queue for storage. The log management engine provides a log query function. The platform-type cloud native security product queries the target log on the log management engine and consumes the target log, which realizes the observation and management of the logs of all cloud native security products from a unified perspective, adapts to various scenarios such as the launch, iteration, and offline of security products, and improves the research and development efficiency of security products.

[0043] According to an embodiment of the present invention, a log processing system embodiment is provided. Figure 1 is a schematic diagram of the structure of a log processing system according to an embodiment of the present invention. Figure 1 As shown, the system includes: a log management engine 1, a log processing engine 2 and a queue 3: the log management engine 1 is used to respond to the registration request of the single-point cloud native security product and connect the log of the single-point cloud native security product to the cloud platform; the log processing engine 2 is set on the cloud platform, and is used to receive the log sent by the single-point cloud native security product; based on the log, the log is forwarded to the target queue 3; the queue 3 is used to store the log; the log management engine 1 is also used to provide log statistical information query for the platform-type cloud native security product, so that the platform-type cloud native security product uses the log.

[0044] In an optional embodiment, the log management engine 1 is used to register the log ID of the single-point cloud native security product to the log management engine before the log of the single-point cloud native security product is accessed to the cloud platform, to determine the log access method, target queue information of the log output, and log format of the single-point cloud native security product.

[0045] In this method, the log management engine registers the log ID of the single-point cloud native security product to the log management engine, determines the log access method, target queue information and log format of the single-point cloud native security product, and facilitates the log access management of the single-point cloud native security product.

[0046] In an optional embodiment, the log management engine 1 is also used to provide the platform-based cloud native security product with log ID, log access method, target queue information for log output, and statistical information of the log format, so that the platform-based cloud native security product can query the target log based on the statistical information; obtain the target log; and parse the target log based on the log format of the target log to obtain the parsing result.

[0047] In this method, the log management engine provides the platform-based cloud native security product with log ID, log access method, target queue information for log output, and statistical information on the log format. The platform-based cloud native security product can obtain the target log and parse the target log to obtain the parsing result, which makes it easier for the platform-based cloud native security product to query and consume the target log on the log management engine.

[0048] In an optional embodiment, the log processing engine 2 is also used to determine whether the log is registered in the log management engine based on the log ID and log access method of the log when receiving the log sent by the single-point cloud native security product; when the log is not registered in the log management engine, reject the log; when the log is registered in the log management engine, forward the log to the target queue 3 according to the target queue information of the log output registered in the log management engine.

[0049] In this method, the log processing engine verifies the logs when receiving logs sent by single-point cloud native security products. Logs that have not been requested in the log management engine will be rejected. After receiving the logs, they will be forwarded to the target queue according to the log output queue information registered in the log management engine, further improving the security and reliability of log processing.

[0050] In one example, Figure 2 is a schematic diagram of the architecture of a log processing system for cloud-native security products according to an embodiment of the present invention. Figure 2 As shown, the log processing system for cloud-native security products is a set of middleware in the cloud platform, including: log management engine 1, log processing engine 2 and queue 3: log management engine 1 is responsible for managing the access and use of logs, and providing statistical information query for logs. Before accessing the logs, single-point cloud-native security products need to register the log ID, determine the access method, determine the log output queue, and determine the log format on the log management engine 1 in an offline manner. Access methods include but are not limited to: UDP port access and restful interface access, which are not limited in the present invention.

[0051] Log processing engine 2 is responsible for receiving logs and routing them to the target output queue. When receiving logs, log processing engine 2 verifies the tuple (log ID, log access method). Log processing engine 2 will refuse to receive logs that have not been applied for in the log management engine. After receiving the logs, log processing engine 2 will forward the logs to target queue 3 according to the log output queue information registered in log management engine 1.

[0052] Queue 3 is used to store logs for consumption by platform-based cloud-native security products.

[0053] The log processing system provided in this embodiment is composed of a log management engine, a log processing engine and a queue. The single-point cloud native security product is registered on the log management engine and sends the log to the log processing engine. The log processing engine forwards the log to the target queue for storage. The log management engine provides a log query function. The platform-type cloud native security product queries the target log on the log management engine and consumes the target log, thereby realizing the observation and management of the logs of all cloud native security products from a unified perspective, adapting to various scenarios such as the launch, iteration, and offline of security products, and improving the R&D efficiency of security products.

[0054] According to an embodiment of the present invention, a log processing method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0055] In this embodiment, a log processing method is provided, which can be used in the above-mentioned mobile terminals, such as mobile phones, tablet computers, etc. Figure 3 is a flow chart of a log processing method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0056] Step S301, register the log ID of the single-point cloud native security product to the log management engine, determine the log access method, target queue information and log format of the single-point cloud native security product.

[0057] In one example, the log management engine is responsible for managing the access and use of logs and providing log statistics query. Before accessing logs, single-point cloud native security products need to register the log ID, determine the access method, determine the log output queue, and determine the log format on the log management engine offline. Access methods include but are not limited to: UDP port access and restful interface access.

[0058] In this method, the log ID of the single-point cloud native security product is registered to the log management engine through the log management engine, and the log access method, target queue information and log format of the single-point cloud native security product are determined, so as to facilitate the log access management of the single-point cloud native security product, and then facilitate the forwarding of the log to the target queue, so that the platform-type cloud native security product can obtain the target log through the queue.

[0059] Step S302: Using the log management engine to respond to the registration request of the single-point cloud native security product, the log of the single-point cloud native security product is connected to the cloud platform.

[0060] Step S303: Use the log processing engine to receive logs sent by single-point cloud native security products.

[0061] Specifically, the above step S302 includes:

[0062] Step S3031, based on the log ID and log access method of the log, determine whether the log is registered in the log management engine.

[0063] Step S3032: When the log is not registered in the log management engine, the log is rejected.

[0064] Step S3033, when the log is registered in the log management engine, the log is forwarded to the target queue according to the target queue information of the log output registered in the log management engine.

[0065] In one example, the log processing engine is responsible for receiving logs and routing them to the target output queue. When receiving logs, the tuple (log ID, log access method) is verified. Logs that have not been applied for in the log management engine will be rejected. After receiving the logs, they will be forwarded to the target queue according to the log output queue information registered in the log management engine.

[0066] In this method, the logs sent by single-point cloud native security products are verified through the log processing engine, and logs that have not been applied for in the log management engine will be rejected, further improving the security and reliability of log processing. After receiving the logs, they will be forwarded to the target queue according to the log output queue information registered in the log management engine, realizing the forwarding of logs to the target queue.

[0067] Step S304: forward the log to the target queue based on the log.

[0068] Step S305: Use a queue to store logs.

[0069] Step S306, using the log management engine to provide log statistical information query for the platform-based cloud native security product, so that the platform-based cloud native security product uses the log.

[0070] In an implementation scenario, a single-point cloud native security product is referred to as A, and A generates logs; a platform-type cloud native security product is referred to as B, and B uses logs. The log processing methods for cloud native security products include:

[0071] Step 1: A registers the log ID as LOG_ID_A on the log management engine, determines the access method as UDP port access, determines the log output queue as CH_A, and registers the log format as FORMAT_A.

[0072] Step 2: A fills in the fields in the log according to the information determined in step 1 and sends the log to the specified UDP port.

[0073] Step 3: The log processing engine receives the log from the UDP port and confirms whether the receiving method is the UDP port according to the log ID LOG_ID_A. If not, the message is discarded directly. According to the target queue information determined in step 1, the log is forwarded to CH_A.

[0074] Step 4: B queries the log management engine and determines that the ID of the log to be used is LOG_ID_A, the queue where the log is located is CH_A, and the log format is FORMAT_A.

[0075] Step 5: B consumes the CH_A queue, obtains logs, and parses the logs according to the FORMAT_A format determined in step 4.

[0076] The log processing method provided in this embodiment utilizes a log processing system composed of a log management engine, a log processing engine and a queue. The single-point cloud native security product sends the log to the log processing engine, and the log processing engine forwards the log to the target queue for storage. The log management engine provides a log query function. The platform-type cloud native security product queries the target log on the log management engine and consumes the target log. This realizes the observation and management of the logs of all cloud native security products from a unified perspective, adapts to various scenarios such as the launch, iteration, and offline of security products, and improves the research and development efficiency of all types of security products.

[0077] The embodiment of the present invention also provides a computer device for executing the above Figure 3 The log processing method shown.

[0078] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0079] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0080] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0081] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0082] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0083] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.

[0084] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0085] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0086] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0087] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A log processing system, characterized in that: The system includes: a log management engine, a log processing engine and a queue: The log management engine is used to connect the log of the single-point cloud native security product to the cloud platform in response to a registration request of the single-point cloud native security product; The log processing engine is arranged on the cloud platform, and is used to receive the log sent by the single-point cloud native security product; based on the log, forward the log to a target queue; The queue is used to store the log; The log management engine is also used to provide statistical information query of the log for the platform-type cloud-native security product, so that the platform-type cloud-native security product uses the log.

2. The system according to claim 1, characterized in that The log management engine is used to register the log ID of the single-point cloud native security product to the log management engine before the log of the single-point cloud native security product is connected to the cloud platform, and determine the log access method, target queue information and log format of the single-point cloud native security product.

3. The system according to claim 2, characterized in that The log management engine is also used to provide the platform-based cloud native security product with the log ID, log access method, target queue information for log output, and statistical information on the log format, so that the platform-based cloud native security product can query the target log based on the statistical information; obtain the target log; and parse the target log based on the log format of the target log to obtain a parsing result.

4. The system according to claim 2, characterized in that The log processing engine is further used to determine whether the log is registered in the log management engine based on the log ID and log access method of the log when receiving the log sent by the single-point cloud native security product; When the log is not registered in the log management engine, the log is rejected; when the log is registered in the log management engine, the log is forwarded to the target queue according to the target queue information of the log output registered in the log management engine.

5. A log processing method, characterized in that: Applied to the log processing system according to any one of claims 1 to 4, the system comprises: a log management engine, a log processing engine and a queue, and the method comprises: Using the log management engine to respond to a registration request of a single-point cloud native security product, the log of the single-point cloud native security product is connected to the cloud platform; Using the log processing engine, receiving the logs sent by the single-point cloud native security product; Based on the log, forward the log to a target queue; Using the queue to store the log; The log management engine is used to provide statistical information query of the log for the platform-based cloud-native security product, so that the platform-based cloud-native security product uses the log.

6. The method according to claim 5, characterized in that Before the log of the single-point cloud native security product is connected to the cloud platform, the method further includes: Register the log ID of the single-point cloud native security product to the log management engine to determine the log access method, target queue information for log output, and log format of the single-point cloud native security product.

7. The method according to claim 6, characterized in that The receiving the log sent by the single-point cloud native security product includes: Based on the log ID and log access method of the log, determining whether the log is registered in the log management engine; When the log is not registered in the log management engine, rejecting the log; When the log is registered in the log management engine, the log is forwarded to the target queue according to the target queue information of the log output registered in the log management engine.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the log processing method according to any one of claims 5 to 7 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the log processing method according to any one of claims 5 to 7.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the log processing method according to any one of claims 5 to 7.

Images