diff options
| author | Zhineng Li <im@zhineng.li> | 2026-07-12 17:11:17 +0800 |
|---|---|---|
| committer | Zhineng Li <im@zhineng.li> | 2026-07-12 17:11:17 +0800 |
| commit | 1c7f908ce09f98fdcbf79ed2a8ae21be60eaa634 (patch) | |
| tree | 5f0857666365b7e40cdaa3733ebe1f3ba9e13c67 /data/en_us/cloud-siem/2022-06-16/api-docs.php | |
| parent | 7347bac4ab7e136157fc94777e6cf87ef9e08599 (diff) | |
| download | afterglow-metadata-full-1c7f908ce09f98fdcbf79ed2a8ae21be60eaa634.tar.gz afterglow-metadata-full-1c7f908ce09f98fdcbf79ed2a8ae21be60eaa634.zip | |
update APIs 20260712
Diffstat (limited to 'data/en_us/cloud-siem/2022-06-16/api-docs.php')
| -rw-r--r-- | data/en_us/cloud-siem/2022-06-16/api-docs.php | 24296 |
1 files changed, 8848 insertions, 15448 deletions
diff --git a/data/en_us/cloud-siem/2022-06-16/api-docs.php b/data/en_us/cloud-siem/2022-06-16/api-docs.php index 3739556..d680c6a 100644 --- a/data/en_us/cloud-siem/2022-06-16/api-docs.php +++ b/data/en_us/cloud-siem/2022-06-16/api-docs.php @@ -1,855 +1,416 @@ <?php return [ 'version' => '1.0', - 'info' => [ - 'style' => 'RPC', - 'product' => 'cloud-siem', - 'version' => '2022-06-16', - ], + 'info' => ['style' => 'RPC', 'product' => 'cloud-siem', 'version' => '2022-06-16'], 'directories' => [ [ - 'id' => 187571, - 'title' => 'Multi-account Management', + 'children' => ['ListRdUsers'], 'type' => 'directory', + 'title' => 'Multi-account management', + ], + [ 'children' => [ - 'ListRdUsers', + 'ListAccountsByLog', 'DescribeUserBuyStatus', 'ListProjectLogStores', 'ModifyDataSource', 'ModifyDataSourceLog', 'ModifyBindAccount', 'ListImportedLogsByProd', 'ListDataSourceTypes', 'ListDataSourceLogs', 'ListBindDataSources', 'ListAllProds', 'EnableServiceForCloudSiem', 'EnableAccessForCloudSiem', 'DescribeServiceStatus', 'DescribeProdCount', 'DescribeImportedLogCount', 'DescribeDataSourceParameters', 'DescribeDataSourceInstance', 'DescribeAuth', 'DeleteBindAccount', + 'BindAccount', 'AddUserSourceLogConfig', 'AddDataSourceLog', 'ListBindAccount', 'ListAccountAccessId', 'SubmitImportLogTasks', ], + 'type' => 'directory', + 'title' => 'Log access', ], [ - 'id' => 187473, - 'title' => 'Log Management', + 'children' => ['DescribeAlertsWithEntity', 'DescribeAlerts', 'DescribeAlertSource', 'DescribeAlertsCount'], 'type' => 'directory', - 'children' => [ - 'ListAccountsByLog', - 'DescribeUserBuyStatus', - 'ListProjectLogStores', - 'ModifyDataSource', - 'ModifyDataSourceLog', - 'ModifyBindAccount', - 'ListImportedLogsByProd', - 'ListDataSourceTypes', - 'ListDataSourceLogs', - 'ListBindDataSources', - 'ListAllProds', - 'EnableServiceForCloudSiem', - 'EnableAccessForCloudSiem', - 'DescribeServiceStatus', - 'DescribeProdCount', - 'DescribeImportedLogCount', - 'DescribeDataSourceParameters', - 'DescribeDataSourceInstance', - 'DescribeAuth', - 'DeleteDataSourceLog', - 'DeleteDataSource', - 'DeleteBindAccount', - 'BindAccount', - 'AddUserSourceLogConfig', - 'AddDataSourceLog', - 'AddDataSource', - 'ListBindAccount', - 'ListAccountAccessId', - 'SubmitImportLogTasks', - ], + 'title' => 'Security alerts', ], [ - 'id' => 186523, - 'title' => 'Alert Monitoring', + 'children' => ['ListEntities', 'DescribeEntityInfo', 'PostEventDisposeAndWhiteruleList', 'DescribeWafScope', 'DescribeEventDispose', 'DescribeEventCountByThreatLevel', 'DescribeDisposeAndPlaybook', 'DescribeCloudSiemEvents', 'DescribeCloudSiemEventDetail', 'DescribeCloudSiemAssetsCounter', 'DescribeCloudSiemAssets', 'DescribeAlertsWithEvent', 'DescribeAlertSourceWithEvent'], 'type' => 'directory', - 'children' => [ - 'DescribeAlertsWithEntity', - 'DescribeAlerts', - 'DescribeAlertSource', - 'DescribeAlertsCount', - ], + 'title' => 'Event handling', ], [ - 'id' => 186560, - 'title' => 'Event Response', + 'children' => ['DescribeAlertType', 'DeleteCustomizeRule', 'DescribeAggregateFunction', 'DescribeCustomizeRuleCount', 'DescribeCustomizeRuleTest', 'DescribeCustomizeRuleTestHistogram', 'DescribeLogFields', 'DescribeLogSource', 'DescribeLogType', 'DescribeOperators', 'ListCloudSiemCustomizeRules', 'ListCloudSiemPredefinedRules', 'ListCustomizeRuleTestResult', 'PostCustomizeRule', 'PostCustomizeRuleTest', 'PostFinishCustomizeRuleTest', 'PostRuleStatusChange'], 'type' => 'directory', - 'children' => [ - 'ListEntities', - 'DescribeEntityInfo', - 'PostEventDisposeAndWhiteruleList', - 'DescribeWafScope', - 'DescribeEventDispose', - 'DescribeEventCountByThreatLevel', - 'DescribeDisposeAndPlaybook', - 'DescribeCloudSiemEvents', - 'DescribeCloudSiemEventDetail', - 'DescribeCloudSiemAssetsCounter', - 'DescribeCloudSiemAssets', - 'DescribeAlertsWithEvent', - 'DescribeAlertSourceWithEvent', - ], + 'title' => 'Rule management', ], [ - 'id' => 186542, - 'title' => 'Rule Management', + 'children' => ['DescribeScopeUsers', 'DeleteAutomateResponseConfig', 'DescribeAutomateResponseConfigCounter', 'DescribeAutomateResponseConfigFeature', 'ListAutomateResponseConfigs', 'PostAutomateResponseConfig', 'UpdateAutomateResponseConfigStatus'], 'type' => 'directory', - 'children' => [ - 'DescribeAlertType', - 'DeleteCustomizeRule', - 'DescribeAggregateFunction', - 'DescribeCustomizeRuleCount', - 'DescribeCustomizeRuleTest', - 'DescribeCustomizeRuleTestHistogram', - 'DescribeLogFields', - 'DescribeLogSource', - 'DescribeLogType', - 'DescribeOperators', - 'ListCloudSiemCustomizeRules', - 'ListCloudSiemPredefinedRules', - 'ListCustomizeRuleTestResult', - 'PostCustomizeRule', - 'PostCustomizeRuleTest', - 'PostFinishCustomizeRuleTest', - 'PostRuleStatusChange', - ], + 'title' => 'Response rules', ], [ - 'id' => 186597, - 'title' => 'Response Rules Management', + 'children' => ['ListDisposeStrategy', 'DescribeDisposeStrategyPlaybook'], 'type' => 'directory', - 'children' => [ - 'DescribeScopeUsers', - 'DeleteAutomateResponseConfig', - 'DescribeAutomateResponseConfigCounter', - 'DescribeAutomateResponseConfigFeature', - 'ListAutomateResponseConfigs', - 'PostAutomateResponseConfig', - 'UpdateAutomateResponseConfigStatus', - ], + 'title' => 'Handling center', ], [ - 'id' => 186605, - 'title' => 'Disposal Center', + 'children' => ['RestoreCapacity', 'GetCapacity', 'SetStorage', 'DescribeStorage', 'GetStorage'], 'type' => 'directory', - 'children' => [ - 'ListDisposeStrategy', - 'DescribeDisposeStrategyPlaybook', - ], + 'title' => 'Storage management', ], [ - 'id' => 186147, - 'title' => 'Storage Management', + 'children' => ['ListDelivery', 'OpenDelivery', 'CloseDelivery'], 'type' => 'directory', - 'children' => [ - 'RestoreCapacity', - 'GetCapacity', - 'SetStorage', - 'DescribeStorage', - 'GetStorage', - ], + 'title' => 'Delivery management', ], [ - 'id' => 186161, - 'title' => 'Delivery Management', + 'children' => ['UpdateWhiteRuleList', 'PostEventWhiteruleList', 'DescribeWhiteRuleList', 'DescribeAlertScene', 'DescribeAlertSceneByEvent', 'DeleteWhiteRuleList'], 'type' => 'directory', - 'children' => [ - 'ListDelivery', - 'OpenDelivery', - 'CloseDelivery', - ], + 'title' => 'Alert whitelisting', ], [ - 'id' => 186608, - 'title' => 'White Rule Management', + 'children' => ['AddDataSource', 'DeleteDataSource', 'DeleteDataSourceLog', 'GetEntitiyStat'], + 'title' => 'Others', 'type' => 'directory', - 'children' => [ - 'UpdateWhiteRuleList', - 'PostEventWhiteruleList', - 'DescribeWhiteRuleList', - 'DescribeAlertScene', - 'DescribeAlertSceneByEvent', - 'DeleteWhiteRuleList', - ], ], ], 'components' => [ 'schemas' => [], ], 'apis' => [ - 'ListRdUsers' => [ - 'summary' => 'Queries a list of Alibaba Cloud accounts that are added to the threat analysis feature for centralized management. These accounts can be used to perform operations supported by the threat analysis feature, such as adding logs and handling events.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'AddDataSource' => [ + 'summary' => 'Adds a data source to an attached multicloud account.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '154081', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListRdUsersResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'Joined' => [ - 'title' => '日志code。', - 'description' => 'Indicates whether the account is added to the threat analysis feature for centralized management. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'JoinedTime' => [ - 'description' => 'The time when the account was added to the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => '2013-10-01 00:00:00', - ], - 'DelegatedOrNot' => [ - 'title' => '是否被委派查看自己的资源', - 'description' => 'Indicates whether the account can be used to view the logs and alerts within the account.'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'MainUserId' => [ - 'title' => '购买威胁分析的云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXXX', - ], - 'SubUserId' => [ - 'title' => '威胁分析云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to perform operations supported by the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXX', - ], - 'SubUserName' => [ - 'title' => '威胁分析云账号名字。', - 'description' => 'The username of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxx', - ], - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - ], - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => '123xxxxxxxx'], ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Joined\\": true,\\n \\"JoinedTime\\": \\"2013-10-01 00:00:00\\",\\n \\"DelegatedOrNot\\": true,\\n \\"MainUserId\\": 0,\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxx\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListRdUsers', - ], - 'ListAccountsByLog' => [ - 'summary' => 'Query accounts by log.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'DataSourceType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- obs: Huawei Cloud Object Storage Service (OBS).'."\n" + ."\n" + .'- wafApi: Tencent Cloud Web Application Firewall (WAF) download API.'."\n" + ."\n" + .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'required' => false, 'example' => 'obs'], ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '196080', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', + [ + 'name' => 'DataSourceInstanceName', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'XX-Beijing-Kafka'], ], - ], - 'parameters' => [ [ - 'name' => 'ProdCode', + 'name' => 'DataSourceInstanceRemark', 'in' => 'formData', - 'schema' => [ - 'title' => '产品的code。', - 'description' => 'The code of the service.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'qcloud_waf', - ], + 'schema' => ['title' => '', 'description' => 'The remarks on the data source.', 'type' => 'string', 'required' => false, 'example' => 'XX Cloud Firewall Shanghai instance'], ], [ - 'name' => 'LogCodes', + 'name' => 'DataSourceInstanceParams', 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'title' => '日志code列表，json数组格式。', - 'description' => 'The codes of logs. The value is a JSON array.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The code of the log. The value is a JSON array.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["cloud_siem_hcloud_waf_alert_log"]', - ], - 'required' => true, - 'example' => '["cloud_siem_hcloud_waf_alert_log"]', - 'maxItems' => 100, - ], + 'schema' => ['title' => '', 'description' => 'The parameters for the data source. The value must be a JSON array.', 'type' => 'string', 'required' => false, 'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]'], ], [ 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '多云的code。取值：'."\n" - .' - hcloud：华为云。'."\n" - .' - qcloud：腾讯云。 '."\n" - .' - aliyun：阿里云。', - 'description' => 'The code that is used for multi-cloud environments.'."\n", + 'title' => '', + 'description' => 'The code for the multicloud service.', 'type' => 'string', 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: For assets in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: For assets in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListAccountsByLogResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<AddDataSourceResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'SubUserId' => [ - 'title' => '威胁分析云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account for which the threat analysis feature is enabled.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXX', - ], - 'MainUserId' => [ - 'title' => '购买威胁分析的云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXXX', - ], - 'AccountId' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'AccountName' => [ - 'title' => '云账号名称。', - 'description' => 'The name of the cloud account.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxx', - ], - 'Imported' => [ - 'title' => '该账号是否已经接入。取值：'."\n" - .' -1：已接入。'."\n" - .' -0：未接入。', - 'description' => 'Indicates whether the account is added. Valid values: -1: yes -0: no'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '123xxxxxxx', - ], - 'LogCode' => [ - 'title' => '日志code。', - 'description' => 'The code of the log.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_waf_xxxxx', - ], - 'ProdCode' => [ - 'title' => '日志对应的产品code。', - 'description' => 'The code of the service.'."\n", - 'type' => 'string', - 'example' => 'qcloud_waf', - ], - ], + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'Count' => ['title' => '', 'description' => 'The number of data sources that were added. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis feature generates the ID by calculating an MD5 hash of the parameter values.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], ], + 'example' => '', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SubUserId\\": 0,\\n \\"MainUserId\\": 0,\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"AccountName\\": \\"sas_account_xxx\\",\\n \\"Imported\\": 0,\\n \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n \\"ProdCode\\": \\"qcloud_waf\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListAccountsByLog', - ], - 'DescribeUserBuyStatus' => [ - 'summary' => 'Checks whether the current Alibaba Cloud account or the management account of a resource directory is used to purchase the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'AddDataSource', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSource'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:AddDataSource', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'translator' => 'machine', + ], + 'AddDataSourceLog' => [ + 'summary' => 'Adds a log for a data source.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '157646', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'SubUserId', + 'name' => 'LogCode', 'in' => 'formData', - 'schema' => [ - 'title' => '阿里云账号', - 'description' => 'The ID of the Alibaba Cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123XXXXXX', - ], + 'schema' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_waf_xxxxx'], ], [ - 'name' => 'RegionId', + 'name' => 'DataSourceInstanceId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the data source. Threat Analysis calculates this ID as an MD5 hash value based on specific parameters. To obtain the data source ID, call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + ], + [ + 'name' => 'DataSourceInstanceLogs', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The details of the data source parameters. The value must be a JSON array.', 'type' => 'string', 'required' => true, 'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]'], + ], + [ + 'name' => 'AccountId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], + ], + [ + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" + 'title' => '', + 'description' => 'The code for the multicloud environment. Valid values:'."\n" ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management Center of Threat Analysis is deployed. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland and Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<UserBuyOrderStatusResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<AddDataSourceLogResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'MasterUserId' => [ - 'title' => '资源目录Master账号ID。', - 'description' => 'The ID of the management account of the resource directory.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXX', - ], - 'MasterUserName' => [ - 'title' => '资源目录Master账号显示名称。', - 'description' => 'The display name of the management account of the resource directory.'."\n", - 'type' => 'string', - 'example' => 'rd_master_xxx', - ], - 'MainUserId' => [ - 'title' => '购买威胁分析的阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXX', - ], - 'MainUserName' => [ - 'title' => '购买威胁分析的阿里云账号名称。', - 'description' => 'The username of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxx', - ], - 'SubUserId' => [ - 'title' => '当前登录阿里云账号ID。', - 'description' => 'The ID of the logon Alibaba Cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXX', - ], - 'SubUserName' => [ - 'title' => '当前登录阿里云账号名称。', - 'description' => 'The username of the logon Alibaba Cloud account.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxx', - ], - 'Capacity' => [ - 'title' => '购买威胁分析的SLS容量，单位GB。', - 'description' => 'The log storage capacity that is purchased for the threat analysis feature. Unit: GB.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1024', - ], - 'SasInstanceId' => [ - 'title' => '云安全中心实例ID。', - 'description' => 'The instance ID of Security Center.'."\n", - 'type' => 'string', - 'example' => 'sas-instance-xxxxx', - ], - 'CanBuy' => [ - 'title' => '当前账号是否可以进行威胁分析订单操作。取值：'."\n" - .' - true：可以购买、升级、变配等。'."\n" - .' - false：不可以操作威胁分析订单。', - 'description' => 'Indicates whether the logon Alibaba Cloud account can be used to place orders for the threat analysis feature, such as purchase, upgrade, and specifications change orders. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'EndTime' => [ - 'title' => '威胁分析到期时间，毫秒级时间戳。', - 'description' => 'The timestamp when the threat analysis feature expires. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1669823999000', - ], - 'DurationDays' => [ - 'title' => '距离威胁分析过期时间的天数。', - 'description' => 'The number of days before the expiration time of the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '3', - ], - 'RdOrder' => [ - 'title' => '是否是siem公测版订单。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], + 'Count' => ['title' => '', 'description' => 'The number of added logs. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. Threat Analysis calculates this ID as an MD5 hash value based on specific parameters.', 'type' => 'string', 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'], ], - 'title' => '请求返回值。', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '81D8EC0C-0804-51AD-8C38-17ED0BC74892', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"MasterUserId\\": 0,\\n \\"MasterUserName\\": \\"rd_master_xxx\\",\\n \\"MainUserId\\": 0,\\n \\"MainUserName\\": \\"sas_account_xxx\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxx\\",\\n \\"Capacity\\": 1024,\\n \\"SasInstanceId\\": \\"sas-instance-xxxxx\\",\\n \\"CanBuy\\": true,\\n \\"EndTime\\": 1669823999000,\\n \\"DurationDays\\": 3,\\n \\"RdOrder\\": 1\\n },\\n \\"RequestId\\": \\"81D8EC0C-0804-51AD-8C38-17ED0BC74892\\"\\n}","type":"json"}]', - 'title' => 'DescribeUserBuyStatus', - ], - 'ListProjectLogStores' => [ - 'summary' => 'Queries the dedicated Simple Log Service project and Logstore for a cloud service based on the patterns of the project and Logstore names.', - 'methods' => [ - 'get', - 'post', + 'title' => 'AddDataSourceLog', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSourceLog'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:AddDataSourceLog', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'AddUserSourceLogConfig' => [ + 'summary' => 'Adds a log collection task to import log data into Threat Analysis for alerting and event analysis.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ 'name' => 'SourceProdCode', 'in' => 'formData', - 'schema' => [ - 'title' => '待查询的产品code。', - 'description' => 'The code of the cloud service.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'sas', - ], + 'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => false, 'example' => 'sas'], ], [ 'name' => 'SourceLogCode', 'in' => 'formData', - 'schema' => [ - 'title' => '待查询的日志code。', - 'description' => 'The log code.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'cloud_siem_aegis_proc', - ], + 'schema' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_proc'], ], [ 'name' => 'SubUserId', 'in' => 'formData', - 'schema' => [ - 'title' => '待查询云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '123XXXXXXXX', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account for which you want to collect logs.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123XXXXXX'], + ], + [ + 'name' => 'SourceLogInfo', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The detailed information about the Simple Log Service (SLS) log to be collected. The value is a JSON string.', 'type' => 'string', 'required' => true, 'example' => '{"project":"wafnew-project-1335759343513432-cn-hangzhou","logStore":"wafnew-logstore","regionCode":"cn-hangzhou","prodCode":"waf"}'], + ], + [ + 'name' => 'DisPlayLine', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The detailed information about the SLS log to be collected.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai.siem-project.siem-logstore'], + ], + [ + 'name' => 'Deleted', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'Specifies whether to add or delete the log collection task. Valid values:'."\n" + ."\n" + .'- -1: Deletes the task.'."\n" + ."\n" + .'- 0: Adds the task.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the region where your assets reside. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListProjectLogStoreResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<UserSourceLogResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'Project' => [ - 'title' => 'sls的project名字。', - 'description' => 'The name of the Simple Log Service project.'."\n", - 'type' => 'string', - 'example' => 'cloud-siem-project', - ], - 'LogStore' => [ - 'title' => 'sls的logstore名字。', - 'description' => 'The name of the Simple Log Service Logstore.'."\n", - 'type' => 'string', - 'example' => 'cloud-siem-logstore', - ], - 'EndPoint' => [ - 'title' => 'sls的project的endpoint。', - 'description' => 'The endpoint of the Simple Log Service project.'."\n", - 'type' => 'string', - 'example' => 'cn-hangzhou.log.aliyuncs.com', - ], - 'RegionId' => [ - 'title' => 'sls的project所在的region。', - 'description' => 'The ID of the region in which the Simple Log Service project resides.'."\n", - 'type' => 'string', - 'example' => 'cn-hangzhou', - ], - 'LocalName' => [ - 'title' => 'sls的project所在的region名字。', - 'description' => 'The name of the region in which the Simple Log Service project resides.'."\n", - 'type' => 'string', - 'example' => 'hangzhou', - ], - 'MainUserId' => [ - 'title' => '购买威胁分析的阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXXX', - ], - 'SubUserId' => [ - 'title' => '威胁分析阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXX', - ], - 'SubUserName' => [ - 'title' => '威胁分析阿里云账号名字。', - 'description' => 'The username of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxxx', - ], - ], + 'title' => '', + 'description' => 'The return value of the request.', + 'type' => 'object', + 'properties' => [ + 'DiplayLine' => ['title' => '', 'description' => 'The detailed information about the SLS log.', 'type' => 'string', 'example' => 'cn-shanghai.siem-project.siem-logstore'], + 'SourceProdCode' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'example' => 'sas'], + 'SourceLogCode' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'example' => 'cloud_siem_aegis_proc'], + 'Displayed' => ['title' => '', 'description' => 'Indicates whether the details of the log collection task are returned. Valid values:', 'type' => 'boolean', 'example' => '0'], + 'Imported' => ['title' => '', 'description' => 'Indicates whether the log is collected. Valid values:', 'type' => 'boolean', 'example' => '0'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account for which the logs are collected.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'], + 'SubUserName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account for which the logs are collected.', 'type' => 'string', 'example' => 'sas_account_xxx'], ], + 'example' => '', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Project\\": \\"cloud-siem-project\\",\\n \\"LogStore\\": \\"cloud-siem-logstore\\",\\n \\"EndPoint\\": \\"cn-hangzhou.log.aliyuncs.com\\",\\n \\"RegionId\\": \\"cn-hangzhou\\",\\n \\"LocalName\\": \\"hangzhou\\",\\n \\"MainUserId\\": 0,\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxxx\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListProjectLogStores', - ], - 'ModifyDataSource' => [ - 'summary' => 'Modifies a data source that is added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'title' => 'AddUserSourceLogConfig', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddUserSourceLogConfig'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:AddUserSourceLogConfig', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"DiplayLine\\": \\"cn-shanghai.siem-project.siem-logstore\\",\\n \\"SourceProdCode\\": \\"sas\\",\\n \\"SourceLogCode\\": \\"cloud_siem_aegis_proc\\",\\n \\"Displayed\\": true,\\n \\"Imported\\": true,\\n \\"MainUserId\\": 0,\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxx\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'BindAccount' => [ + 'summary' => 'Binds a multicloud account from Multicloud Assets of Security Center to Threat Analysis.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -858,360 +419,370 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '194690', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'AccountId', - 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '123xxxxxx', - ], - ], - [ - 'name' => 'DataSourceType', - 'in' => 'formData', - 'schema' => [ - 'title' => '数据源类型。', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* ckafka: Tencent Cloud Kafka (CKafka)'."\n" - .'* obs: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'obs', - ], - ], - [ - 'name' => 'DataSourceInstanceId', + 'name' => 'AccessId', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [DescribeDataSourceInstance](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CDescribeDataSourceInstance) operation to query the IDs of data sources.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'schema' => ['title' => '', 'description' => 'The AccessKey ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => 'ABCXXXXXXXX'], ], [ - 'name' => 'DataSourceInstanceName', + 'name' => 'AccountName', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源名称。', - 'description' => 'The name of the data source.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'beijing_waf_kafka', - ], + 'schema' => ['title' => '', 'description' => 'The name of the multicloud account.', 'type' => 'string', 'required' => true, 'example' => 'xxxx'], ], [ - 'name' => 'DataSourceInstanceRemark', - 'in' => 'formData', - 'schema' => [ - 'title' => '数据源备注。', - 'description' => 'The remarks on the data source.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'waf_alert_log', - ], - ], - [ - 'name' => 'DataSourceInstanceParams', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源参数，json数组格式。', - 'description' => 'The parameters of the data source in the JSON string format.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], ], [ 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '多云的code。', + 'title' => '', 'description' => 'The code of the cloud service provider. Valid values:'."\n" ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", + .'- aliyun: Alibaba Cloud'."\n" + .'- hcloud: Huawei Cloud'."\n" + .'- qcloud: Tencent Cloud', 'type' => 'string', 'required' => true, + 'enumValueTitles' => [], + 'enum' => ['qcloud', 'hcloud'], 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is located. You must select a region for the data management center based on the region where your assets reside. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are deployed in the Chinese mainland or Hong Kong (China).'."\n" + .'- ap-southeast-1: Your assets are deployed in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member to whose view the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<ModifyDataSourceResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<BindAccountResult>', + 'description' => 'CloudSiemResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The detailed information returned by the Threat Analysis service.', 'type' => 'object', 'properties' => [ - 'Count' => [ - 'title' => '修改数据源的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of data sources that are modified. The value 1 indicates that the modification is successful, and a value less than or equal to 0 indicates that the modification failed.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'DataSourceInstanceId' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'Count' => ['title' => '', 'description' => 'The number of account bindings that are added.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], + 'example' => '', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ + 400 => [ + ['errorCode' => 'InvalidOperation', 'errorMessage' => 'access ak "%s" already bound.', 'description' => ''], + ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'BindAccount', + 'changeSet' => [ + ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:BindAccount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'BindAccount'], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ModifyDataSource', ], - 'ModifyDataSourceLog' => [ - 'summary' => 'Modifies the description of the logs that are added to the threat analysis feature for a data source within a cloud account.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'CloseDelivery' => [ + 'summary' => 'Stops log delivery from a connected cloud service. Once stopped, no new logs are added to your Logstore.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '154877', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ + 'name' => 'ProductCode', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The code of the cloud service. Valid values:'."\n" + ."\n" + .'- qcloud\\_waf'."\n" + ."\n" + .'- qlcoud\\_cfw'."\n" + ."\n" + .'- hcloud\\_waf'."\n" + ."\n" + .'- hcloud\\_cfw'."\n" + ."\n" + .'- ddos'."\n" + ."\n" + .'- sas'."\n" + ."\n" + .'- cfw'."\n" + ."\n" + .'- config'."\n" + ."\n" + .'- csk'."\n" + ."\n" + .'- fc'."\n" + ."\n" + .'- rds'."\n" + ."\n" + .'- nas'."\n" + ."\n" + .'- apigateway'."\n" + ."\n" + .'- cdn'."\n" + ."\n" + .'- mongodb'."\n" + ."\n" + .'- eip'."\n" + ."\n" + .'- slb'."\n" + ."\n" + .'- vpc'."\n" + ."\n" + .'- actiontrail'."\n" + ."\n" + .'- waf'."\n" + ."\n" + .'- bastionhost'."\n" + ."\n" + .'- oss'."\n" + ."\n" + .'- polardb', 'type' => 'string', 'required' => true, 'example' => 'sas'], + ], + [ 'name' => 'LogCode', 'in' => 'formData', - 'schema' => [ - 'title' => '日志code。', - 'description' => 'The log code.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_waf_xxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The code of the log within the cloud service. For example, the process log of Security Center. For valid values, see the return value of the ListDelivery operation.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_proc'], ], [ - 'name' => 'AccountId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '123xxxxxxx', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'DataSourceType', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源类型。取值：'."\n" - .' - obs：华为云obs。'."\n" - .' - wafApi：腾讯云waf下载api。 '."\n" - .' - ckafka： 腾讯云ckafka。', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* obs: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n" - .'* ckafka: Tencent Cloud Kafka (CKafka)'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'obs', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'DataSourceInstanceId', + 'name' => 'RegionId', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the data management center of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this region if your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Select this region if your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [DescribeDataSourceInstance](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CDescribeDataSourceInstance) operation to query the IDs of data sources.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1', + 'title' => 'CloudSiemResponse<Boolean>', + 'description' => 'CloudSiemResponse', + 'type' => 'object', + 'properties' => [ + 'Data' => ['title' => '', 'description' => 'The result of the request. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => 'F375A043-4F5B-55F2-A564-CC47FFC6****'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'Siem.Delivery.MissingProductCode', 'errorMessage' => 'ProductCode is mandatory for this action.', 'description' => ''], + ], + 500 => [ + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ['errorCode' => 'Siem.Delivery.ErrorMapping', 'errorMessage' => 'The Mapping between productCode and logCode is error.', 'description' => ''], + ['errorCode' => 'Siem.Delivery.ErrorProductCode', 'errorMessage' => 'ProductCode is error for this action.', 'description' => ''], + ['errorCode' => 'SLS.Ship.Error', 'errorMessage' => 'The Simple Log Service about data shipping is unavailable.', 'description' => ''], + ], + ], + 'title' => 'CloseDelivery', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'CloseDelivery'], + ], + ], + 'ramActions' => [ [ - 'name' => 'DataSourceInstanceLogs', - 'in' => 'formData', - 'schema' => [ - 'title' => '数据源参数详情，json数组格式。', - 'description' => 'The parameters of the data source. Set this parameter to a JSON string.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]', + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:CloseDelivery', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"F375A043-4F5B-55F2-A564-CC47FFC6****\\"\\n}","type":"json"}]', + ], + 'DeleteAutomateResponseConfig' => [ + 'summary' => 'Deletes an automated response rule by its ID.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'LogInstanceId', + 'AK' => [], + ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ + [ + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '日志ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) to query log IDs.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123'], ], [ - 'name' => 'CloudCode', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member. An administrator can use this ID to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management hub for threat analysis is located. Select the region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<ModifyDataSourceLogResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<String>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'Count' => [ - 'title' => '修改日志的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of logs that are modified. The value 1 indicates that the modification is successful, and a value less than or equal to 0 indicates that the modification failed.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'LogInstanceId' => [ - 'title' => '日志的ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'string', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ModifyDataSourceLog', - ], - 'ModifyBindAccount' => [ - 'summary' => 'Modifies a third-party cloud account that is added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DeleteAutomateResponseConfig', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteAutomateResponseConfig'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteAutomateResponseConfig', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DeleteBindAccount' => [ + 'summary' => 'Detaches the AccessKey of a multicloud account, such as a Tencent Cloud or Huawei Cloud account, from a threat analysis data source. You can then attach a new account.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -1220,573 +791,347 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeCode' => '194689', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeCode' => '194688', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'AccessId', - 'in' => 'formData', - 'schema' => [ - 'title' => '云账号的AccessKeyId。', - 'description' => 'The AccessKey ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ABCXXXXXXXXX', - ], - ], - [ - 'name' => 'AccountName', + 'name' => 'BindId', 'in' => 'formData', - 'schema' => [ - 'title' => '多云账号名称。', - 'description' => 'The username of the cloud account.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'sas_account_xxx', - ], + 'schema' => ['title' => '', 'description' => 'The binding ID. Call the [ListBindAccount](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListBindAccount) operation to obtain the binding ID.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '10'], ], [ - 'name' => 'BindId', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '绑定记录ID。ListBindAccount接口返回的BindId。', - 'description' => 'The ID that is generated by the system when the account is added. You can call the ListBindAccount operation to query the ID.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '123', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], ], [ - 'name' => 'AccountId', + 'name' => 'AccessId', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The AccessKey ID of the cloud account.', 'type' => 'string', 'required' => true, 'example' => 'ABCXXXXXXXX'], ], [ 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider.'."\n", + 'title' => '', + 'description' => 'The code for the cloud service provider. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud'."\n" + ."\n" + .'- aliyun: Alibaba Cloud'."\n" + ."\n" + .'- hcloud: Huawei Cloud', 'type' => 'string', 'required' => true, + 'enum' => ['qcloud', 'hcloud'], 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the threat analysis data center is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in mainland China or the China (Hong Kong) region.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], [ - 'name' => 'RoleFor', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The type of the view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that are managed by your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'RoleType', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to perform the operation from the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<ModifyBindAccountResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<DeleteBindAccountResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'Count' => [ - 'title' => '修改账号绑定的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of the accounts that are modified. The value 1 indicates that the modification is successful, and a value less than or equal to 0 indicates that the modification failed.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], + 'Count' => ['title' => '', 'description' => 'The number of account bindings that are deleted. A value of 1 indicates that the operation was successful. A value of 0 or less indicates that the operation failed.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], + 'example' => '', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ], + ], + 'title' => 'DeleteBindAccount', + 'changeSet' => [ + ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteBindAccount'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteBindAccount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ModifyBindAccount', ], - 'ListImportedLogsByProd' => [ - 'summary' => 'Queries the details of the logs in a cloud service that is added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'DeleteCustomizeRule' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '195548', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'ProdCode', - 'in' => 'formData', - 'schema' => [ - 'title' => '产品的code。', - 'description' => 'The code of the cloud service.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'qcloud_waf', - ], - ], - [ - 'name' => 'CloudCode', + 'name' => 'RuleId', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。取值：'."\n" - .' - hcloud：华为云。'."\n" - .' - qcloud：腾讯云。 '."\n" - .' - aliyun：阿里云。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud.'."\n" - .'* aliyun: Alibaba Cloud.'."\n" - .'* hcloud: Huawei Cloud.'."\n", - 'type' => 'string', - 'required' => true, - 'enumValueTitles' => [], - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the product is deployed.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListImportedLogsByProdResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", + 'title' => 'BaseResponse<Integer>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'ProdCode' => [ - 'title' => '日志对应的产品code。', - 'description' => 'The code of the cloud service to which the log belongs.'."\n", - 'type' => 'string', - 'example' => 'qcloud_waf', - ], - 'LogCode' => [ - 'title' => '日志code。', - 'description' => 'The code of the log.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_waf_xxxxx', - ], - 'LogMdsCode' => [ - 'title' => '日志显示code。', - 'description' => 'The display code of the log.'."\n", - 'type' => 'string', - 'example' => '${siem.prod. cloud_siem_waf_xxxxx}', - ], - 'ImportedUserCount' => [ - 'title' => '已接入该日志的用户数量。', - 'description' => 'The number of users who have added the log.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'UnImportedUserCount' => [ - 'title' => '未接入该日志的用户数量。', - 'description' => 'The number of users who have not added the log.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'TotalUserCount' => [ - 'title' => '该日志下总共的用户数量。', - 'description' => 'The total number of users who have the log.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '5', - ], - 'ModifyTime' => [ - 'title' => '日志最后接入时间。', - 'description' => 'The time when the log was last added.'."\n", - 'type' => 'string', - 'example' => '2023-11-23 12:30:00', - ], - 'Imported' => [ - 'title' => '日志是否已经接入。取值：'."\n" - .' - 1：已接入。 '."\n" - .' - 0：未接入。', - 'description' => 'Indicates whether the log is added to the threat analysis feature. Valid values:'."\n" - ."\n" - .'* 1: yes.'."\n" - .'* 0: no.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2023-11-23 12:30:00', - ], - 'AutoImported' => [ - 'title' => '新增账号是否自动接入。取值：'."\n" - .' - 1：自动接入。 '."\n" - .' - 0：不自动接入。', - 'description' => 'Indicates whether the log is automatically added to the threat analysis feature within newly added accounts. Valid values:'."\n" - ."\n" - .'* 1: yes.'."\n" - .'* 0: no.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2023-11-23 12:30:00', - ], - 'LogType' => [ - 'title' => '日志类型。取值：'."\n" - .' - 1：中心侧接入。 '."\n" - .' - 2：预定义日志服务。 '."\n" - .' -3：自定义日志服务', - 'description' => 'The type of log. Valid values:'."\n" - .' - 1: the log produced by other product'."\n" - .' - 2: the predefined log'."\n" - .' - 3: the custom log', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud.'."\n" - .'* aliyun: Alibaba Cloud.'."\n" - .'* hcloud: Huawei Cloud.'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ + 400 => [ + ['errorCode' => 'CloudSiemCustomizeRuleDeleteExcepiton', 'errorMessage' => 'can not delete online customize rule.', 'description' => ''], + ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DeleteCustomizeRule', + 'summary' => 'You can customize rules for a specific ID.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"ProdCode\\": \\"qcloud_waf\\",\\n \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n \\"LogMdsCode\\": \\"${siem.prod. cloud_siem_waf_xxxxx}\\",\\n \\"ImportedUserCount\\": 2,\\n \\"UnImportedUserCount\\": 3,\\n \\"TotalUserCount\\": 5,\\n \\"ModifyTime\\": \\"2023-11-23 12:30:00\\",\\n \\"Imported\\": 0,\\n \\"AutoImported\\": 0,\\n \\"LogType\\": 0,\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListImportedLogsByProd', - ], - 'ListDataSourceTypes' => [ - 'summary' => 'Queries a list of data source types in third-party cloud services that can be added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteCustomizeRule'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteCustomizeRule', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": 123456,\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DeleteDataSource' => [ + 'summary' => 'Call this operation to delete a data source that is no longer required.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ + 'name' => 'DataSourceInstanceId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value calculated by Threat Analysis based on specific parameters. Call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + ], + [ + 'name' => 'AccountId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], + ], + [ 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the third-party cloud service.'."\n" + 'title' => '', + 'description' => 'The code for the multicloud environment. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" ."\n" - .'Valid values:'."\n" + .'- aliyun: Alibaba Cloud.'."\n" ."\n" - .'* qcloud'."\n" - .'* hcloud'."\n", + .'- hcloud: Huawei Cloud.', 'type' => 'string', 'required' => true, + 'enumValueTitles' => [], + 'enum' => ['qcloud', 'hcloud', 'aliyun'], 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management hub of Threat Analysis is located. Select the region of the management hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListDataSourceTypesResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<DeleteDataSourceResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'DataSourceType' => [ - 'title' => '数据源类型。取值：'."\n" - .' - obs：华为云obs。'."\n" - .' - wafApi：腾讯云waf下载api。 '."\n" - .' - ckafka： 腾讯云ckafka。', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* obs: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n" - .'* ckafka: Tencent Cloud Kafka (CKafka)'."\n", - 'type' => 'string', - 'example' => 'obs', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the third-party cloud service.'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], - ], + 'title' => '', + 'description' => 'The return value of the request.', + 'type' => 'object', + 'properties' => [ + 'Count' => ['title' => '', 'description' => 'The number of data sources that are deleted. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], + 'example' => '', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IllegalParameter', - 'errorMessage' => 'The specified parameter %s is not valid, only support %s', - ], - ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"DataSourceType\\": \\"obs\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListDataSourceTypes', - ], - 'ListDataSourceLogs' => [ - 'summary' => 'Queries the logs of a data source.', - 'methods' => [ - 'get', - 'post', + 'title' => 'DeleteDataSource', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSource'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDataSource', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'DeleteDataSourceLog' => [ + 'summary' => 'Removes a log.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ + 'name' => 'LogInstanceId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of logs.'."\n", 'type' => 'string', 'required' => true, 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'], + ], + [ 'name' => 'DataSourceInstanceId', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The value is obtained after the threat analysis feature calculates the MD5 hash value of a parameter.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n", 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], ], [ 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the cloud account.'."\n", 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], ], [ 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code that is used for multi-cloud environments. Valid values:'."\n" + 'title' => '', + 'description' => 'The code of the cloud service provider. Valid values:'."\n" ."\n" .'* qcloud: Tencent Cloud'."\n" .'* aliyun: Alibaba Cloud'."\n" @@ -1795,740 +1140,531 @@ 'required' => true, 'enumValueTitles' => [], 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], + 'enum' => ['qcloud', 'hcloud', 'aliyun'], ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" + ."\n" + .'* cn-hangzhou: Your assets reside in regions in China.'."\n" + .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<ListDataSourceLogsResult>', + 'title' => 'CloudSiemSuccessResponse<DeleteDataSourceLogResult>', 'description' => 'CloudSiemSuccessResponse'."\n", 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', + 'title' => '', 'description' => 'The data returned.'."\n", 'type' => 'object', 'properties' => [ - 'SubUserId' => [ - 'title' => '日志对应的阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXX', - ], - 'DataSourceInstanceId' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The value is obtained after the threat analysis feature calculates the MD5 hash value of a parameter.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], - 'DataSourceInstanceName' => [ - 'title' => '数据源名称。', - 'description' => 'The name of the data source.'."\n", - 'type' => 'string', - 'example' => 'waf kafka', - ], - 'DataSourceInstanceRemark' => [ - 'title' => '数据源备注。', - 'description' => 'The remarks of the data source.'."\n", - 'type' => 'string', - 'example' => 'waf kafka', - ], - 'DataSourceInstanceLogs' => [ - 'title' => '该数据源下日志列表。', - 'description' => 'The logs of the data source.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'LogInstanceId' => [ - 'title' => '日志的ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the log. The value is obtained after the threat analysis feature calculates the MD5 hash value of a parameter.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], - 'LogCode' => [ - 'title' => '日志code。', - 'description' => 'The code of the log.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_waf_xxxxx', - ], - 'LogMdsCode' => [ - 'title' => '日志显示code。', - 'description' => 'The display code of the log.'."\n", - 'type' => 'string', - 'example' => '${siem.prod.cloud_siem_waf_xxxxx}', - ], - 'LogParams' => [ - 'title' => '日志详细参数列表。', - 'description' => 'The parameters of the log.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'ParaCode' => [ - 'title' => '日志参数code。', - 'description' => 'The parameter code of the log.'."\n", - 'type' => 'string', - 'example' => 'region_code', - ], - 'ParaValue' => [ - 'title' => '日志参数值。', - 'description' => 'The parameter value of the log.'."\n", - 'type' => 'string', - 'example' => 'ap-guangzhou', - ], - ], - ], - ], - 'TaskStatus' => [ - 'title' => '日志对应的接入任务状态。取值：'."\n" - .' - 1：已接入。 '."\n" - .' - 0：未接入。', - 'description' => 'Indicates whether the task for which logs are collected is enabled. Valid values:'."\n" - ."\n" - .'* 1: yes'."\n" - .'* 0: no'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - ], - ], - ], - 'AccountId' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code that is used for multi-cloud environments. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'Count' => ['title' => '', 'description' => 'The number of logs that are removed. The value 1 indicates that the log is removed, and a value less than or equal to 0 indicates that the log failed to be removed.'."\n", 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", 'type' => 'string', 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'], ], + 'example' => '', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.'."\n", 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"SubUserId\\": 0,\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"DataSourceInstanceName\\": \\"waf kafka\\",\\n \\"DataSourceInstanceRemark\\": \\"waf kafka\\",\\n \\"DataSourceInstanceLogs\\": [\\n {\\n \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n \\"LogMdsCode\\": \\"${siem.prod.cloud_siem_waf_xxxxx}\\",\\n \\"LogParams\\": [\\n {\\n \\"ParaCode\\": \\"region_code\\",\\n \\"ParaValue\\": \\"ap-guangzhou\\"\\n }\\n ],\\n \\"TaskStatus\\": 1\\n }\\n ],\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListDataSourceLogs', - ], - 'ListBindDataSources' => [ - 'summary' => 'Queries a list of data sources that are added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DeleteDataSourceLog', + 'changeSet' => [], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDataSourceLog', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSourceLog'], + ], ], + ], + 'DeleteWhiteRuleList' => [ + 'summary' => 'Deletes an alert whitelist rule with the specified ID.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'AccountId', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The unique ID of the whitelist rule.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123456789'], ], [ - 'name' => 'CloudCode', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider.'."\n" - ."\n" - .'Valid values:'."\n" - ."\n" - .'* qcloud'."\n" - .'* hcloud'."\n" - .'* aliyun'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view for the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view for all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member. An administrator can switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListBindDataSourcesResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", + 'title' => 'BaseResponse', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'AccountName' => [ - 'title' => '多云账号名称。', - 'description' => 'The username of the cloud account.'."\n", - 'type' => 'string', - 'example' => 'sas_tq_account_xxxx', - ], - 'DataSourceInstanceId' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], - 'DataSourceType' => [ - 'title' => '数据源类型。取值：'."\n" - .' - obs：华为云obs。'."\n" - .' - wafApi：腾讯云waf下载api。 '."\n" - .' - ckafka： 腾讯云ckafka。', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* obs: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n" - .'* ckafka: Tencent Cloud Kafka (CKafka)'."\n", - 'type' => 'string', - 'example' => 'obs', - ], - 'DataSourceName' => [ - 'title' => '数据源名称。', - 'description' => 'The name of the data source.'."\n", - 'type' => 'string', - 'example' => 'waf_kafka', - ], - 'DataSourceRemark' => [ - 'title' => '数据源备注。', - 'description' => 'The remarks on the data source.'."\n", - 'type' => 'string', - 'example' => 'waf_kafka', - ], - 'LogCount' => [ - 'title' => '该数据源下已添加的日志的数量。', - 'description' => 'The number of logs that are added within the data source.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'TaskCount' => [ - 'title' => '该数据源下已创建的日志接入任务的数量。', - 'description' => 'The number of existing tasks that are created to add logs within the data source.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'AccountId' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'any', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AccountName\\": \\"sas_tq_account_xxxx\\",\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"DataSourceType\\": \\"obs\\",\\n \\"DataSourceName\\": \\"waf_kafka\\",\\n \\"DataSourceRemark\\": \\"waf_kafka\\",\\n \\"LogCount\\": 1,\\n \\"TaskCount\\": 0,\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListBindDataSources', - ], - 'ListAllProds' => [ - 'summary' => 'Queries a list of cloud services that can be added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DeleteWhiteRuleList', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteWhiteRuleList'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteWhiteRuleList', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAggregateFunction' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '195975', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - ."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member. An administrator can switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<ListAllProdsResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'PlainResponse<List<RuleAggregateFunction>>', + 'description' => 'PlainResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'TotalCount' => [ - 'title' => '日志总数。', - 'description' => 'The total number of logs.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '19', - ], - 'PageSize' => [ - 'title' => '每页的大小。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'CurrentPage' => [ - 'title' => '当前页。', - 'description' => 'The page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'ProdList' => [ - 'title' => '产品列表。', - 'description' => 'The cloud services.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'ProdCode' => [ - 'title' => '产品code。', - 'description' => 'The code of the cloud service.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'TotalLogCount' => [ - 'title' => '该产品下总共的日志数量。', - 'description' => 'The total number of logs within the cloud service.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '19', - ], - 'ImportedLogCount' => [ - 'title' => '该产品下已经接入的日志数量。', - 'description' => 'The number of logs within the cloud service that are added to the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'ModifyTime' => [ - 'title' => '该产品下日志最近接入时间。', - 'description' => 'The time when the logs within the cloud service were last added to the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => '2023-11-23 12:12:12', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud.'."\n" - .'* aliyun: Alibaba Cloud.'."\n" - .'* hcloud: Huawei Cloud.'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], - ], - ], - 'example' => '1', + 'title' => '', + 'description' => 'The returned data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Function' => ['title' => '', 'description' => 'The aggregate function.', 'type' => 'string', 'example' => 'count'], + 'FunctionName' => ['title' => '', 'description' => 'The display name of the aggregate function.', 'type' => 'string', 'example' => 'Count'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAggregateFunction', + 'summary' => 'Describes the aggregate functions that are supported by custom rules.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"TotalCount\\": 19,\\n \\"PageSize\\": 10,\\n \\"CurrentPage\\": 1,\\n \\"ProdList\\": [\\n {\\n \\"ProdCode\\": \\"sas\\",\\n \\"TotalLogCount\\": 19,\\n \\"ImportedLogCount\\": 10,\\n \\"ModifyTime\\": \\"2023-11-23 12:12:12\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ]\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListAllProds', - ], - 'EnableServiceForCloudSiem' => [ - 'summary' => 'Authorizes the threat analysis feature to access a resource directory. This operation must be called by the management account of the resource directory.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAggregateFunction'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAggregateFunction', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Function\\": \\"count\\",\\n \\"FunctionName\\": \\"Count\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAlertScene' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], + ], + [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. You must select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<List<SceneAndTarget>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the threat analysis feature is authorized to access the resource directory. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'AlertType' => ['title' => '', 'description' => 'The display name of the alert type. The value varies based on the language of the environment.', 'type' => 'string', 'example' => 'unusual login'], + 'AlertTypeId' => ['title' => '', 'description' => 'The ID of the alert type.', 'type' => 'string', 'example' => 'unusual login'], + 'AlertName' => ['title' => '', 'description' => 'The display name of the alert. The value varies based on the language of the environment.', 'type' => 'string', 'example' => 'login_common_ip'], + 'AlertNameId' => ['title' => '', 'description' => 'The ID of the alert name.', 'type' => 'string', 'example' => 'login_common_ip'], + 'AlertTile' => ['title' => '', 'description' => 'The display title of the alert. The value varies based on the language of the environment.', 'type' => 'string', 'example' => 'unusual login-login_common_ip'], + 'AlertTileId' => ['title' => '', 'description' => 'The ID of the alert title.', 'type' => 'string', 'example' => 'unusual login-login_common_ip'], + 'Targets' => [ + 'title' => '', + 'description' => 'The objects that can be added to the whitelist.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Type' => ['title' => '', 'description' => 'The field of the entity that can be added to the whitelist.', 'type' => 'string', 'example' => 'host_uuid'], + 'Name' => ['title' => '', 'description' => 'The display name of the field of the entity that can be added to the whitelist.', 'type' => 'string', 'example' => 'HOST UUID'], + 'Value' => ['title' => '', 'description' => 'The default right operand that is displayed for the whitelist rule.', 'type' => 'string', 'example' => '441862da-a539-4cc0-a00d-47395582****'], + 'Values' => [ + 'title' => '', + 'description' => 'The available right operands for the whitelist rule.', + 'type' => 'array', + 'items' => ['description' => 'The right operand.', 'type' => 'string', 'title' => '', 'example' => '[441862da-a539-4cc0-a00d-47395582****]'], + 'example' => '["441862da-a539-4cc0-a00d-473955826881"]', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '123456', ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'EnableServiceForCloudSiem', - ], - 'EnableAccessForCloudSiem' => [ - 'summary' => 'Creates a service-linked role named AliyunServiceRoleForSasCloudSiem for the threat analysis feature. The feature can assume this role to access cloud services.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAlertScene', + 'summary' => 'Queries the scenarios in which alerts can be whitelisted.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertScene'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertScene', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AlertType\\": \\"unusual login\\",\\n \\"AlertTypeId\\": \\"unusual login\\",\\n \\"AlertName\\": \\"login_common_ip\\",\\n \\"AlertNameId\\": \\"login_common_ip\\",\\n \\"AlertTile\\": \\"unusual login-login_common_ip\\",\\n \\"AlertTileId\\": \\"unusual login-login_common_ip\\",\\n \\"Targets\\": [\\n {\\n \\"Type\\": \\"host_uuid\\",\\n \\"Name\\": \\"HOST UUID\\",\\n \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n \\"Values\\": [\\n \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n ]\\n }\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAlertSceneByEvent' => [ + 'summary' => 'Retrieves a list of alert whitelisting scenarios and objects.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '158612', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'AutoSubmit', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'description' => 'Whether import the log of SAS alert, the log of WAF alert, the log of CFW alert or not. Valid values:'."\n" - .'- 0: not imported automatically'."\n" - .'- 1: imported automatically', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The event ID.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<List<SceneAndTarget>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'AlertType' => ['title' => '', 'description' => 'The display name of the alert type. The value varies based on the language settings.', 'type' => 'string', 'example' => 'Unusual Logon'], + 'AlertTypeId' => ['title' => '', 'description' => 'The identifier of the alert type.', 'type' => 'string', 'example' => 'Unusual Logon'], + 'AlertName' => ['title' => '', 'description' => 'The display name of the alert. The value varies based on the language settings.', 'type' => 'string', 'example' => 'login_common_ip'], + 'AlertNameId' => ['title' => '', 'description' => 'The identifier of the alert name.', 'type' => 'string', 'example' => 'login_common_ip'], + 'AlertTile' => ['title' => '', 'description' => 'The display title of the alert. The value varies based on the language settings.', 'type' => 'string', 'example' => 'Unusual Logon-login_common_ip'], + 'AlertTileId' => ['title' => '', 'description' => 'The identifier of the alert title.', 'type' => 'string', 'example' => 'Unusual Logon-login_common_ip'], + 'Targets' => [ + 'title' => '', + 'description' => 'The objects to be whitelisted.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Type' => ['title' => '', 'description' => 'The field of the entity property that can be whitelisted.', 'type' => 'string', 'example' => 'host_uuid'], + 'Name' => ['title' => '', 'description' => 'The display name of the entity property field that can be whitelisted.', 'type' => 'string', 'example' => 'host uuid'], + 'Value' => ['title' => '', 'description' => 'The default right operand displayed for the whitelisting rule.', 'type' => 'string', 'example' => '441862da-a539-4cc0-a00d-47395582****'], + 'Values' => [ + 'title' => '', + 'description' => 'The available right operands for the whitelisting rule.', + 'type' => 'array', + 'items' => ['description' => 'The right operand.', 'type' => 'string', 'title' => '', 'example' => '[441862da-a539-4cc0-a00d-47395582****]'], + 'example' => '["441862da-a539-4cc0-a00d-473955826881"]', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '123456', ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAlertSceneByEvent', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'EnableAccessForCloudSiem', - ], - 'DescribeServiceStatus' => [ - 'summary' => 'Checks whether the threat analysis feature is authorized to access a resource directory.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSceneByEvent'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertSceneByEvent', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AlertType\\": \\"Unusual Logon\\",\\n \\"AlertTypeId\\": \\"Unusual Logon\\",\\n \\"AlertName\\": \\"login_common_ip\\",\\n \\"AlertNameId\\": \\"login_common_ip\\",\\n \\"AlertTile\\": \\"Unusual Logon-login_common_ip\\",\\n \\"AlertTileId\\": \\"Unusual Logon-login_common_ip\\",\\n \\"Targets\\": [\\n {\\n \\"Type\\": \\"host_uuid\\",\\n \\"Name\\": \\"host uuid\\",\\n \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n \\"Values\\": [\\n \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n ]\\n }\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAlertSource' => [ + 'summary' => 'Retrieves a list of alert sources.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -2540,594 +1676,366 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasNB8R24'], ], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'Level', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" + 'title' => '', + 'description' => 'The threat levels. Valid values:'."\n" ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', + .'- `serious`: High'."\n" + ."\n" + .'- `suspicious`: Medium'."\n" + ."\n" + .'- `remind`: Low', + 'type' => 'array', + 'items' => ['description' => 'A threat level. Valid values:'."\n" + ."\n" + .'- `serious`: High'."\n" + ."\n" + .'- `suspicious`: Medium'."\n" + ."\n" + .'- `remind`: Low', 'type' => 'string', 'required' => false, 'example' => '["remind","serious"]', 'title' => ''], 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemSuccessResponse'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the threat analysis feature is authorized to access the resource directory. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - ], - ], - ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', + 'example' => '["serious","suspicious","remind"]', + 'maxItems' => 100, ], ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DescribeServiceStatus', - ], - 'DescribeProdCount' => [ - 'summary' => 'Queries the number of services that can be added to the threat analysis feature in Alibaba Cloud, Tenant Cloud, and Huawei Cloud.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'StartTime', + 'in' => 'formData', + 'schema' => ['description' => 'The start of the query time range. The value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '195547', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', + [ + 'name' => 'EndTime', + 'in' => 'formData', + 'schema' => ['description' => 'The end of the query time range. The value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], ], - ], - 'parameters' => [ [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- `0`: View data for the current Alibaba Cloud account.'."\n" + ."\n" + .'- `1`: View data for all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The user ID of the member whose data you want to view. An administrator uses this parameter to view data from the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the data management center for threat analysis. Select the data management center that corresponds to the region where your assets are located. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: for assets in the Chinese mainland and Hong Kong (China).'."\n" + ."\n" + .'- `ap-southeast-1`: for assets in regions outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<DescribeProdCountResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<List<AlertSource>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'AliyunProdCount' => [ - 'title' => '阿里云产品的数量。', - 'description' => 'The number of Alibaba Cloud services.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '19', - ], - 'HcloudProdCount' => [ - 'title' => '华为云产品的数量。', - 'description' => 'The number of Huawei Cloud services.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'QcloudProdCount' => [ - 'title' => '腾讯云产品的数量。', - 'description' => 'The number of Tencent Cloud services.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'IdcProdCount' => [ - 'title' => 'IDC产品的数量。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'AliyunImportedCount' => [ - 'type' => 'integer', - 'format' => 'int32', - ], - 'HcloudImportedCount' => [ - 'type' => 'integer', - 'format' => 'int32', - ], - 'QcloudImportedCount' => [ - 'type' => 'integer', - 'format' => 'int32', - ], - 'IdcImportedCount' => [ - 'type' => 'integer', - 'format' => 'int32', + 'title' => '', + 'description' => 'The list of alert sources.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'SourceName' => ['description' => 'The name of the alert source.', 'type' => 'string', 'example' => 'sas', 'title' => ''], + 'Source' => ['description' => 'The internal code for the alert source.', 'type' => 'string', 'title' => '', 'example' => 'aliyun.siem.alert_datasource.sas'], + 'Modules' => [ + 'type' => 'array', + 'items' => ['description' => 'A module.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_cwpp', 'title' => ''], + 'description' => 'The list of modules.', + 'title' => '', + 'example' => '', + ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- `true`: The request was successful.'."\n" + ."\n" + .'- `false`: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Code' => ['description' => 'The status code of the response. A value of 200 indicates success.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''], + 'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SourceName\\": \\"sas\\",\\n \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\",\\n \\"Modules\\": [\\n \\"alibaba_cloud_sas_cwpp\\"\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'title' => 'DescribeAlertSource', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"AliyunProdCount\\": 19,\\n \\"HcloudProdCount\\": 2,\\n \\"QcloudProdCount\\": 2,\\n \\"IdcProdCount\\": 2,\\n \\"AliyunImportedCount\\": 2,\\n \\"HcloudImportedCount\\": 2,\\n \\"QcloudImportedCount\\": 2,\\n \\"IdcImportedCount\\": 2\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DescribeProdCount', - ], - 'DescribeImportedLogCount' => [ - 'summary' => 'Queries the number of logs that are added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSource'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertSource', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'DescribeAlertSourceWithEvent' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '195544', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - 'pattern' => '^\\d+$', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that are managed by the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - 'pattern' => '^\\d+$', - ], + 'schema' => ['description' => 'The ID of the member whose data you want to view. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], + ], + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in China.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<DescribeImportedLogCountResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<List<AlertSource>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'TotalLogCount' => [ - 'title' => '日志总数。', - 'description' => 'The total number of logs.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '59', - ], - 'ImportedLogCount' => [ - 'title' => '已接入的日志的数量。', - 'description' => 'The number of logs that are added.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'UnImportedLogCount' => [ - 'title' => '未接入的日志的数量。', - 'description' => 'The number of logs that are not added.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '49', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'SourceName' => ['title' => '', 'description' => 'The name of the alert data source.', 'type' => 'string', 'example' => 'sas'], + 'Source' => ['title' => '', 'description' => 'The Medusa code for the alert data source.', 'type' => 'string', 'example' => 'aliyun.siem.alert_datasource.sas'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAlertSourceWithEvent', + 'summary' => 'Retrieves the alert data sources associated with an event.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"TotalLogCount\\": 59,\\n \\"ImportedLogCount\\": 10,\\n \\"UnImportedLogCount\\": 49\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DescribeImportedLogCount', - ], - 'DescribeDataSourceParameters' => [ - 'summary' => 'Queries the parameters of a data source.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSourceWithEvent'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertSourceWithEvent', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SourceName\\": \\"sas\\",\\n \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAlertType' => [ + 'summary' => 'Retrieves a list of threat types for custom rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'DataSourceType', + 'name' => 'RuleType', 'in' => 'formData', - 'schema' => [ - 'title' => '接入的数据源类型。 取值: '."\n" - .' - ckafka：腾讯云ckafka。 '."\n" - .' - obs：华为云obs。 '."\n" - .' - wafApi：腾讯云waf攻击日志下载api。 ', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* **ckafka**: Tencent Cloud TDMQ for CKafka'."\n" - .'* **obs**: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* **wafApi**: download API of Tencent Cloud Web Application Firewall (WAF)'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'obs', - ], + 'schema' => ['title' => '规则类型。 取值：'."\n" + .'- predefine：预定义'."\n" + .'- customize：自定义', 'description' => 'The type of the rule. Valid values:'."\n" + ."\n" + .'- predefine: predefined'."\n" + ."\n" + .'- customize: custom', 'type' => 'string', 'required' => false, 'example' => 'customize'], ], [ - 'name' => 'CloudCode', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider.'."\n" - ."\n" - .'Valid values:'."\n" - ."\n" - .'* qcloud'."\n" - .'* hcloud'."\n" - .'* aliyun'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<DescribeDataSourceParametersResult>>', - 'description' => 'CloudSiemSuccessResponse\\<List>'."\n", + 'title' => 'PlainResponse<List<AlertType>>', + 'description' => 'PlainResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'array', 'items' => [ - 'description' => '', 'type' => 'object', 'properties' => [ - 'DataSourceType' => [ - 'title' => '数据源类型。取值：'."\n" - .' - obs：华为云obs。'."\n" - .' - wafApi：腾讯云waf下载api。 '."\n" - .' - ckafka： 腾讯云ckafka。', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* **obs**: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* **wafApi**: download API of Tencent Cloud Web Application Firewall (WAF)'."\n" - .'* **ckafka**: Tencent Cloud TDMQ for CKafka'."\n", - 'type' => 'string', - 'example' => 'obs', - ], - 'ParaLevel' => [ - 'title' => '参数级别。取值：'."\n" - .' - 1：数据源参数。'."\n" - .'- 2：日志参数。', - 'description' => 'The parameter level. Valid values:'."\n" - ."\n" - .'* **1**: the parameters of the data source'."\n" - .'* **2**: the parameters of the log'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'ParaCode' => [ - 'title' => '参数code。', - 'description' => 'The code of the parameter.'."\n", - 'type' => 'string', - 'example' => 'region_code', - ], - 'ParaName' => [ - 'title' => '参数名字。', - 'description' => 'The name of the parameter.'."\n", - 'type' => 'string', - 'example' => 'region local', - ], - 'ParaType' => [ - 'title' => '参数类型。', - 'description' => 'The data type of the parameter.'."\n", - 'type' => 'string', - 'example' => 'string', - ], - 'Required' => [ - 'title' => '是否必选参数。取值：'."\n" - .' - 1：必选。'."\n" - .' - 0：非必选。', - 'description' => 'Indicates whether the parameter is required. Valid values:'."\n" - ."\n" - .'* **1**: required'."\n" - .'* **0**: optional'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => 'string', - ], - 'FormatCheck' => [ - 'title' => '格式校验方式。', - 'description' => 'The method that is used to check the parameter format.'."\n", - 'type' => 'string', - 'example' => 'email', - ], - 'Title' => [ - 'title' => '参数值提示。', - 'description' => 'The note for the parameter value.'."\n", - 'type' => 'string', - 'example' => 'obs bucket name', - ], - 'Hit' => [ - 'title' => '更多说明。', - 'description' => 'The additional information.'."\n", - 'type' => 'string', - 'example' => 'obs docment', - ], - 'DefaultValue' => [ - 'title' => '默认参数值。', - 'description' => 'The default value of the parameter.'."\n", - 'type' => 'string', - 'example' => 'wafApi', - ], - 'Disabled' => [ - 'title' => '是否禁止修改。取值：'."\n" - .' - true：禁止修改。 '."\n" - .' - false：可以修改。', - 'description' => 'Indicates whether the modification operation is forbidden. Valid values:'."\n" - ."\n" - .'* **true**'."\n" - .'* **false**'."\n", - 'type' => 'boolean', - 'example' => 'wafApi', - ], - 'CanEditted' => [ - 'title' => '是否可编辑。取值：'."\n" - .' - 0：禁止修改。 '."\n" - .' - 1：可以修改。', - 'description' => 'Indicates whether the edit operation is supported. Valid values:'."\n" - ."\n" - .'* **0**'."\n" - .'* **1**'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => 'wafApi', - ], - 'ParamValue' => [ - 'title' => '具体的参数列表。', - 'description' => 'The value of the parameter.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'Label' => [ - 'title' => '展示内容。', - 'description' => 'The display value.'."\n", - 'type' => 'string', - 'example' => 'guangzhou', - ], - 'Value' => [ - 'title' => '实际的参数内容。', - 'description' => 'The actual value.'."\n", - 'type' => 'string', - 'example' => 'ap-guangzhou', - ], - ], - ], - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* **qcloud**: Tencent Cloud'."\n" - .'* **aliyun**: Alibaba Cloud'."\n" - .'* **hcloud**: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'], + 'AlertTypeMds' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'example' => 'siem_rule_type_process_abnormal_command'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"DataSourceType\\": \\"obs\\",\\n \\"ParaLevel\\": 1,\\n \\"ParaCode\\": \\"region_code\\",\\n \\"ParaName\\": \\"region local\\",\\n \\"ParaType\\": \\"string\\",\\n \\"Required\\": 0,\\n \\"FormatCheck\\": \\"email\\",\\n \\"Title\\": \\"obs bucket name\\",\\n \\"Hit\\": \\"obs docment\\",\\n \\"DefaultValue\\": \\"wafApi\\",\\n \\"Disabled\\": true,\\n \\"CanEditted\\": 0,\\n \\"ParamValue\\": [\\n {\\n \\"Label\\": \\"guangzhou\\",\\n \\"Value\\": \\"ap-guangzhou\\"\\n }\\n ],\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DescribeDataSourceParameters', - ], - 'DescribeDataSourceInstance' => [ - 'summary' => 'Queries the details of a data source.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAlertType', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertType'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertType', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AlertType\\": \\"WEBSHELL\\",\\n \\"AlertTypeMds\\": \\"siem_rule_type_process_abnormal_command\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAlerts' => [ + 'summary' => 'Gets the list of alerts for a user.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -3139,1528 +2047,1715 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], ], 'parameters' => [ [ - 'name' => 'DataSourceInstanceId', + 'name' => 'AlertUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'schema' => ['description' => 'The unique ID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => '', 'required' => false], ], [ - 'name' => 'AccountId', + 'name' => 'Level', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', + 'title' => '', + 'description' => 'The threat levels. This parameter is a JSON array. Valid values:'."\n" + ."\n" + .'- `serious`: high'."\n" + ."\n" + .'- `suspicious`: medium'."\n" + ."\n" + .'- `remind`: low', + 'type' => 'array', + 'items' => ['description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- `serious`: high'."\n" + ."\n" + .'- `suspicious`: medium'."\n" + ."\n" + .'- `remind`: low', 'type' => 'string', 'required' => false, 'example' => '["remind","serious"]', 'title' => ''], + 'required' => false, + 'example' => '["serious","suspicious","remind"]', + 'maxItems' => 100, ], ], [ - 'name' => 'CloudCode', + 'name' => 'Source', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['description' => 'The source of the alert.', 'type' => 'string', 'example' => 'sas', 'title' => '', 'required' => false], ], [ - 'name' => 'RegionId', + 'name' => 'IsDefend', + 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether the threat is defended. Valid values:'."\n" + ."\n" + .'- `0`: detected'."\n" + ."\n" + .'- `1`: blocked', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '1'], + ], + [ + 'name' => 'AlertTitle', + 'in' => 'formData', + 'schema' => ['description' => 'The title of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Unusual Logon-login_common_account'], + ], + [ + 'name' => 'AlertType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Scan'], + ], + [ + 'name' => 'AlertName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Try SNMP weak password'."\n"], + ], + [ + 'name' => 'AssetName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'hostname-****'."\n"], + ], + [ + 'name' => 'AssetId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'F3385128-69A5-3EE8-BD05-FBEE7DB2****'], + ], + [ + 'name' => 'EntityName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'launch-advisor-*****'."\n"], + ], + [ + 'name' => 'EntityId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'f366e287ea530e7a324cbe987993****'], + ], + [ + 'name' => 'SubUserId', 'in' => 'formData', + 'schema' => ['description' => 'The ID of the Alibaba Cloud account that is associated with the alert.', 'type' => 'string', 'example' => '176555323***', 'title' => '', 'required' => false], + ], + [ + 'name' => 'LabelType', + 'in' => 'formData', + 'schema' => ['description' => 'The alert type. Valid values:'."\n" + ."\n" + .'- `system`: An alert generated from aggregated analysis'."\n" + ."\n" + .'- `custom`: An alert generated from custom analysis'."\n" + ."\n" + .'- `cfw`: firewall'."\n" + ."\n" + .'- `waf`: web application firewall'."\n" + ."\n" + .'- `edr`: endpoint detection and response'."\n" + ."\n" + .'- `other`: other', 'type' => 'string', 'example' => 'custom', 'title' => '', 'required' => false], + ], + [ + 'name' => 'AlertStatus', + 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', + 'type' => 'array', + 'items' => ['description' => 'The status of the alert.', 'type' => 'string', 'example' => '1', 'title' => '', 'required' => false], + 'maxItems' => 100, + 'description' => 'The status of the alert.', + 'title' => '', + 'example' => '', 'required' => false, - 'example' => 'cn-hangzhou', ], ], + [ + 'name' => 'StartTime', + 'in' => 'formData', + 'schema' => ['description' => 'The beginning of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], + ], + [ + 'name' => 'EndTime', + 'in' => 'formData', + 'schema' => ['description' => 'The end of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], + ], + [ + 'name' => 'CurrentPage', + 'in' => 'formData', + 'schema' => ['description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type of the alert. Valid values:'."\n" + ."\n" + .'- `0`: current account'."\n" + ."\n" + .'- `1`: all accounts', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the user who is used to switch the account to view the data of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The region where the data management center of the threat analysis feature resides. You are required to specify this parameter based on the region where your assets reside. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: Your assets reside in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- `ap-southeast-1`: Your assets reside outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<DescribeDataSourceInstanceResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'PageResponse<List<AlertDetail>>', + 'description' => 'PageResponse\\<List>', 'type' => 'object', 'properties' => [ + 'Success' => ['description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- `true`: The request was successful.'."\n" + ."\n" + .'- `false`: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Code' => ['description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''], + 'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The response data.', 'type' => 'object', 'properties' => [ - 'DataSourceInstanceId' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', + 'PageInfo' => [ + 'title' => '', + 'description' => 'The paging information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''], + ], + 'example' => '', ], - 'DataSourceInstanceParams' => [ - 'title' => '数据源的详细参数列表。', - 'description' => 'The parameters of the data source.'."\n", + 'ResponseData' => [ + 'title' => '', + 'description' => 'A list of alerts.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'ParaCode' => [ - 'title' => '参数code。', - 'description' => 'The code of the parameter.'."\n", - 'type' => 'string', - 'example' => 'region_code', - ], - 'ParaValue' => [ - 'title' => '参数值。', - 'description' => 'The value of the parameter.'."\n", - 'type' => 'string', - 'example' => 'ap-guangzhou', + 'Id' => ['description' => 'The unique ID of the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789', 'title' => ''], + 'GmtCreate' => ['description' => 'The time when the alert was stored in the database.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'GmtModified' => ['description' => 'The time when the alert was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'MainUserId' => ['description' => 'The ID of the main account associated with the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****', 'title' => ''], + 'IncidentUuid' => ['description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''], + 'AlertUuid' => ['description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''], + 'LogTime' => ['description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'AlertSrcProd' => ['description' => 'The product that generated the alert.', 'type' => 'string', 'example' => 'sas', 'title' => ''], + 'AlertTitle' => ['description' => 'The title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''], + 'AlertTitleEn' => ['description' => 'The English title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''], + 'AlertType' => ['description' => 'The type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''], + 'AlertTypeEn' => ['description' => 'The English type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''], + 'AlertTypeCode' => ['description' => 'The internal code for the alert type.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshellName', 'title' => ''], + 'AlertName' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'example' => 'Try SNMP weak password'], + 'AlertNameEn' => ['description' => 'The English name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password', 'title' => ''], + 'AlertNameCode' => ['description' => 'The internal code for the alert name.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell', 'title' => ''], + 'AlertLevel' => ['description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- `serious`: high'."\n" + ."\n" + .'- `suspicious`: medium'."\n" + ."\n" + .'- `remind`: low', 'type' => 'string', 'example' => 'remind', 'title' => ''], + 'AssetList' => ['description' => 'A JSON string that contains a list of involved assets.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "is_main_asset": "1",'."\n" + .' "asset_name": "47.245.*",'."\n" + .' "port": "22",'."\n" + .' "ip": "47.245.*",'."\n" + .' "asset_type": "ip",'."\n" + .' "location": "ap-southeast-1",'."\n" + .' "asset_id": "47.245.*",'."\n" + .' "net_connect_dir": "in"'."\n" + .' }'."\n" + .']', 'title' => ''], + 'OccurTime' => ['description' => 'The time when the alert occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'StartTime' => ['description' => 'The time when the alert first occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'EndTime' => ['description' => 'The end time of the alert.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'AlertSrcProdModule' => ['description' => 'The submodule of the product that generated the alert.', 'type' => 'string', 'example' => 'waf', 'title' => ''], + 'AlertDesc' => ['description' => 'The description of the alert.', 'type' => 'string', 'title' => '', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'], + 'AlertDescEn' => ['description' => 'The English description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', 'title' => ''], + 'AlertDescCode' => ['description' => 'The internal code for the alert description.', 'type' => 'string', 'title' => '', 'example' => 'security_event_config.event_name.webshell'], + 'AlertDetail' => ['description' => 'A JSON string that contains alert details.', 'type' => 'string', 'title' => '', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}'], + 'LogUuid' => ['description' => 'The UUID of the alert log.', 'type' => 'string', 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', 'title' => ''], + 'EntityList' => ['description' => 'A JSON string that contains a list of entities involved in the alert. The entity data is standardized for query and analysis.', 'type' => 'string', 'title' => '', 'example' => '[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]'], + 'AttCk' => ['description' => 'The ATT\\&CK attack technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning', 'title' => ''], + 'SubUserId' => ['description' => 'The ID of the sub-account that generated the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => ''], + 'SubUserName' => ['description' => 'The name of the sub-account that generated the alert.', 'type' => 'string', 'example' => '176555323***', 'title' => ''], + 'VendorId' => ['description' => 'The cloud provider code. Valid values:'."\n" + ."\n" + .'- `aliyun`: Alibaba Cloud'."\n" + ."\n" + .'- `qcloud`: Tencent Cloud'."\n" + ."\n" + .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''], + 'IsDefend' => ['description' => 'Indicates whether the threat was blocked. Valid values:'."\n" + ."\n" + .'- `0`: detected'."\n" + ."\n" + .'- `1`: blocked', 'type' => 'string', 'title' => '', 'example' => '1'], + 'AlertInfoList' => [ + 'title' => '', + 'description' => 'A list of key-value pairs that contain the detailed properties of the alert.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Key' => ['description' => 'The key of the detailed alert property.', 'type' => 'string', 'title' => '', 'example' => 'suspicious.wbd.wb.trojanpath'], + 'KeyName' => ['description' => 'The display name of the detailed alert property.', 'type' => 'string', 'title' => '', 'example' => 'Trojan Path'], + 'Values' => ['description' => 'The value of the detailed alert property.', 'type' => 'string', 'example' => '/root/test33.php', 'title' => ''], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => 'aliyun', ], + 'ExtendContent' => ['description' => 'Extended information about the alert, in JSON string format.', 'type' => 'string', 'example' => '{"user":"Member","num":"1"}', 'title' => ''], + 'ProductId' => ['description' => 'The ID of the product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'CloudCode' => ['description' => 'The cloud provider code. Valid values:'."\n" + ."\n" + .'- `aliyun`: Alibaba Cloud'."\n" + ."\n" + .'- `qcloud`: Tencent Cloud'."\n" + ."\n" + .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''], + 'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-48zs4tk7qfd4rjd9****', 'title' => ''], + 'AlertStatus' => ['description' => 'The alert status.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'InvestigationReport' => ['description' => 'The investigation report for the alert, in JSON string format.', 'type' => 'string', 'example' => '{"agent_attack_confidence": 90, "agent_judgement_category": "false_positive", "reason": "The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.", "start_time": 1774929064, "end_time": 1774929071}', 'title' => ''], ], + 'description' => '', + 'title' => '', + 'example' => '', ], - ], - 'AccountId' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], + 'example' => '', ], ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"DataSourceInstanceParams\\": [\\n {\\n \\"ParaCode\\": \\"region_code\\",\\n \\"ParaValue\\": \\"ap-guangzhou\\"\\n }\\n ],\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DescribeDataSourceInstance', - ], - 'DescribeAuth' => [ - 'summary' => 'Checks whether the security information and event management (SIEM) system is granted the required permissions to access other cloud resources within your Alibaba Cloud account and whether the AliyunServiceRoleForSasCloudSiem service-linked role is created.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"MainUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertType\\": \\"Scan\\",\\n \\"AlertTypeEn\\": \\"Scan\\",\\n \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertLevel\\": \\"remind\\",\\n \\"AssetList\\": \\"[\\\\n {\\\\n \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n }\\\\n]\\",\\n \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n \\"EntityList\\": \\"[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"176555323***\\",\\n \\"VendorId\\": \\"aliyun\\",\\n \\"IsDefend\\": \\"1\\",\\n \\"AlertInfoList\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"ExtendContent\\": \\"{\\\\\\"user\\\\\\":\\\\\\"Member\\\\\\",\\\\\\"num\\\\\\":\\\\\\"1\\\\\\"}\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\",\\n \\"AlertStatus\\": \\"1\\",\\n \\"InvestigationReport\\": \\"{\\\\\\"agent_attack_confidence\\\\\\": 90, \\\\\\"agent_judgement_category\\\\\\": \\\\\\"false_positive\\\\\\", \\\\\\"reason\\\\\\": \\\\\\"The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.\\\\\\", \\\\\\"start_time\\\\\\": 1774929064, \\\\\\"end_time\\\\\\": 1774929071}\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + 'title' => 'DescribeAlerts', + 'changeSet' => [ + ['createdAt' => '2025-04-25T07:53:21.000Z', 'description' => 'Response parameters changed'], + ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'security' => [ - [ - 'AK' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlerts'], ], ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], - 'parameters' => [ + 'ramActions' => [ [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'enumValueTitles' => [ - 'ap-southeast-1' => '', - 'cn-hangzhou' => '', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlerts', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], ], - 'example' => 'cn-hangzhou', ], ], ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemResponse'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the SIEM system is granted the required permissions. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'enumValueTitles' => [], - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '4F539347-7D9A-51EA-8ABF-5D5507045C5C', - ], - ], - ], - ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - ], - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"4F539347-7D9A-51EA-8ABF-5D5507045C5C\\"\\n}","type":"json"}]', - 'title' => 'DescribeAuth', ], - 'DeleteDataSourceLog' => [ - 'summary' => 'Removes a log.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'DescribeAlertsCount' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'LogInstanceId', + 'name' => 'QueryType', 'in' => 'formData', - 'schema' => [ - 'title' => '日志ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of logs.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1', - ], + 'schema' => ['title' => '', 'description' => 'The query type.', 'type' => 'string', 'required' => false, 'example' => 'bySrcProd'], ], [ - 'name' => 'DataSourceInstanceId', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'schema' => ['title' => '', 'description' => 'The start time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ - 'name' => 'AccountId', + 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The end time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ - 'name' => 'CloudCode', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'enumValueTitles' => [], - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to query alerts from the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the data management center. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<DeleteDataSourceLogResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'PlainResponse<CloudSiemAlertCounter>', + 'description' => 'PlainResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'Count' => [ - 'title' => '删除的日志的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of logs that are removed. The value 1 indicates that the log is removed, and a value less than or equal to 0 indicates that the log failed to be removed.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'LogInstanceId' => [ - 'title' => '日志ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1', + 'High' => ['title' => '', 'description' => 'The number of high-risk alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '25'], + 'Medium' => ['title' => '', 'description' => 'The number of medium-risk alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '25'], + 'Low' => ['title' => '', 'description' => 'The number of low-risk alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '25'], + 'All' => ['title' => '', 'description' => 'The total number of alerts.', 'type' => 'integer', 'format' => 'int64', 'example' => '75'], + 'ProductNum' => ['title' => '', 'description' => 'The number of connected products.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + 'CountMap' => [ + 'type' => 'object', + 'additionalProperties' => ['type' => 'integer', 'format' => 'int64', 'description' => 'The value.', 'title' => '', 'example' => '12'], + 'description' => 'The number of alerts for each severity level.', + 'title' => '', + 'example' => '', ], ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DeleteDataSourceLog', - ], - 'DeleteDataSource' => [ - 'summary' => 'Removes a data source that is no longer required.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAlertsCount', + 'summary' => 'Queries the count of alerts for different severity levels.', + 'changeSet' => [ + ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsCount'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertsCount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"High\\": 25,\\n \\"Medium\\": 25,\\n \\"Low\\": 25,\\n \\"All\\": 75,\\n \\"ProductNum\\": 3,\\n \\"CountMap\\": {\\n \\"key\\": 12\\n }\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAlertsWithEntity' => [ + 'summary' => 'Queries for alerts that are associated with an entity.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], ], 'parameters' => [ [ - 'name' => 'DataSourceInstanceId', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'schema' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ - 'name' => 'AccountId', + 'name' => 'SophonTaskId', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Security Orchestration, Automation, and Response (SOAR) handling policy.', 'type' => 'string', 'required' => false, 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa'], ], [ - 'name' => 'CloudCode', + 'name' => 'EntityId', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'enumValueTitles' => [], - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['title' => '', 'description' => 'The ID of the entity.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], + ], + [ + 'name' => 'EntityUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the entity.', 'type' => 'string', 'required' => false, 'example' => '123456789'], + ], + [ + 'name' => 'StartTime', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The start time of the query. The unit is milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], + ], + [ + 'name' => 'EndTime', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The end time of the query. The unit is milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], + ], + [ + 'name' => 'CurrentPage', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The number of the page to return. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The number of entries to return on each page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the view. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that are managed by your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member to which the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: your assets are in the Chinese mainland and China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<DeleteDataSourceResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'PageResponse<List<AlertDetail>>', + 'description' => 'PageResponse\\<List\\<AlertDetail>>', 'type' => 'object', 'properties' => [ + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'Count' => [ - 'title' => '删除的数据源的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of data sources that are removed. The value 1 indicates that data source is removed, and a value less than or equal to 0 indicates that the data source failed to be removed.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', + 'PageInfo' => [ + 'title' => '', + 'description' => 'The pagination information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], + ], + 'example' => '', + ], + 'ResponseData' => [ + 'title' => '', + 'description' => 'The detailed data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Id' => ['title' => '', 'description' => 'The unique ID of the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the alert was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the alert was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used for threat analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'IncidentUuid' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'AlertUuid' => ['title' => '', 'description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'], + 'LogTime' => ['title' => '', 'description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'AlertSrcProd' => ['title' => '', 'description' => 'The source product of the alert.', 'type' => 'string', 'example' => 'sas'], + 'AlertTitle' => ['title' => '', 'description' => 'The title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password'], + 'AlertTitleEn' => ['title' => '', 'description' => 'The English title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password'], + 'AlertType' => ['title' => '', 'description' => 'The type of the alert.', 'type' => 'string', 'example' => 'Scan'], + 'AlertTypeEn' => ['title' => '', 'description' => 'The English type of the alert.', 'type' => 'string', 'example' => 'Scan'], + 'AlertTypeCode' => ['title' => '', 'description' => 'The Medusa code of the alert type.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshellName'], + 'AlertName' => ['title' => '', 'description' => 'The name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password'], + 'AlertNameEn' => ['title' => '', 'description' => 'The name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password'], + 'AlertNameCode' => ['title' => '', 'description' => 'The Medusa code of the alert name.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell'], + 'AlertLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'example' => 'remind'], + 'AssetList' => ['title' => '', 'description' => 'The list of assets.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "is_main_asset": "1",'."\n" + .' "asset_name": "47.245.*",'."\n" + .' "port": "22",'."\n" + .' "ip": "47.245.*",'."\n" + .' "asset_type": "ip",'."\n" + .' "location": "ap-southeast-1",'."\n" + .' "asset_id": "47.245.*",'."\n" + .' "net_connect_dir": "in"'."\n" + .' }'."\n" + .']'], + 'OccurTime' => ['title' => '', 'description' => 'The time when the alert occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'StartTime' => ['title' => '', 'description' => 'The time when the alert first occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'EndTime' => ['title' => '', 'description' => 'The time when the alert ended.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'AlertSrcProdModule' => ['title' => '', 'description' => 'The submodule of the alert source.', 'type' => 'string', 'example' => 'waf'], + 'AlertDesc' => ['title' => '', 'description' => 'The description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'], + 'AlertDescEn' => ['title' => '', 'description' => 'The English description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'], + 'AlertDescCode' => ['title' => '', 'description' => 'The Medusa code of the alert description.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell'."\n"], + 'AlertDetail' => ['title' => '', 'description' => 'The details of the alert.', 'type' => 'string', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}'], + 'LogUuid' => ['title' => '', 'description' => 'The UUID of the alert log.', 'type' => 'string', 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****'], + 'EntityList' => ['title' => '', 'description' => 'The details of the entity. The entity is standardized and indexed.', 'type' => 'string', 'example' => '[{"entity_uuid":"55f0c0654d7e79b035a5168fcb4****","entity_type":"cloud_account","account_id":"15176874502****","main_user_id":"15176874502****","cloud_code":"alibaba_cloud","is_asset":1,"entity_id":"151768745029****"}]'], + 'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK tag.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that generated the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***'], + 'SubUserName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account that generated the alert.', 'type' => 'string', 'example' => '176555323***'], + 'IsDefend' => ['title' => '', 'description' => 'Indicates whether the threat is defended. Valid values:'."\n" + ."\n" + .'- 0: detected'."\n" + ."\n" + .'- 1: blocked', 'type' => 'string', 'example' => '1'], + 'AlertInfoList' => [ + 'title' => '', + 'description' => 'The detailed information about the alert.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Key' => ['title' => '', 'description' => 'The key of the alert property.', 'type' => 'string', 'example' => 'suspicious.wbd.wb.trojanpath'], + 'KeyName' => ['title' => '', 'description' => 'The name of the detailed alert data.', 'type' => 'string', 'example' => 'Trojan Path'."\n"], + 'Values' => ['title' => '', 'description' => 'The value of the detailed alert data.', 'type' => 'string', 'example' => '/root/test33.php'], + ], + 'description' => 'The detailed information about the alert.', + 'title' => '', + 'example' => '', + ], + 'example' => 'aliyun', + ], + 'CloudCode' => ['title' => '', 'description' => 'The cloud service provider. Valid values:'."\n" + ."\n" + .'- aliyun: Alibaba Cloud'."\n" + ."\n" + .'- qcloud: Tencent Cloud'."\n" + ."\n" + .'- hcloud: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun'], + 'ProductId' => ['type' => 'string', 'description' => 'The product ID.', 'title' => '', 'example' => 'alibaba_cloud_sas'], + 'VendorId' => ['type' => 'string', 'description' => 'The cloud service provider. Valid values:'."\n" + ."\n" + .'- aliyun: Alibaba Cloud'."\n" + ."\n" + .'- qcloud: Tencent Cloud'."\n" + ."\n" + .'- hcloud: Huawei Cloud', 'title' => '', 'example' => 'aliyun'], + 'DetectionRuleId' => ['type' => 'string', 'description' => 'The ID of the detection rule.', 'title' => '', 'example' => 'dr-48zs4tk7qfd4rjd9****'], + ], + 'description' => 'The detailed data.', + 'title' => '', + 'example' => '', + ], + 'example' => '', ], ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DeleteDataSource', - ], - 'DeleteBindAccount' => [ - 'summary' => 'Removes a third-party cloud account that is added to the threat analysis feature by using its AccessKey ID. You can add another cloud account based on your business requirements.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"MainUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertType\\": \\"Scan\\",\\n \\"AlertTypeEn\\": \\"Scan\\",\\n \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertLevel\\": \\"remind\\",\\n \\"AssetList\\": \\"[\\\\n {\\\\n \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n }\\\\n]\\",\\n \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n \\"EntityList\\": \\"[{\\\\\\"entity_uuid\\\\\\":\\\\\\"55f0c0654d7e79b035a5168fcb4****\\\\\\",\\\\\\"entity_type\\\\\\":\\\\\\"cloud_account\\\\\\",\\\\\\"account_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"main_user_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"cloud_code\\\\\\":\\\\\\"alibaba_cloud\\\\\\",\\\\\\"is_asset\\\\\\":1,\\\\\\"entity_id\\\\\\":\\\\\\"151768745029****\\\\\\"}]\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"176555323***\\",\\n \\"IsDefend\\": \\"1\\",\\n \\"AlertInfoList\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"VendorId\\": \\"aliyun\\",\\n \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + 'title' => 'DescribeAlertsWithEntity', + 'changeSet' => [ + ['createdAt' => '2024-11-04T11:26:51.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEntity'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertsWithEntity', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + ], + 'DescribeAlertsWithEvent' => [ + 'summary' => 'Retrieves alerts associated with a specific event.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeCode' => '194688', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ - 'name' => 'BindId', + 'name' => 'IncidentUuid', + 'in' => 'formData', + 'schema' => ['description' => 'The incident ID.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => '', 'required' => false], + ], + [ + 'name' => 'Level', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '绑定ID。', - 'description' => 'The ID generated when the account is added to the threat analysis feature. You can call the [ListBindAccount](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListBindAccount) operation to query the ID.'."\n", - 'type' => 'integer', - 'format' => 'int64', + 'title' => '', + 'description' => 'The threat level. The value is a JSON array. Valid values:'."\n" + ."\n" + .'- `serious`: high'."\n" + ."\n" + .'- `suspicious`: medium'."\n" + ."\n" + .'- `remind`: low', + 'type' => 'array', + 'items' => ['description' => 'The threat level. The value is a JSON array. Valid values:'."\n" + ."\n" + .'- `serious`: high'."\n" + ."\n" + .'- `suspicious`: medium'."\n" + ."\n" + .'- `remind`: low', 'type' => 'string', 'required' => false, 'example' => '["remind","serious"]'."\n", 'title' => ''], 'required' => false, - 'example' => '10', + 'example' => '["serious","suspicious","remind"]', + 'maxItems' => 100, ], ], [ - 'name' => 'AccountId', + 'name' => 'AlertTitle', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['description' => 'The title of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Scan-Try SNMP weak password'."\n"], ], [ - 'name' => 'AccessId', + 'name' => 'AlertType', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号AccessKeyId。', - 'description' => 'The AccessKey ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'ABCXXXXXXXX', - ], + 'schema' => ['description' => 'The type of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Scan'], ], [ - 'name' => 'CloudCode', + 'name' => 'AlertName', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'schema' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Try SNMP weak password'], ], [ - 'name' => 'RegionId', + 'name' => 'AssetName', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The name of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'hostname-****'], ], [ - 'name' => 'RoleType', + 'name' => 'AssetId', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The ID of the asset.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '09414e9ebaa9c19b84d851abb91d****'], ], [ - 'name' => 'RoleFor', + 'name' => 'EntityName', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The name of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'launch-advisor-*****'], ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<DeleteBindAccountResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'Count' => [ - 'title' => '删除账号绑定的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of cloud accounts that are removed. The value 1 indicates that cloud account is removed, and a value less than or equal to 0 indicates that the cloud account failed to be removed.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - ], - ], + [ + 'name' => 'EntityId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the entity.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '21034e803f492b926cea9e5beab4****'], ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + [ + 'name' => 'SubUserId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the account that is associated with the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => '', 'required' => false], ], - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'DeleteBindAccount', - ], - 'BindAccount' => [ - 'summary' => 'Adds a third-party cloud account that is displayed on the Multi-cloud assets tab of the Feature Settings page to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'Source', + 'in' => 'formData', + 'schema' => ['description' => 'The data source of the alert.', 'type' => 'string', 'example' => 'sas', 'title' => '', 'required' => false], ], - ], - 'operationType' => 'write', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '194690', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', + [ + 'name' => 'IsDefend', + 'in' => 'formData', + 'schema' => ['description' => 'Indicates whether the attack is defended. Valid values:'."\n" + ."\n" + .'- `0`: detected'."\n" + ."\n" + .'- `1`: blocked', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '1'], ], - ], - 'parameters' => [ [ - 'name' => 'AccessId', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号AccessKeyId。', - 'description' => 'The AccessKey ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'ABCXXXXXXXX', - ], + 'schema' => ['description' => 'The start of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], ], [ - 'name' => 'AccountName', + 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => '多云账号名称。', - 'description' => 'The username of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'xxxx', - ], + 'schema' => ['description' => 'The end of the time range to query. This value is a UNIX timestamp representing the number of milliseconds that have elapsed since January 1, 1970, 00:00:00 UTC.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], ], [ - 'name' => 'AccountId', + 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['description' => 'The page number. Pages start from page 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''], ], [ - 'name' => 'CloudCode', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n" - .'* qcloud: Tencent Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'enumValueTitles' => [], - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'schema' => ['description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], ], [ - 'name' => 'RegionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The entity of the alert. Valid values:'."\n" + ."\n" + .'- `0`: the current Alibaba Cloud account.'."\n" + ."\n" + .'- `1`: all members in the resource directory.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The ID of the member in the resource directory.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'RoleType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The region in which the data management center of Threat Analysis resides. You can determine the region based on the region in which your assets reside. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: Your assets reside in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- `ap-southeast-1`: Your assets reside in regions outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<BindAccountResult>', - 'description' => 'The response parameters.'."\n", + 'title' => 'PageResponse<List<AlertDetail>>', + 'description' => 'A paginated response that contains a list of alerts.', 'type' => 'object', 'properties' => [ + 'Success' => ['description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- `true`: The request was successful.'."\n" + ."\n" + .'- `false`: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Code' => ['description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''], + 'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The response payload.', 'type' => 'object', 'properties' => [ - 'Count' => [ - 'title' => '添加账号绑定的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of the cloud accounts that are added to the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', + 'PageInfo' => [ + 'title' => '', + 'description' => 'The pagination information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''], + ], + 'example' => '', + ], + 'ResponseData' => [ + 'title' => '', + 'description' => 'The details of the alerts.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Id' => ['description' => 'The unique ID of the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789', 'title' => ''], + 'GmtCreate' => ['description' => 'The time when the alert was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'GmtModified' => ['description' => 'The time when the alert was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'MainUserId' => ['description' => 'The ID of the main account associated with the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****', 'title' => ''], + 'IncidentUuid' => ['description' => 'The universally unique identifier (UUID) of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''], + 'AlertUuid' => ['description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''], + 'LogTime' => ['description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'AlertSrcProd' => ['description' => 'The source product of the alert.', 'type' => 'string', 'example' => 'sas', 'title' => ''], + 'AlertTitle' => ['description' => 'The title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''], + 'AlertTitleEn' => ['description' => 'The English title of the alert.', 'type' => 'string', 'example' => 'Scan-Try SNMP weak password', 'title' => ''], + 'AlertType' => ['description' => 'The type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''], + 'AlertTypeEn' => ['description' => 'The English type of the alert.', 'type' => 'string', 'example' => 'Scan', 'title' => ''], + 'AlertTypeCode' => ['description' => 'The Medusa code of the alert type.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshellName', 'title' => ''], + 'AlertName' => ['description' => 'The name of the alert.', 'type' => 'string', 'title' => '', 'example' => 'Try SNMP weak password'], + 'AlertNameEn' => ['description' => 'The English name of the alert.', 'type' => 'string', 'example' => 'Try SNMP weak password', 'title' => ''], + 'AlertNameCode' => ['description' => 'The Medusa code of the alert name.', 'type' => 'string', 'example' => 'security_event_config.event_name.webshell', 'title' => ''], + 'AlertLevel' => ['description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- `serious`: high'."\n" + ."\n" + .'- `suspicious`: medium'."\n" + ."\n" + .'- `remind`: low', 'type' => 'string', 'example' => 'remind', 'title' => ''], + 'AssetList' => ['description' => 'A JSON-formatted string that lists the assets associated with the alert.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "is_main_asset": "1",'."\n" + .' "asset_name": "47.245.*",'."\n" + .' "port": "22",'."\n" + .' "ip": "47.245.*",'."\n" + .' "asset_type": "ip",'."\n" + .' "location": "ap-southeast-1",'."\n" + .' "asset_id": "47.245.*",'."\n" + .' "net_connect_dir": "in"'."\n" + .' }'."\n" + .']', 'title' => ''], + 'OccurTime' => ['description' => 'The time when the alert occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'StartTime' => ['description' => 'The time when the alert first occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'EndTime' => ['description' => 'The end time of the alert.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'AlertSrcProdModule' => ['description' => 'The submodule of the source product.', 'type' => 'string', 'example' => 'waf', 'title' => ''], + 'AlertDesc' => ['description' => 'The description of the alert.', 'type' => 'string', 'title' => '', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.'], + 'AlertDescEn' => ['description' => 'The English description of the alert.', 'type' => 'string', 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', 'title' => ''], + 'AlertDescCode' => ['description' => 'The Medusa code of the alert description.', 'type' => 'string', 'title' => '', 'example' => 'security_event_config.event_name.webshell'."\n"], + 'AlertDetail' => ['description' => 'A JSON-formatted string that contains the alert details.', 'type' => 'string', 'title' => '', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}'], + 'LogUuid' => ['description' => 'The UUID of the alert log.', 'type' => 'string', 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', 'title' => ''], + 'EntityList' => ['description' => 'A JSON-formatted string that lists the entities involved in the alert.', 'type' => 'string', 'title' => '', 'example' => '[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]'], + 'AttCk' => ['description' => 'The ATT\\&CK tag.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning', 'title' => ''], + 'SubUserId' => ['description' => 'The ID of the sub-account that generated the alert.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => ''], + 'SubUserName' => ['description' => 'The name of the sub-account that generated the alert.', 'type' => 'string', 'example' => '176555323***', 'title' => ''], + 'CloudCode' => ['description' => 'The cloud service provider. Valid values:'."\n" + ."\n" + .'- `aliyun`: Alibaba Cloud'."\n" + ."\n" + .'- `qcloud`: Tencent Cloud'."\n" + ."\n" + .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''], + 'IsDefend' => ['description' => 'Indicates whether the attack was blocked. Valid values:'."\n" + ."\n" + .'- `0`: detected'."\n" + ."\n" + .'- `1`: blocked', 'type' => 'string', 'title' => '', 'example' => '1'], + 'AlertInfoList' => [ + 'title' => '', + 'description' => 'A list of objects that contain detailed alert attributes.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Key' => ['description' => 'The key of the alert attribute.', 'type' => 'string', 'title' => '', 'example' => 'suspicious.wbd.wb.trojanpath'], + 'KeyName' => ['description' => 'The display name of the alert attribute.', 'type' => 'string', 'title' => '', 'example' => 'Trojan Path'."\n"], + 'Values' => ['description' => 'The value of the alert attribute.', 'type' => 'string', 'example' => '/root/test33.php', 'title' => ''], + ], + 'description' => 'An object that contains the attributes of a specific alert detail.', + 'title' => '', + 'example' => '', + ], + 'example' => 'aliyun', + ], + 'ExtendContent' => ['description' => 'A JSON-formatted string that contains extended information about the alert.', 'type' => 'string', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99****"}', 'title' => ''], + 'ProductId' => ['description' => 'The cloud service ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'VendorId' => ['description' => 'The cloud service provider. Valid values:'."\n" + ."\n" + .'- `aliyun`: Alibaba Cloud'."\n" + ."\n" + .'- `qcloud`: Tencent Cloud'."\n" + ."\n" + .'- `hcloud`: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun', 'title' => ''], + 'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-48zs4tk7qfd4rjd9****', 'title' => ''], + 'InvestigationReport' => ['description' => 'A JSON-formatted string that contains the investigation report for the alert.', 'type' => 'string', 'example' => '{"agent_attack_confidence": 90, "agent_judgement_category": "false_positive", "reason": "The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.", "start_time": 1774929064, "end_time": 1774929071}', 'title' => ''], + ], + 'description' => 'The details of the alert.', + 'title' => '', + 'example' => '', + ], + 'example' => '', ], ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'InvalidOperation', - 'errorMessage' => 'access ak "%s" already bound.', - ], - ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"MainUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertType\\": \\"Scan\\",\\n \\"AlertTypeEn\\": \\"Scan\\",\\n \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertLevel\\": \\"remind\\",\\n \\"AssetList\\": \\"[\\\\n {\\\\n \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n }\\\\n]\\",\\n \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n \\"EntityList\\": \\"[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"176555323***\\",\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"IsDefend\\": \\"1\\",\\n \\"AlertInfoList\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"ExtendContent\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99****\\\\\\"}\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"VendorId\\": \\"aliyun\\",\\n \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\",\\n \\"InvestigationReport\\": \\"{\\\\\\"agent_attack_confidence\\\\\\": 90, \\\\\\"agent_judgement_category\\\\\\": \\\\\\"false_positive\\\\\\", \\\\\\"reason\\\\\\": \\\\\\"The command line contains \'mediacenter\' which is a normal startup behavior of Lark (Feishu) client, and the process path is in the standard user installation directory.\\\\\\", \\\\\\"start_time\\\\\\": 1774929064, \\\\\\"end_time\\\\\\": 1774929071}\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + 'title' => 'DescribeAlertsWithEvent', + 'changeSet' => [ + ['createdAt' => '2025-04-25T07:53:21.000Z', 'description' => 'Response parameters changed'], + ['createdAt' => '2024-11-04T11:26:50.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEvent'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAlertsWithEvent', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'BindAccount', ], - 'AddUserSourceLogConfig' => [ - 'summary' => 'Adds the logs of a cloud service within a cloud account to the threat analysis feature for alert and event anslysis.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'DescribeAuth' => [ + 'summary' => 'Checks whether an Alibaba Cloud account has granted permissions to Cloud SIEM and the AliyunServiceRoleForSasCloudSiem role has been created.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'SourceProdCode', + 'name' => 'RegionId', 'in' => 'formData', 'schema' => [ - 'title' => '产品code。', - 'description' => 'The code of the cloud service.'."\n", + 'title' => '', + 'description' => 'The region of the threat analysis center. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this value if your assets are deployed in the Chinese mainland or the China (Hong Kong) region.'."\n" + ."\n" + .'- ap-southeast-1: Select this value if your assets are deployed in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, - 'example' => 'sas', + 'enumValueTitles' => ['ap-southeast-1' => 'Singapore', 'cn-hangzhou' => 'China (Hangzhou)'], + 'example' => 'cn-hangzhou', ], ], - [ - 'name' => 'SourceLogCode', - 'in' => 'formData', + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '日志code。', - 'description' => 'The log code.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_aegis_proc', + 'title' => 'CloudSiemSuccessResponse<Boolean>', + 'description' => 'CloudSiemResponse', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'title' => '', + 'description' => 'Indicates whether the permissions are granted.'."\n" + ."\n" + .'- true: The permissions are granted.'."\n" + ."\n" + .'- false: The permissions are not granted.', + 'type' => 'boolean', + 'enumValueTitles' => [], + 'example' => 'true', + ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '4F539347-7D9A-51EA-8ABF-5D5507045C5C'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 500 => [ + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ], + ], + 'title' => 'DescribeAuth', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '15', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAuth'], + ], + ], + 'ramActions' => [ [ - 'name' => 'SubUserId', - 'in' => 'formData', - 'schema' => [ - 'title' => '需要接入日志的阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '123XXXXXX', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAuth', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"4F539347-7D9A-51EA-8ABF-5D5507045C5C\\"\\n}","type":"json"}]', + ], + 'DescribeAutomateResponseConfigCounter' => [ + 'summary' => 'Returns the number of automated response rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'SourceLogInfo', - 'in' => 'formData', - 'schema' => [ - 'title' => '需要接入日志的详细SLS信息，json数组格式。', - 'description' => 'The details of the Logstore that you want to use in the JSON string format.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '{"project":"wafnew-project-1335759343513432-cn-hangzhou","logStore":"wafnew-logstore","regionCode":"cn-hangzhou","prodCode":"waf"}', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'DisPlayLine', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '需要接入日志的详细SLS信息。', - 'description' => 'The display details of the Logstore.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-shanghai.siem-project.siem-logstore', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'Deleted', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '添加接入或删除接入。取值：'."\n" - .'-1：删除接入 '."\n" - .'0：添加接入', - 'description' => 'Specifies whether to add logs or delete added logs. Valid values:'."\n" - ."\n" - .'* \\-1: deletes added logs.'."\n" - .'* 0: adds logs.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['description' => 'The user ID of the member whose view the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Management Hub. Select the region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<UserSourceLogResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<AutomateResponseCounter>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'DiplayLine' => [ - 'title' => '需要接入日志的详细SLS信息。', - 'description' => 'The display details of the Logstore.'."\n", - 'type' => 'string', - 'example' => 'cn-shanghai.siem-project.siem-logstore', - ], - 'SourceProdCode' => [ - 'title' => '产品code。', - 'description' => 'The code of the cloud service.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'SourceLogCode' => [ - 'title' => '日志code。', - 'description' => 'The log code.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_proc', - ], - 'Displayed' => [ - 'title' => '返回接入详细信息。取值：'."\n" - .' - true：已接入。'."\n" - .' - 未接入：false。', - 'description' => 'Indicates whether the details of added logs are returned. Valid values: true false'."\n", - 'type' => 'boolean', - 'example' => '0', - ], - 'Imported' => [ - 'title' => '是否已经接入。取值：'."\n" - .' - true：已接入。'."\n" - .' - 未接入：false。', - 'description' => 'Indicates whether the logs are added to the threat analysis feature. Valid values: true false'."\n", - 'type' => 'boolean', - 'example' => '0', - ], - 'MainUserId' => [ - 'title' => '购买威胁分析的阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXXX', - ], - 'SubUserId' => [ - 'title' => '威胁分析阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123XXXXXXXX', - ], - 'SubUserName' => [ - 'title' => '威胁分析阿里云账号名字。', - 'description' => 'The username of the Alibaba Cloud account that can be used to perform operations supported by the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxx', - ], + 'All' => ['title' => '', 'description' => 'The total number of rules.', 'type' => 'integer', 'format' => 'int64', 'example' => '20'], + 'Online' => ['title' => '', 'description' => 'The number of enabled rules.', 'type' => 'integer', 'format' => 'int64', 'example' => '10'], ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"DiplayLine\\": \\"cn-shanghai.siem-project.siem-logstore\\",\\n \\"SourceProdCode\\": \\"sas\\",\\n \\"SourceLogCode\\": \\"cloud_siem_aegis_proc\\",\\n \\"Displayed\\": true,\\n \\"Imported\\": true,\\n \\"MainUserId\\": 0,\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxx\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'AddUserSourceLogConfig', - ], - 'AddDataSourceLog' => [ - 'summary' => 'Adds logs of a cloud account to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAutomateResponseConfigCounter', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigCounter'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAutomateResponseConfigCounter', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"All\\": 20,\\n \\"Online\\": 10\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeAutomateResponseConfigFeature' => [ + 'summary' => 'Retrieves the configurable fields and operators for automated response rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'LogCode', - 'in' => 'formData', - 'schema' => [ - 'title' => '日志code。', - 'description' => 'The log code.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_waf_xxxxx', - ], - ], - [ - 'name' => 'DataSourceInstanceId', + 'name' => 'AutoResponseType', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters. You can call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to query the IDs of data sources.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', - ], + 'schema' => ['title' => '', 'description' => 'The type of automated response. Valid values:'."\n" + ."\n" + .'- event: event'."\n" + ."\n" + .'- alert: alert', 'type' => 'string', 'required' => false, 'example' => 'event'], ], [ - 'name' => 'DataSourceInstanceLogs', - 'in' => 'formData', - 'schema' => [ - 'title' => '数据源参数详情，json数组格式。', - 'description' => 'The parameters of the data source. Set this parameter to a JSON array.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]', - ], - ], - [ - 'name' => 'AccountId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '123xxxxxxx', - ], + 'schema' => ['description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that are managed by the administrator account.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'CloudCode', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets in the Chinese mainland and Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Assets outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<AddDataSourceLogResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'BaseResponse<List<AutomateResponseConfigFeature>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'Count' => [ - 'title' => '添加的日志的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of logs that are added. The value 1 indicates that the log is added, and a value less than or equal to 0 indicates that the log failed to be added.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'LogInstanceId' => [ - 'title' => '日志ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the log. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1', + 'title' => '', + 'description' => 'The returned data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Feature' => ['title' => '', 'description' => 'The name of the condition field for the automated response rule.', 'type' => 'string', 'example' => 'alert_desc'], + 'DataType' => ['title' => '', 'description' => 'The data type of the condition field for the automated response rule.', 'type' => 'string', 'example' => 'varchar'], + 'SupportOperators' => [ + 'title' => '', + 'description' => 'The operators that the field supports.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'HasRightValue' => ['title' => '', 'description' => 'Indicates whether a right operand is required. Valid values:'."\n" + ."\n" + .'- true: A right operand is required.'."\n" + ."\n" + .'- false: A right operand is not required.', 'type' => 'boolean', 'example' => 'false'], + 'Operator' => ['title' => '', 'description' => 'The operator.', 'type' => 'string', 'example' => '<='], + 'OperatorName' => ['title' => '', 'description' => 'The display name of the operator.', 'type' => 'string', 'example' => '<='], + 'OperatorDescCn' => ['title' => '', 'description' => 'The description of the operator in Chinese.', 'type' => 'string', 'example' => 'larger than or equal to'], + 'OperatorDescEn' => ['title' => '', 'description' => 'The description of the operator in English.', 'type' => 'string', 'example' => 'larger than or equal to'], + 'SupportDataType' => ['title' => '', 'description' => 'The data types that the operator supports. Multiple data types are separated by commas.', 'type' => 'string', 'example' => 'varchar'], + 'SupportTag' => [ + 'title' => '', + 'description' => 'The scenarios that the operator supports. Multiple scenarios are separated by commas, such as aggregation. By default, this parameter is empty.', + 'type' => 'array', + 'items' => ['description' => 'The supported scenario.', 'type' => 'string', 'title' => '', 'example' => '[AGGREGATE]'], + 'example' => '[AGGREGATE]', + ], + 'Index' => ['title' => '', 'description' => 'The position of the operator in the list of operators.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + 'RightValueEnums' => [ + 'title' => '', + 'description' => 'The enumeration of the right operand that corresponds to the field.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Value' => ['title' => '', 'description' => 'The enumeration value of the right operand.', 'type' => 'string', 'example' => 'serious'], + 'ValueMds' => ['title' => '', 'description' => 'The Medusa code for the enumeration value of the right operand.', 'type' => 'string', 'example' => 'aliyun.siem.automate.feature.alert_level.serious'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request is successful. Valid values:'."\n" + ."\n" + .'- true: The request is successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"LogInstanceId\\": \\"ef33097c9d1fdb0b9c7e8c7ca320pkl1\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'AddDataSourceLog', - ], - 'AddDataSource' => [ - 'summary' => 'Adds a data source to a cloud account that is added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeAutomateResponseConfigFeature', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigFeature'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeAutomateResponseConfigFeature', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Feature\\": \\"alert_desc\\",\\n \\"DataType\\": \\"varchar\\",\\n \\"SupportOperators\\": [\\n {\\n \\"HasRightValue\\": false,\\n \\"Operator\\": \\"<=\\",\\n \\"OperatorName\\": \\"<=\\",\\n \\"OperatorDescCn\\": \\"larger than or equal to\\",\\n \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n \\"SupportDataType\\": \\"varchar\\",\\n \\"SupportTag\\": [\\n \\"[AGGREGATE]\\"\\n ],\\n \\"Index\\": 3\\n }\\n ],\\n \\"RightValueEnums\\": [\\n {\\n \\"Value\\": \\"serious\\",\\n \\"ValueMds\\": \\"aliyun.siem.automate.feature.alert_level.serious\\"\\n }\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeCloudSiemAssets' => [ + 'summary' => 'Queries a list of assets that are associated with an event.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'AccountId', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '123xxxxxxxx', - ], + 'schema' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ - 'name' => 'DataSourceType', + 'name' => 'AssetType', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源类型。取值：'."\n" - .' - obs：华为云obs。'."\n" - .' - wafApi：腾讯云waf下载api。 '."\n" - .' - ckafka： 腾讯云ckafka。', - 'description' => 'The type of the data source. Valid values:'."\n" - ."\n" - .'* obs: Huawei Cloud Object Storage Service (OBS)'."\n" - .'* wafApi: download API of Tencent Cloud Web Application Firewall (WAF)'."\n" - .'* ckafka: Tencent Cloud Kafka (CKafka)'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'obs', - ], + 'schema' => ['title' => '', 'description' => 'The asset type. Valid values:'."\n" + ."\n" + .'- ip: IP address'."\n" + ."\n" + .'- domain: domain name'."\n" + ."\n" + .'- url: URL'."\n" + ."\n" + .'- process: process'."\n" + ."\n" + .'- file: file'."\n" + ."\n" + .'- host: host', 'type' => 'string', 'required' => false, 'example' => 'ip'], ], [ - 'name' => 'DataSourceInstanceName', + 'name' => 'AssetName', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源名称。', - 'description' => 'The name of the data source.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'beijing_waf_kafka', - ], + 'schema' => ['title' => '', 'description' => 'The asset name.', 'type' => 'string', 'required' => false, 'example' => 'test123'], ], [ - 'name' => 'DataSourceInstanceRemark', + 'name' => 'AssetUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源备注。', - 'description' => 'The remarks on the data source.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'waf_alert_log', - ], + 'schema' => ['title' => '', 'description' => 'The UUID of the asset.', 'type' => 'string', 'required' => false, 'example' => '123456-2222-3333-5555-3435345****'], ], [ - 'name' => 'DataSourceInstanceParams', + 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '数据源参数，json数组格式。', - 'description' => 'The parameters of the data source. Set this parameter to a JSON array.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]', - ], + 'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], ], [ - 'name' => 'CloudCode', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider.'."\n" - ."\n" - .'Valid values:'."\n" - ."\n" - .'* qcloud'."\n" - .'* hcloud'."\n" - .'* aliyun'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], + 'schema' => ['title' => '', 'description' => 'The number of entries to return on each page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member whose data you want to view. This parameter is available only when an administrator wants to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is deployed. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: assets in the Chinese mainland or China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<AddDataSourceResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", + 'title' => 'PageResponse<List<AssetInfo>>', + 'description' => 'PageResponse\\<List>', 'type' => 'object', 'properties' => [ + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'Count' => [ - 'title' => '添加数据源的数量，等于1表示成功，小于等于0表示失败。', - 'description' => 'The number of data sources that are added. The value 1 indicates that data source is added, and a value less than or equal to 0 indicates that the data source failed to be added.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', + 'PageInfo' => [ + 'title' => '', + 'description' => 'The pagination information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], + ], + 'example' => '', ], - 'DataSourceInstanceId' => [ - 'title' => '数据源ID，由威胁分析根据具体参数计算md5生成。', - 'description' => 'The ID of the data source. The ID is an MD5 hash value that is calculated by the threat analysis feature based on specific parameters.'."\n", - 'type' => 'string', - 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea', + 'ResponseData' => [ + 'title' => '', + 'description' => 'The detailed data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Id' => ['title' => '', 'description' => 'The asset ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the asset was synchronized.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the asset was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '1276085894174392'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the linked account.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***'], + 'IncidentUuid' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'AlertUuid' => ['title' => '', 'description' => 'The UUID of the alert that is associated with the event.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'], + 'AssetName' => ['title' => '', 'description' => 'The asset name.', 'type' => 'string', 'example' => 'zsw-agentless-centos****'], + 'AssetType' => ['title' => '', 'description' => 'The asset type. Valid values:'."\n" + ."\n" + .'- ip: IP address'."\n" + ."\n" + .'- domain: domain name'."\n" + ."\n" + .'- url: URL'."\n" + ."\n" + .'- process: process'."\n" + ."\n" + .'- file: file'."\n" + ."\n" + .'- host: host', 'type' => 'string', 'example' => 'domain'], + 'AssetInfo' => [ + 'title' => '', + 'description' => 'The asset information, in a JSON array.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Key' => ['title' => '', 'description' => 'The key of the alert property.', 'type' => 'string', 'example' => 'suspicious.wbd.wb.trojanpath'], + 'KeyName' => ['title' => '', 'description' => 'The name of the alert property.', 'type' => 'string', 'example' => 'Trojan Path'], + 'Values' => ['title' => '', 'description' => 'The value of the alert property.', 'type' => 'string', 'example' => '/root/test33.php'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '[{"KeyName": "${aliyun.siem.asset.asset_name}","Values": "zsw-agentless-ubuntu20","Key": "asset_name"}]', + ], + 'AssetId' => ['title' => '', 'description' => 'The logical ID of the asset.', 'type' => 'string', 'example' => '0616caeb-acb8-45e0-8520-4ee5fbe251f0'], + 'CloudCode' => ['title' => '', 'description' => 'The cloud service provider of the entity. Valid values:'."\n" + ."\n" + .'- aliyun: Alibaba Cloud'."\n" + ."\n" + .'- qcloud: Tencent Cloud'."\n" + ."\n" + .'- hcloud: Huawei Cloud', 'type' => 'string', 'example' => 'aliyun'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '', ], ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeCloudSiemAssets', + 'changeSet' => [ + ['createdAt' => '2024-11-04T11:26:50.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'AddDataSource', - ], - 'ListBindAccount' => [ - 'summary' => 'Queries a list of cloud accounts that are added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssets'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCloudSiemAssets', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 1276085894174392,\\n \\"SubUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"AssetName\\": \\"zsw-agentless-centos****\\",\\n \\"AssetType\\": \\"domain\\",\\n \\"AssetInfo\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"AssetId\\": \\"0616caeb-acb8-45e0-8520-4ee5fbe251f0\\",\\n \\"CloudCode\\": \\"aliyun\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'DescribeCloudSiemAssetsCounter' => [ + 'summary' => 'Queries the number of assets of each type that are associated with an event.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'CloudCode', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'required' => true, - 'enumValueTitles' => [], - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'schema' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ - 'name' => 'RegionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The type of view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The UID of the member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'RoleType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or the China (Hong Kong) region.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => '已经绑定的账号列表。', - 'description' => 'The response parameters.'."\n", + 'title' => 'PlainResponse<List<CloudSiemEventAssetCounter>>', + 'description' => 'PlainResponse\\<List\\<CloudSiemEventAssetCounter>>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The returned data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'AccountName' => [ - 'title' => '账号名称。', - 'description' => 'The username of the cloud account.'."\n", - 'type' => 'string', - 'example' => 'sas_account_xxx', - ], - 'AccessId' => [ - 'title' => '已经绑定ACCESS_KEY_ID。', - 'description' => 'The AccessKey ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => 'ABCXXXXXXXX', - ], - 'DataSourceCount' => [ - 'title' => '该账号下绑定数据源的数量。', - 'description' => 'The number of data sources that are added to the threat analysis feature within the cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '2', - ], - 'ModifyTime' => [ - 'title' => '修改时间。', - 'description' => 'The modification time.'."\n", - 'type' => 'string', - 'example' => '2023-11-10 12:20:35', - ], - 'CreateUser' => [ - 'title' => '该账号绑定者。', - 'description' => 'The ID of the account that is used to add the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'BindId' => [ - 'title' => '绑定ID。', - 'description' => 'The ID that is generated when the cloud account is added.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123xxxxxxx', - ], - 'AccountId' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'enumValueTitles' => [], - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'AssetType' => ['title' => '', 'description' => 'The type of the asset. Valid values:'."\n" + ."\n" + .'- ip: IP address'."\n" + ."\n" + .'- domain: domain name'."\n" + ."\n" + .'- url: URL'."\n" + ."\n" + .'- process: process'."\n" + ."\n" + .'- file: file'."\n" + ."\n" + .'- host: host', 'type' => 'string', 'example' => 'domain'], + 'AssetNum' => ['title' => '', 'description' => 'The number of assets.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AccountName\\": \\"XXXX公司\\",\\n \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n \\"DataSourceCount\\": 2,\\n \\"ModifyTime\\": \\"2023-11-10 12:20:35\\",\\n \\"CreateUser\\": \\"123xxxxxxx\\",\\n \\"BindId\\": 0,\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListBindAccount', - ], - 'ListAccountAccessId' => [ - 'summary' => 'Queries a list of AccessKey IDs of third-party cloud accounts that are added to the threat analysis feature.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeCloudSiemAssetsCounter', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssetsCounter'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCloudSiemAssetsCounter', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AssetType\\": \\"domain\\",\\n \\"AssetNum\\": 1\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeCloudSiemEventDetail' => [ + 'summary' => 'Retrieves the details of an event.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -4669,1973 +3764,923 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeCode' => '195478', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ - 'name' => 'CloudCode', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider.'."\n" - ."\n" - .'Valid values:'."\n" - ."\n" - .'* qcloud'."\n" - .'* hcloud', - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'schema' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ - 'name' => 'RegionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'description' => 'The ID of the account that you switch from the management account.', - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member account. An administrator can use this parameter to query data from the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'RoleType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'example' => '0', - ], + 'schema' => ['title' => '', 'description' => 'The region of the data management center for Threat Analysis. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: assets in regions outside the Chinese mainland', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<List<ListAccountAccessIdResult>>', - 'description' => 'The response parameters.', + 'title' => 'PlainResponse<SiemEvent>', + 'description' => 'A PlainResponse object containing .', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'SubUserId' => [ - 'title' => '多云AccessKeyId对应的阿里云账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to add the third-party cloud account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => 'ABCXXXXXXXX', - ], - 'AccessIdMd5' => [ - 'title' => '多云AccessKeyId对应的MD5值。', - 'description' => 'The MD5 hash value of the AccessKey ID.'."\n", - 'type' => 'string', - 'example' => 'abcXXXXXXXX', - ], - 'AccountStr' => [ - 'title' => '多云AccessKeyId所属的账号信息，格式为阿里云账号ID|阿里云账号名称|多云AccessKeyId。', - 'description' => 'The information about the cloud account to which the AccessKey ID belongs. The value is in the following format: Alibaba Cloud account ID|Alibaba Cloud account username|AccessKey ID.'."\n", - 'type' => 'string', - 'example' => '123xxxxxx|xxxx|ABCXXXXX', - ], - 'Bound' => [ - 'title' => '该AccessKeyId是否已经被绑定到威胁分析。取值：'."\n" - .' - 0 : 未绑定。'."\n" - .' - 1：已绑定。', - 'description' => 'Indicates whether the cloud account to which the AccessKey ID belongs is added to the threat analysis feature. Valid values:'."\n" - ."\n" - .'* 0: no'."\n" - .'* 1: yes'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'AccessId' => [ - 'title' => '已经绑定ACCESS_KEY_ID。', - 'description' => 'The AccessKey ID of the cloud account that is added to the threat analysis feature.'."\n", - 'type' => 'string', - 'example' => 'ABCXXXXXXXX', - ], - 'AccountId' => [ - 'title' => '云账号ID。', - 'description' => 'The ID of the cloud account.'."\n", - 'type' => 'string', - 'example' => '123xxxxxxx', - ], - 'CloudCode' => [ - 'title' => '多云的code。', - 'description' => 'The code of the cloud service provider.'."\n", - 'type' => 'string', - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - ], - ], + 'title' => '', + 'description' => 'The returned data.', + 'type' => 'object', + 'properties' => [ + 'GmtCreate' => ['title' => '', 'description' => 'The time when the event occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the event was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to which the event belongs.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'AlertNum' => ['title' => '', 'description' => 'The number of alerts that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'], + 'AssetNum' => ['title' => '', 'description' => 'The number of assets that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'], + 'IncidentUuid' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'IncidentName' => ['title' => '', 'description' => 'The name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'], + 'IncidentNameEn' => ['title' => '', 'description' => 'The English name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'], + 'Description' => ['title' => '', 'description' => 'The description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'], + 'DescriptionEn' => ['title' => '', 'description' => 'The English description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'], + 'DataSources' => [ + 'title' => '', + 'description' => 'The cloud services that generated the alerts associated with the event.', + 'type' => 'array', + 'items' => ['description' => 'The cloud service that generated the alerts associated with the event.', 'type' => 'string', 'title' => '', 'example' => '[sas,waf]'], + 'example' => '[sas,waf]', ], + 'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'example' => 'remind'], + 'ThreatScore' => ['title' => '', 'description' => 'The threat score of the event. The score is a value from 0 to 100. A higher score indicates a higher threat level.', 'type' => 'number', 'format' => 'float', 'example' => '90.2'], + 'ExtContent' => ['title' => '', 'description' => 'The extended information about the event, in JSON format.', 'type' => 'string', 'example' => '{"event_transfer_type":"customize_rule"}'], + 'Status' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n" + ."\n" + .'- 0: unhandled'."\n" + ."\n" + .'- 1: handling'."\n" + ."\n" + .'- 5: handling failed'."\n" + ."\n" + .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'AttCkLabels' => [ + 'title' => '', + 'description' => 'The ATT\\&CK technique labels.', + 'type' => 'array', + 'items' => ['description' => 'The ATT\\&CK technique label.', 'type' => 'string', 'title' => '', 'example' => '["T1595.002 Vulnerability Scanning"]'], + 'example' => '["T1595.002 Vulnerability Scanning"]', + ], + 'AttckStages' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'TacticId' => ['type' => 'string', 'description' => 'The ID of the ATT\\&CK tactic.', 'title' => '', 'example' => 'TA0008'], + 'TacticName' => ['type' => 'string', 'description' => 'The name of the tactic.', 'title' => '', 'example' => 'Persistence'], + 'AlertNum' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of alerts that are associated with the tactic.', 'title' => '', 'example' => '21'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'description' => 'The attack stages.', + 'title' => '', + 'example' => '', + ], + 'ReferAccount' => ['description' => 'The linked accounts.', 'type' => 'string', 'title' => '', 'example' => '17661858****/****,176618448****/****'], + 'IncidentType' => ['description' => 'The type of the event.'."\n" + ."\n" + .'- net-attack: Expert rule'."\n" + ."\n" + .'- graph: Graph computing'."\n" + ."\n" + .'- singleToSingle: Alert pass-through'."\n" + ."\n" + .'- allToSingle: Alert aggregation', 'type' => 'string', 'title' => '', 'example' => 'graph'], + 'RuleId' => ['description' => 'The rule that is used to generate the event.', 'type' => 'string', 'title' => '', 'example' => 'net-attack/101'], + 'Remark' => ['title' => '', 'description' => 'The remarks for the event.', 'type' => 'string', 'example' => 'dealed'], ], + 'example' => '123456', ], - 'Success' => [ - 'title' => '本次请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => 'HTTP状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '返回消息描述。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The response code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"AlertNum\\": 4,\\n \\"AssetNum\\": 4,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DataSources\\": [\\n \\"[sas,waf]\\"\\n ],\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"ThreatScore\\": 90.2,\\n \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n \\"Status\\": 0,\\n \\"AttCkLabels\\": [\\n \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n ],\\n \\"AttckStages\\": [\\n {\\n \\"TacticId\\": \\"TA0008\\",\\n \\"TacticName\\": \\"Persistence\\",\\n \\"AlertNum\\": 21\\n }\\n ],\\n \\"ReferAccount\\": \\"17661858****/****,176618448****/****\\",\\n \\"IncidentType\\": \\"graph\\",\\n \\"RuleId\\": \\"net-attack/101\\",\\n \\"Remark\\": \\"dealed\\"\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'title' => 'DescribeCloudSiemEventDetail', + 'changeSet' => [ + ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Response parameters changed'], + ['createdAt' => '2024-09-13T03:04:52.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-02-22T06:04:58.000Z', 'description' => 'Error codes changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEventDetail'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCloudSiemEventDetail', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SubUserId\\": 0,\\n \\"AccessIdMd5\\": \\"abcXXXXXXXX\\",\\n \\"AccountStr\\": \\"123xxxxxx|xxxx|ABCXXXXX\\",\\n \\"Bound\\": 1,\\n \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListAccountAccessId', ], - 'SubmitImportLogTasks' => [ - 'summary' => 'Submits log collection tasks at a time.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'DescribeCloudSiemEvents' => [ + 'summary' => 'Retrieves a list of threat analysis events.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeCode' => '195545', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ - 'name' => 'ProdCode', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '产品的code。', - 'description' => 'The code of the service.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'qcloud_waf', - ], + 'schema' => ['title' => '', 'description' => 'The start time of the query. This value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ - 'name' => 'LogCodes', + 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => '提交接入的日志列表，json数组格式。', - 'description' => 'The logs that you want to collect. The value is a JSON array.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["cloud_siem_qcloud_cfw_alert_log"]', - ], + 'schema' => ['title' => '', 'description' => 'The end time of the query. This value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ - 'name' => 'Accounts', + 'name' => 'ThreadLevel', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '提交接入的账号列表，json数组格式。取值：'."\n" - .' - AccountId：待接入的账号ID。 '."\n" - .' - Imported：'."\n" - .' - 0：取消接入。 '."\n" - .' - 1：接入。', - 'description' => 'The accounts that you want to add. The value is a JSON array. Valid values:'."\n" + 'title' => '', + 'description' => 'The threat level of the event. The value is a JSON array. Valid values:'."\n" ."\n" - .'* AccountId: the IDs of the accounts.'."\n" + .'- serious: high'."\n" ."\n" - .'* Imported: specifies whether to add the accounts. Valid values:'."\n" + .'- suspicious: medium'."\n" ."\n" - .' * 0: no'."\n" - .' * 1: yes'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[{"AccountId":"123123","Imported":1}]', - ], - ], - [ - 'name' => 'AutoImported', - 'in' => 'formData', - 'schema' => [ - 'title' => '是否自动接入配置了该日志的账号。取值：'."\n" - .' - 1：自动接入。 '."\n" - .' - 0：不自动接入。', - 'description' => 'Specifies whether to automatically add the account for which the logging feature is configured. Valid values:'."\n" + .'- remind: low', + 'type' => 'array', + 'items' => ['description' => 'The threat level of the event. The value is a JSON array. Valid values:'."\n" ."\n" - .'* 1: yes'."\n" - .'* 0: no'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '["cloud_siem_qcloud_cfw_alert_log"]', - ], - ], - [ - 'name' => 'CloudCode', - 'in' => 'formData', - 'schema' => [ - 'title' => '多云的code。', - 'description' => 'The code that is used for multi-cloud environments. Valid values:'."\n" + .'- serious: high'."\n" ."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* hcloud: Huawei Cloud', - 'type' => 'string', - 'required' => true, - 'example' => 'hcloud', - 'enum' => [ - 'qcloud', - 'hcloud', - 'aliyun', - ], - ], - ], - [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- suspicious: medium'."\n" ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', + .'- remind: low', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["remind","serious"]'."\n"], 'required' => false, - 'description' => 'The ID of the account that you switch from the management account.', - 'example' => '113091674488****', + 'example' => '["serious","suspicious","remind"]', + 'maxItems' => 100, ], ], [ - 'name' => 'RoleType', + 'name' => 'EventName', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'example' => '0', - ], - ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<SubmitImportLogTasksResult>', - 'description' => 'CloudSiemSuccessResponse'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'Count' => [ - 'title' => '成功提交的日志接入任务数量。', - 'description' => 'The number of log collection tasks that are submitted.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - ], - ], - ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + 'schema' => ['title' => '', 'description' => 'The name of the event.', 'type' => 'string', 'required' => false, 'example' => 'ECS unusual log in'], ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'eventInfo' => [ - 'enable' => false, - 'eventNames' => [], - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 10\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'SubmitImportLogTasks', - ], - 'DescribeAlertsWithEntity' => [ - 'summary' => 'Queries the alerts that are associated with an entity.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ - [ - 'AK' => [], - ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas731ZAS', - ], - ], - 'parameters' => [ [ 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The event ID.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ - 'name' => 'SophonTaskId', + 'name' => 'AssetId', 'in' => 'formData', - 'schema' => [ - 'title' => 'soar处置策略ID。', - 'description' => 'The ID of the SOAR handing policy.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the asset that is associated with the event.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****'], ], [ - 'name' => 'EntityId', + 'name' => 'EntityUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '实体ID。', - 'description' => 'The ID of the entity.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', - ], + 'schema' => ['title' => '', 'description' => 'The UUID of the entity that is associated with the event.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****'], ], [ - 'name' => 'EntityUuid', + 'name' => 'Status', 'in' => 'formData', - 'schema' => [ - 'title' => '实体ID。', - 'type' => 'string', - 'example' => '123456789', - ], + 'schema' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n" + ."\n" + .'- 0: unhandled'."\n" + ."\n" + .'- 1: in progress'."\n" + ."\n" + .'- 5: failed'."\n" + ."\n" + .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'], ], [ - 'name' => 'StartTime', + 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The field to sort the event list by. Valid values:'."\n" + ."\n" + .'- GmtModified: Sorts by modification time. This is the default value.'."\n" + ."\n" + .'- ThreatScore: Sorts by threat score.', 'type' => 'string', 'required' => false, 'example' => 'ThreatScore'], ], [ - 'name' => 'EndTime', + 'name' => 'Order', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- desc: descending'."\n" + ."\n" + .'- asc: ascending', 'type' => 'string', 'required' => false, 'example' => 'desc'], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that are managed by the administrator account.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member. The administrator can use this ID to view the data of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis & Response is located. Select the region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<AlertDetail>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'PageResponse<List<SiemEvent>>', + 'description' => 'PageResponse\\<List\\<SiemEvent>>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: successful'."\n" + ."\n" + .'- false: failed', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The return value of the request.', 'type' => 'object', 'properties' => [ 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", + 'title' => '', + 'description' => 'The pagination information.', 'type' => 'object', 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], + 'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], + 'example' => '', ], 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", + 'title' => '', + 'description' => 'The detailed data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '告警唯一ID。', - 'description' => 'The unique ID of the alert.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '告警入库时间。', - 'description' => 'The time when the alert was received.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '告警最后更新时间。', - 'description' => 'The time when the alert was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'MainUserId' => [ - 'title' => '告警关联siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '告警id。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'LogTime' => [ - 'title' => '告警记录时间。', - 'description' => 'The time when the alert was recorded.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'AlertSrcProd' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The source of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'AlertTitle' => [ - 'title' => '告警标题。', - 'description' => 'The title of the alert.'."\n", - 'type' => 'string', - 'example' => 'Scan-Try SNMP weak password', - ], - 'AlertTitleEn' => [ - 'title' => '告警标题英文。', - 'description' => 'The alert title in English.'."\n", - 'type' => 'string', - 'example' => 'Scan-Try SNMP weak password', - ], - 'AlertType' => [ - 'title' => '告警类型。', - 'description' => 'The type of the alert.'."\n", - 'type' => 'string', - 'example' => 'Scan', - ], - 'AlertTypeEn' => [ - 'title' => '告警类型英文。', - 'description' => 'The alert type in English.'."\n", - 'type' => 'string', - 'example' => 'Scan', - ], - 'AlertTypeCode' => [ - 'title' => '告警类型美杜莎code。', - 'description' => 'The internal code of the alert type.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshellName', - ], - 'AlertName' => [ - 'title' => '告警名称。', - 'description' => 'The name of the alert.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameEn' => [ - 'title' => '告警名称。', - 'description' => 'The name of the alert.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameCode' => [ - 'title' => '告警名称美杜莎code。', - 'description' => 'The internal code of the alert name.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshell', - ], - 'AlertLevel' => [ - 'title' => '威胁等级。 取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'AssetList' => [ - 'title' => '资产列表。', - 'description' => 'The details of the asset.'."\n", - 'type' => 'string', - 'example' => '['."\n" - .' {'."\n" - .' "is_main_asset": "1",'."\n" - .' "asset_name": "47.245.*",'."\n" - .' "port": "22",'."\n" - .' "ip": "47.245.*",'."\n" - .' "asset_type": "ip",'."\n" - .' "location": "ap-southeast-1",'."\n" - .' "asset_id": "47.245.*",'."\n" - .' "net_connect_dir": "in"'."\n" - .' }'."\n" - .']', - ], - 'OccurTime' => [ - 'title' => '告警发生时间。', - 'description' => 'The time when the alert was triggered.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'StartTime' => [ - 'title' => '告警首次发生时间。', - 'description' => 'The time at which the alert was first generated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'EndTime' => [ - 'title' => '告警结束时间。', - 'description' => 'The time when the alert was closed.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'AlertSrcProdModule' => [ - 'title' => '事件关联告警来源产品子模块。', - 'description' => 'The sub-module of the alert source.'."\n", - 'type' => 'string', - 'example' => 'waf', - ], - 'AlertDesc' => [ - 'title' => '告警描述。', - 'description' => 'The description of the alert.'."\n", - 'type' => 'string', - 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', - ], - 'AlertDescEn' => [ - 'title' => '告警英文描述。', - 'description' => 'The alert description in English.'."\n", - 'type' => 'string', - 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', - ], - 'AlertDescCode' => [ - 'title' => '告警描述美杜莎code。', - 'description' => 'The internal code of the alert description.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshell'."\n", - ], - 'AlertDetail' => [ - 'title' => '告警详情。', - 'description' => 'The details of the alert.'."\n", - 'type' => 'string', - 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}', - ], - 'LogUuid' => [ - 'title' => '告警log UUID。', - 'description' => 'The UUID of the alert log.'."\n", - 'type' => 'string', - 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', - ], - 'EntityList' => [ - 'title' => '实体详情（标准化/开启索引）', - 'type' => 'string', - ], - 'AttCk' => [ - 'title' => 'ATTCT&攻击技术标签。', - 'description' => 'The tag of the ATT\\&CK attack.'."\n", - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'SubUserId' => [ - 'title' => '产生告警阿里账号ID。', - 'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '176555323***', - ], - 'SubUserName' => [ - 'title' => '产生告警阿里账号ID。', - 'type' => 'string', - 'example' => '176555323***', + 'GmtCreate' => ['title' => '', 'description' => 'The time when the event occurred.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the event was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to which the event belongs.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'AlertNum' => ['title' => '', 'description' => 'The number of alerts that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'], + 'AssetNum' => ['title' => '', 'description' => 'The number of assets that are associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4'], + 'IncidentUuid' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'IncidentName' => ['title' => '', 'description' => 'The name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'], + 'IncidentNameEn' => ['title' => '', 'description' => 'The English name of the event.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc'], + 'Description' => ['title' => '', 'description' => 'The description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'], + 'DescriptionEn' => ['title' => '', 'description' => 'The English description of the event.', 'type' => 'string', 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc'], + 'DataSources' => [ + 'title' => '', + 'description' => 'The cloud services that generated the alerts, which are associated with the event.', + 'type' => 'array', + 'items' => ['description' => 'The cloud service that generated the alert, which is associated with the event.', 'type' => 'string', 'title' => '', 'example' => '[sas,waf]'], + 'example' => '[sas,waf]', ], - 'IsDefend' => [ - 'title' => '是否已防御', - 'description' => 'Specifies whether an attack is defended. Valid values:'."\n" - ."\n" - .'* 0: detected'."\n" - .'* 1: blocked'."\n", - 'type' => 'string', - 'example' => '1', + 'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'example' => 'remind'], + 'ThreatScore' => ['title' => '', 'description' => 'The threat score of the event. The score ranges from 0 to 100. A higher score indicates a higher risk level.', 'type' => 'number', 'format' => 'float', 'example' => '90.2'], + 'ExtContent' => ['title' => '', 'description' => 'The extended information about the event, in the JSON format.', 'type' => 'string', 'example' => '{"event_transfer_type":"customize_rule"}'], + 'Status' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n" + ."\n" + .'- 0: unhandled'."\n" + ."\n" + .'- 1: in progress'."\n" + ."\n" + .'- 5: failed'."\n" + ."\n" + .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'AttCkLabels' => [ + 'title' => '', + 'description' => 'The tags of the ATT\\&CK attack technique.', + 'type' => 'array', + 'items' => ['description' => 'The tag of the ATT\\&CK attack technique.', 'type' => 'string', 'title' => '', 'example' => '["T1595.002 Vulnerability Scanning"]'], + 'example' => '["T1595.002 Vulnerability Scanning"]', ], - 'AlertInfoList' => [ - 'title' => '告警详细数据。', - 'description' => 'The displayed details of the alert.'."\n", + 'AttckStages' => [ 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Key' => [ - 'title' => '告警详细属性key。', - 'description' => 'The attribute key.'."\n", - 'type' => 'string', - 'example' => 'suspicious.wbd.wb.trojanpath', - ], - 'KeyName' => [ - 'title' => '告警详细数据名称。', - 'description' => 'The name of the key.'."\n", - 'type' => 'string', - 'example' => 'Trojan Path'."\n", - ], - 'Values' => [ - 'title' => '告警详细数据值。', - 'description' => 'The value of the key.'."\n", - 'type' => 'string', - 'example' => '/root/test33.php', - ], + 'TacticId' => ['type' => 'string', 'description' => 'The ID of the ATT\\&CK attack stage.', 'title' => '', 'example' => 'TA0001'], + 'TacticName' => ['type' => 'string', 'description' => 'The name of the attack stage.', 'title' => '', 'example' => 'Persistence'], + 'AlertNum' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of alerts that are associated with the attack stage.', 'title' => '', 'example' => '21'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], - 'example' => 'aliyun', - ], - 'CloudCode' => [ + 'description' => 'The list of attack stages.', 'title' => '', - 'description' => 'The cloud code. Valid values:'."\n" - ."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'aliyun', - ], - 'ProductId' => [ - 'type' => 'string', - ], - 'VendorId' => [ - 'type' => 'string', - ], - 'DetectionRuleId' => [ - 'type' => 'string', + 'example' => '', ], + 'ReferAccount' => ['description' => 'The linked account.', 'type' => 'string', 'title' => '', 'example' => '127608589417****'], + 'IncidentType' => ['type' => 'string', 'description' => 'The event type.'."\n" + ."\n" + .'- net-attack: expert rule'."\n" + ."\n" + .'- graph: graph computing', 'title' => '', 'example' => 'graph'], + 'RuleId' => ['type' => 'string', 'description' => 'The rule ID.', 'title' => '', 'example' => 'crecr-21d7pogu9v4a****'], + 'Remark' => ['title' => '', 'description' => 'The remarks on the event.', 'type' => 'string', 'example' => 'dealed'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeCloudSiemEvents', + 'changeSet' => [ + ['createdAt' => '2024-11-04T11:26:50.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"MainUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertType\\": \\"Scan\\",\\n \\"AlertTypeEn\\": \\"Scan\\",\\n \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertLevel\\": \\"remind\\",\\n \\"AssetList\\": \\"[\\\\n {\\\\n \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n }\\\\n]\\",\\n \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n \\"EntityList\\": \\"[{\\\\\\"entity_uuid\\\\\\":\\\\\\"55f0c0654d7e79b035a5168fcb4****\\\\\\",\\\\\\"entity_type\\\\\\":\\\\\\"cloud_account\\\\\\",\\\\\\"account_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"main_user_id\\\\\\":\\\\\\"15176874502****\\\\\\",\\\\\\"cloud_code\\\\\\":\\\\\\"alibaba_cloud\\\\\\",\\\\\\"is_asset\\\\\\":1,\\\\\\"entity_id\\\\\\":\\\\\\"151768745029****\\\\\\"}]\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"176555323***\\",\\n \\"IsDefend\\": \\"1\\",\\n \\"AlertInfoList\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"VendorId\\": \\"aliyun\\",\\n \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeAlertsWithEntity', - ], - 'DescribeAlerts' => [ - 'summary' => 'Queries alerts within your account.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEvents'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCloudSiemEvents', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"AlertNum\\": 4,\\n \\"AssetNum\\": 4,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DataSources\\": [\\n \\"[sas,waf]\\"\\n ],\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"ThreatScore\\": 90.2,\\n \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n \\"Status\\": 0,\\n \\"AttCkLabels\\": [\\n \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n ],\\n \\"AttckStages\\": [\\n {\\n \\"TacticId\\": \\"TA0001\\",\\n \\"TacticName\\": \\"Persistence\\",\\n \\"AlertNum\\": 21\\n }\\n ],\\n \\"ReferAccount\\": \\"127608589417****\\",\\n \\"IncidentType\\": \\"graph\\",\\n \\"RuleId\\": \\"crecr-21d7pogu9v4a****\\",\\n \\"Remark\\": \\"dealed\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'DescribeCustomizeRuleCount' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas731ZAS', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'AlertUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件关联告警ID。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - ], - [ - 'name' => 'Level', - 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'title' => '威胁等级，格式为json数组。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. The value is a JSON array. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The risk level. The value is a JSON string. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["remind","serious"]', - ], - 'required' => false, - 'example' => '["serious","suspicious","remind"]', - 'maxItems' => 100, - ], - ], - [ - 'name' => 'Source', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The source of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'sas', - ], - ], - [ - 'name' => 'IsDefend', - 'in' => 'formData', - 'schema' => [ - 'title' => '是否已防御', - 'description' => 'Specifies whether an attack is defended. Valid values:'."\n" - ."\n" - .'* 0: detected.'."\n" - .'* 1: blocked.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'AlertTitle', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警标题。', - 'description' => 'The title of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'Unusual Logon-login_common_account', - ], - ], - [ - 'name' => 'AlertType', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警类型。', - 'type' => 'string', - ], - ], - [ - 'name' => 'AlertName', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警名称。', - 'type' => 'string', - ], - ], - [ - 'name' => 'AssetName', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '资产名称。', - 'type' => 'string', - ], + 'schema' => ['description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'AssetId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '资产id。', - 'type' => 'string', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'EntityName', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '实体名称。', - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The region of the management center for threat analysis. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], - [ - 'name' => 'EntityId', - 'in' => 'formData', + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '实体id。', - 'type' => 'string', + 'title' => 'PlainResponse<CustomizeRuleCounter>', + 'description' => 'PlainResponse', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'InUseRuleNum' => ['title' => '', 'description' => 'The number of rules in use.', 'type' => 'integer', 'format' => 'int32', 'example' => '20'], + 'HighRuleNum' => ['title' => '', 'description' => 'The number of high-risk rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '12'], + 'MediumRuleNum' => ['title' => '', 'description' => 'The number of medium-risk rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '5'], + 'LowRuleNum' => ['title' => '', 'description' => 'The number of low-risk rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + 'TotalRuleNum' => ['title' => '总规则数', 'description' => 'The total number of rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'CustomizeRuleNum' => ['title' => '自定义规则数', 'description' => 'The number of custom rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'PredefinedRuleNum' => ['title' => '预定义规则数', 'description' => 'The number of predefined rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'UnEventRuleNum' => ['title' => '不产生事件规则数', 'description' => 'The number of rules that do not generate events.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + 'ExpertRuleNum' => ['title' => '专家规则数', 'description' => 'The number of expert rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '7'], + 'GraphComputingRuleNum' => ['title' => '图计算规则数', 'description' => 'The number of graph computing rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'], + 'SingleAlertRuleNum' => ['title' => '告警透传规则数', 'description' => 'The number of alert pass-through rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + 'AggregationRuleNum' => ['title' => '同类聚合规则数', 'description' => 'The number of rules for intra-class aggregation.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + ], + 'example' => '123456', + ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + ], + 'example' => '', ], ], - [ - 'name' => 'SubUserId', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警史记关联阿里账号ID。', - 'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '176555323***', - ], + ], + 'errorCodes' => [ + 500 => [ + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], - [ - 'name' => 'LabelType', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警史记关联阿里账号ID。', - 'type' => 'string', - 'example' => '176555323***', - ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeCustomizeRuleCount', + 'summary' => 'Retrieves the count of custom rules.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleCount'], ], + ], + 'ramActions' => [ [ - 'name' => 'AlertStatus', - 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'title' => '告警状态', - 'type' => 'array', - 'items' => [ - 'title' => '告警状态', - 'type' => 'string', - 'example' => '1', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCustomizeRuleCount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], ], - 'maxItems' => 100, - ], - ], - [ - 'name' => 'StartTime', - 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], - ], - [ - 'name' => 'EndTime', - 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"InUseRuleNum\\": 20,\\n \\"HighRuleNum\\": 12,\\n \\"MediumRuleNum\\": 5,\\n \\"LowRuleNum\\": 3,\\n \\"TotalRuleNum\\": 10,\\n \\"CustomizeRuleNum\\": 10,\\n \\"PredefinedRuleNum\\": 10,\\n \\"UnEventRuleNum\\": 3,\\n \\"ExpertRuleNum\\": 7,\\n \\"GraphComputingRuleNum\\": 2,\\n \\"SingleAlertRuleNum\\": 3,\\n \\"AggregationRuleNum\\": 3\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeCustomizeRuleTest' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'CurrentPage', - 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'PageSize', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member account to which the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<AlertDetail>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'BaseResponse<CustomizeRuleTest>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Id' => [ - 'title' => '告警唯一ID。', - 'description' => 'The unique ID of the alert.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '告警入库时间。', - 'description' => 'The time when the alert was received.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '告警最后更新时间。', - 'description' => 'The time when the alert was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'MainUserId' => [ - 'title' => '告警关联siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '告警id。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'LogTime' => [ - 'title' => '告警记录时间。', - 'description' => 'The time when the alert was recorded.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'AlertSrcProd' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The service for which the alert associated with the event is generated.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'AlertTitle' => [ - 'title' => '告警标题。', - 'description' => 'The title of the alert.'."\n", - 'type' => 'string', - 'example' => 'Scan-Try SNMP weak password', - ], - 'AlertTitleEn' => [ - 'title' => '告警标题英文。', - 'description' => 'The title of the alert in English.'."\n", - 'type' => 'string', - 'example' => 'Scan-Try SNMP weak password', - ], - 'AlertType' => [ - 'title' => '告警类型。', - 'description' => 'The alert type.'."\n", - 'type' => 'string', - 'example' => 'Scan', - ], - 'AlertTypeEn' => [ - 'title' => '告警类型英文。', - 'description' => 'The type of the alert in English.'."\n", - 'type' => 'string', - 'example' => 'Scan', - ], - 'AlertTypeCode' => [ - 'title' => '告警类型美杜莎code。', - 'description' => 'The internal code of the alert type.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshellName', - ], - 'AlertName' => [ - 'title' => '告警名称。', - 'description' => 'The name of the alert.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameEn' => [ - 'title' => '告警名称。', - 'description' => 'The name of the alert in English.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameCode' => [ - 'title' => '告警名称美杜莎code。', - 'description' => 'The internal code of the alert name.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshell', - ], - 'AlertLevel' => [ - 'title' => '威胁等级。 取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The threat level. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'AssetList' => [ - 'title' => '资产列表。', - 'description' => 'The details of the asset.'."\n", - 'type' => 'string', - 'example' => '['."\n" - .' {'."\n" - .' "is_main_asset": "1",'."\n" - .' "asset_name": "47.245.*",'."\n" - .' "port": "22",'."\n" - .' "ip": "47.245.*",'."\n" - .' "asset_type": "ip",'."\n" - .' "location": "ap-southeast-1",'."\n" - .' "asset_id": "47.245.*",'."\n" - .' "net_connect_dir": "in"'."\n" - .' }'."\n" - .']', - ], - 'OccurTime' => [ - 'title' => '告警发生时间。', - 'description' => 'The time when the alert is triggered.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'StartTime' => [ - 'title' => '告警首次发生时间。', - 'description' => 'The time at which the alert was first generated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'EndTime' => [ - 'title' => '告警结束时间。', - 'description' => 'The time when the alert was closed.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'AlertSrcProdModule' => [ - 'title' => '事件关联告警来源产品子模块。', - 'description' => 'The sub-module of ther alert source.'."\n", - 'type' => 'string', - 'example' => 'waf', - ], - 'AlertDesc' => [ - 'title' => '告警描述。', - 'description' => 'The description of the alert.'."\n", - 'type' => 'string', - 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', - ], - 'AlertDescEn' => [ - 'title' => '告警英文描述。', - 'description' => 'The description of the alert in English.'."\n", - 'type' => 'string', - 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', - ], - 'AlertDescCode' => [ - 'title' => '告警描述美杜莎code。', - 'description' => 'The internal code of the alert description.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshell', - ], - 'AlertDetail' => [ - 'title' => '告警详情。', - 'description' => 'The details of the alert.'."\n", - 'type' => 'string', - 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}', - ], - 'LogUuid' => [ - 'title' => '告警log UUID。', - 'description' => 'The UUID of the alert log.'."\n", - 'type' => 'string', - 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', - ], - 'EntityList' => [ - 'title' => '实体详情（标准化/开启索引）', - 'type' => 'string', - ], - 'AttCk' => [ - 'title' => 'ATTCT&攻击技术标签。', - 'description' => 'The tag of the ATT\\&CK attack.'."\n", - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'SubUserId' => [ - 'title' => '产生告警阿里账号ID。', - 'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '176555323***', - ], - 'SubUserName' => [ - 'title' => '产生告警阿里账号ID。', - 'type' => 'string', - 'example' => '176555323***', - ], - 'VendorId' => [ - 'title' => '云code。 取值：'."\n" - .'- aliyun：阿里云'."\n" - .'- qcloud：腾讯云'."\n" - .'- hcloud：华为云', - 'type' => 'string', - 'example' => 'aliyun', - ], - 'IsDefend' => [ - 'title' => '是否已防御', - 'description' => 'Indicates whether an attack is defended. Valid values:'."\n" - ."\n" - .'* 0: detected.'."\n" - .'* 1: blocked.'."\n", - 'type' => 'string', - 'example' => '1', - ], - 'AlertInfoList' => [ - 'title' => '告警详细数据。', - 'description' => 'The displayed details of the alert.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Key' => [ - 'title' => '告警详细属性key。', - 'description' => 'The attribute key.'."\n", - 'type' => 'string', - 'example' => 'suspicious.wbd.wb.trojanpath', - ], - 'KeyName' => [ - 'title' => '告警详细数据名称。', - 'description' => 'The name of the key.'."\n", - 'type' => 'string', - 'example' => 'Trojan Path', - ], - 'Values' => [ - 'title' => '告警详细数据值。', - 'description' => 'The value of the key.'."\n", - 'type' => 'string', - 'example' => '/root/test33.php', - ], - ], - ], - 'example' => 'aliyun', - ], - 'ExtendContent' => [ - 'type' => 'string', - ], - 'ProductId' => [ - 'type' => 'string', - ], - 'CloudCode' => [ - 'title' => '', - 'description' => 'The cloud code. Valid values:'."\n" - ."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'aliyun', - ], - 'DetectionRuleId' => [ - 'type' => 'string', - ], - 'AlertStatus' => [ - 'title' => '告警状态', - 'type' => 'string', - 'example' => '1', - ], - ], - ], - ], + 'Id' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'], + 'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- 0: initial'."\n" + ."\n" + .'- 10: simulated data test'."\n" + ."\n" + .'- 15: real-time data test in progress'."\n" + ."\n" + .'- 20: real-time data test complete'."\n" + ."\n" + .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'SimulateData' => ['title' => '', 'description' => 'The historical data of the simulated test case.', 'type' => 'string', 'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]'], ], 'example' => '123456', ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeCustomizeRuleTest', + 'summary' => 'Retrieves historical simulated data from a test scenario.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"MainUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertType\\": \\"Scan\\",\\n \\"AlertTypeEn\\": \\"Scan\\",\\n \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertLevel\\": \\"remind\\",\\n \\"AssetList\\": \\"[\\\\n {\\\\n \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n }\\\\n]\\",\\n \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n \\"EntityList\\": \\"[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"176555323***\\",\\n \\"VendorId\\": \\"aliyun\\",\\n \\"IsDefend\\": \\"1\\",\\n \\"AlertInfoList\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"ExtendContent\\": \\"{\\\\\\"user\\\\\\":\\\\\\"Member\\\\\\",\\\\\\"num\\\\\\":\\\\\\"1\\\\\\"}\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\",\\n \\"AlertStatus\\": \\"1\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeAlerts', - ], - 'DescribeAlertSource' => [ - 'summary' => 'Queries alert data sources.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTest'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCustomizeRuleTest', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Id\\": 123456789,\\n \\"Status\\": 0,\\n \\"SimulateData\\": \\"[{\\\\\\"key1\\\\\\":\\\\\\"value1\\\\\\",\\\\\\"key2\\\\\\":\\\\\\"value2\\\\\\",\\\\\\"key3\\\\\\":\\\\\\"value3\\\\\\",\\\\\\"key4\\\\\\":\\\\\\"value4\\\\\\",\\\\\\"key5\\\\\\":\\\\\\"value5\\\\\\"}]\\"\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeCustomizeRuleTestHistogram' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Level', - 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'title' => '威胁等级，格式为json数组。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk levels. The value is a JSON array. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The risk level. The value is a JSON string. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["remind","serious"]', - ], - 'required' => false, - 'example' => '["serious","suspicious","remind"]', - 'maxItems' => 100, - ], - ], - [ - 'name' => 'StartTime', - 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], - ], - [ - 'name' => 'EndTime', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Management Hub of threat analysis is located. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<AlertSource>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => 'BaseResponse<List<CustomizeRuleAlertHistogram>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'SourceName' => [ - 'title' => '告警数据源名称。', - 'description' => 'The name of the alert data source.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'Source' => [ - 'title' => '告警数据源名称美杜莎code。', - 'description' => 'The internal code of the alert data source.'."\n", - 'type' => 'string', - 'example' => 'aliyun.siem.alert_datasource.sas', - ], + 'From' => ['title' => '', 'description' => 'The start of the time range for the alert. This value is a UNIX timestamp. Unit: seconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1599897188'], + 'To' => ['title' => '', 'description' => 'The end of the time range for the alert. This value is a UNIX timestamp. Unit: seconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1599997188'], + 'Count' => ['title' => '', 'description' => 'The number of alerts generated in the subinterval.', 'type' => 'integer', 'format' => 'int64', 'example' => '125'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeCustomizeRuleTestHistogram', + 'summary' => 'Retrieves the chart of test results for a custom rule.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SourceName\\": \\"sas\\",\\n \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAlertSource', - ], - 'DescribeAlertsCount' => [ - 'summary' => 'Queries the number of alerts of different severities.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTestHistogram'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeCustomizeRuleTestHistogram', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"From\\": 1599897188,\\n \\"To\\": 1599997188,\\n \\"Count\\": 125\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeDataSourceInstance' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'QueryType', - 'in' => 'formData', - 'schema' => [ - 'title' => '查询类型。', - 'type' => 'string', - 'example' => 'bySrcProd', - ], - ], - [ - 'name' => 'StartTime', + 'name' => 'DataSourceInstanceId', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis service generates the ID by calculating the MD5 hash of specific parameters. Call the [ListDataSourceLogs](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CListDataSourceLogs) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], ], [ - 'name' => 'EndTime', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], ], [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], - ], - [ - 'name' => 'RoleFor', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', + 'title' => '', + 'description' => 'The code for the multicloud environment. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', + 'type' => 'string', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of the threat analysis service is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<CloudSiemAlertCounter>', - 'description' => 'PlainResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<DescribeDataSourceInstanceResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'High' => [ - 'title' => '高威胁告警数。', - 'description' => 'The number of high-risk alerts.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '25', - ], - 'Medium' => [ - 'title' => '中威胁告警数。', - 'description' => 'The number of medium-risk alerts.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '25', - ], - 'Low' => [ - 'title' => '低威胁告警数。', - 'description' => 'The number of low-risk alerts.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '25', - ], - 'All' => [ - 'title' => '告警总数。', - 'description' => 'The total number of alerts.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '75', - ], - 'ProductNum' => [ - 'title' => '接入产品数。', - 'description' => 'The number of connected services.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'CountMap' => [ - 'type' => 'object', - 'additionalProperties' => [ - 'type' => 'integer', - 'format' => 'int64', + 'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis service generates the ID by calculating the MD5 hash of specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + 'DataSourceInstanceParams' => [ + 'title' => '', + 'description' => 'The list of detailed parameters for the data source.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'ParaCode' => ['title' => '', 'description' => 'The parameter code.', 'type' => 'string', 'example' => 'region_code'], + 'ParaValue' => ['title' => '', 'description' => 'The parameter value.', 'type' => 'string', 'example' => 'ap-guangzhou'], + ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', + ], + 'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code for the multicloud environment. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', + 'type' => 'string', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"High\\": 25,\\n \\"Medium\\": 25,\\n \\"Low\\": 25,\\n \\"All\\": 75,\\n \\"ProductNum\\": 3,\\n \\"CountMap\\": {\\n \\"key\\": 12\\n }\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAlertsCount', - ], - 'ListEntities' => [ - 'summary' => 'Queries entities.', - 'methods' => [ - 'get', - 'post', + 'title' => 'DescribeDataSourceInstance', + 'summary' => 'Queries the details of a data source.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceInstance'], + ], ], - 'schemes' => [ - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeDataSourceInstance', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"DataSourceInstanceParams\\": [\\n {\\n \\"ParaCode\\": \\"region_code\\",\\n \\"ParaValue\\": \\"ap-guangzhou\\"\\n }\\n ],\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'DescribeDataSourceParameters' => [ + 'summary' => 'Describes the parameters for a data source.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -6643,1289 +4688,949 @@ ], 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'IncidentUuid', + 'name' => 'DataSourceType', 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- **ckafka**: Tencent Cloud CKafka.'."\n" + ."\n" + .'- **obs**: Huawei Cloud OBS.'."\n" + ."\n" + .'- **wafApi**: Tencent Cloud WAF attack log download API.', 'type' => 'string', 'required' => true, 'example' => 'obs'], ], [ - 'name' => 'EntityType', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '实体类型。', - 'description' => '', + 'title' => '', + 'description' => 'The code for the multicloud environment.', 'type' => 'string', - 'required' => false, - 'example' => 'ip', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], [ - 'name' => 'EntityName', + 'name' => 'RegionId', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center for threat analysis is deployed. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '实体名称。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'host1****', + 'title' => 'CloudSiemSuccessResponse<List<DescribeDataSourceParametersResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'DataSourceType' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- **obs**: Huawei Cloud OBS.'."\n" + ."\n" + .'- **wafApi**: Tencent Cloud WAF download API.'."\n" + ."\n" + .'- **ckafka**: Tencent Cloud CKafka.', 'type' => 'string', 'example' => 'obs'], + 'ParaLevel' => ['title' => '', 'description' => 'The level of the parameter. Valid values:'."\n" + ."\n" + .'- **1**: data source parameter.'."\n" + ."\n" + .'- **2**: log parameter.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'ParaCode' => ['title' => '', 'description' => 'The code of the parameter.', 'type' => 'string', 'example' => 'region_code'], + 'ParaName' => ['title' => '', 'description' => 'The name of the parameter.', 'type' => 'string', 'example' => 'region local'], + 'ParaType' => ['title' => '', 'description' => 'The type of the parameter.', 'type' => 'string', 'example' => 'string'], + 'Required' => ['title' => '', 'description' => 'Indicates whether the parameter is required. Valid values:'."\n" + ."\n" + .'- **1**: The parameter is required.'."\n" + ."\n" + .'- **0**: The parameter is optional.', 'type' => 'integer', 'format' => 'int32', 'example' => 'string'], + 'FormatCheck' => ['title' => '', 'description' => 'The format check method.', 'type' => 'string', 'example' => 'email'], + 'Title' => ['title' => '', 'description' => 'The prompt for the parameter value.', 'type' => 'string', 'example' => 'obs bucket name'], + 'Hit' => ['title' => '', 'description' => 'Additional information.', 'type' => 'string', 'example' => 'obs docment'], + 'DefaultValue' => ['title' => '', 'description' => 'The default value of the parameter.', 'type' => 'string', 'example' => 'wafApi'], + 'Disabled' => ['title' => '', 'description' => 'Indicates whether the parameter can be modified. Valid values:'."\n" + ."\n" + .'- **true**: The parameter cannot be modified.'."\n" + ."\n" + .'- **false**: The parameter can be modified.', 'type' => 'boolean', 'example' => 'wafApi'], + 'CanEditted' => ['title' => '', 'description' => 'Indicates whether the parameter is editable. Valid values:'."\n" + ."\n" + .'- **0**: The parameter cannot be modified.'."\n" + ."\n" + .'- **1**: The parameter can be modified.', 'type' => 'integer', 'format' => 'int32', 'example' => 'wafApi'], + 'ParamValue' => [ + 'title' => '', + 'description' => 'The list of parameters.', + 'type' => 'array', + 'items' => [ + 'description' => 'The parameter value.', + 'type' => 'object', + 'properties' => [ + 'Label' => ['title' => '', 'description' => 'The displayed content.', 'type' => 'string', 'example' => 'guangzhou'], + 'Value' => ['title' => '', 'description' => 'The actual value of the parameter.', 'type' => 'string', 'example' => 'ap-guangzhou'], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code for the multicloud environment. Valid values:'."\n" + ."\n" + .'- **qcloud**: Tencent Cloud.'."\n" + ."\n" + .'- **aliyun**: Alibaba Cloud.'."\n" + ."\n" + .'- **hcloud**: Huawei Cloud.', + 'type' => 'string', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', + ], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 500 => [ + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ], + ], + 'title' => 'DescribeDataSourceParameters', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceParameters'], + ], + ], + 'ramActions' => [ [ - 'name' => 'EntityUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '实体ID。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '6c740667-80b2-476d-8924-2e706feb****', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeDataSourceParameters', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"DataSourceType\\": \\"obs\\",\\n \\"ParaLevel\\": 1,\\n \\"ParaCode\\": \\"region_code\\",\\n \\"ParaName\\": \\"region local\\",\\n \\"ParaType\\": \\"string\\",\\n \\"Required\\": 0,\\n \\"FormatCheck\\": \\"email\\",\\n \\"Title\\": \\"obs bucket name\\",\\n \\"Hit\\": \\"obs docment\\",\\n \\"DefaultValue\\": \\"wafApi\\",\\n \\"Disabled\\": true,\\n \\"CanEditted\\": 0,\\n \\"ParamValue\\": [\\n {\\n \\"Label\\": \\"guangzhou\\",\\n \\"Value\\": \\"ap-guangzhou\\"\\n }\\n ],\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'DescribeDisposeAndPlaybook' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], + 'security' => [ [ - 'name' => 'EntityUuids', - 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'AK' => [], ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas104PTS'], + ], + 'parameters' => [ [ - 'name' => 'MalwareType', + 'name' => 'EntityType', 'in' => 'formData', - 'schema' => [ - 'title' => '恶意实体类型。 取值：'."\n" - .'- 0:否'."\n" - .'- 1:是。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun.siem.sas.alert_tag.miner_software', - ], + 'schema' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n" + .'- ip: IP address'."\n" + .'- process: process'."\n" + .'- file: file', 'type' => 'string', 'example' => 'ip', 'required' => false], ], [ - 'name' => 'IsMalwareEntity', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '是否恶意实体。 取值：'."\n" - .'- 0:否'."\n" - .'- 1:是。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The event UUID.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'required' => false], ], [ - 'name' => 'Tags', + 'name' => 'EntityUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '实体标签。格式为JSON数组字符串：\\"[{\\"tagKey1\\":\\"tagValue1\\"},{\\"tagKey2\\":\\"tagValue2\\"}]\\"', - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'required' => false], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'required' => false], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'required' => false], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region in which the data management center of the threat analysis feature resides. Select the data management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland or Hong Kong (China).'."\n" + .'- ap-southeast-1: Your assets reside in regions outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<EntityInfo>>', - 'description' => 'PageResponse<List<EntityInfo>>', + 'title' => '', + 'description' => 'PageResponse<List<DisposeAndScopeView>>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => '', - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => '', - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + .'- true: Successful.'."\n" + .'- false: Failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The response status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The response message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => '', + 'title' => '', + 'description' => 'The response data.', 'type' => 'object', 'properties' => [ 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => '', + 'title' => '', + 'description' => 'The pagination information.', 'type' => 'object', 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], + 'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], + 'example' => '', ], 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => '', + 'title' => '', + 'description' => 'The detailed data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '实体ID。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789***', - ], - 'GmtCreate' => [ - 'title' => '实体采集时间。', - 'description' => '', - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '实体最后更新时间。', - 'description' => '', - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => 'siem主用户ID。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789****', - ], - 'IncidentUuid' => [ - 'title' => '事件ID。', - 'description' => '', - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '告警ID。', - 'description' => '', - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'AlertNum' => [ - 'title' => '实体关联告警数量。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'EventNum' => [ - 'title' => '实体关联事件数量。', - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'CloudCode' => [ - 'title' => '实体来源云code。 取值：'."\n" - .'- aliyun：阿里云'."\n" - .'- qcloud：腾讯云'."\n" - .'- hcloud：华为云', - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun', - ], - 'EntityType' => [ - 'title' => '实体类型。取值：'."\n" - .'- ip:ip'."\n" - .'- domain：域名'."\n" - .'- url：url'."\n" - .'- process：进程'."\n" - .'- file：文件'."\n" - .'- host：主机', - 'description' => '', - 'type' => 'string', - 'example' => 'ip', - ], - 'EntityName' => [ - 'title' => '实体名称。', - 'description' => '', - 'type' => 'string', - 'example' => '123.123.123.123', - ], - 'EntityInfo' => [ - 'title' => '实体展示信息 json格式。', - 'description' => '', - 'type' => 'string', - 'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c****","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246b****","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-2023****"}', - ], - 'SubUserId' => [ - 'title' => '实体关联账号id', - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '113091674488****', - ], - 'EntityId' => [ - 'title' => '实体逻辑id', - 'description' => '', - 'type' => 'string', - 'example' => '12345****', - ], - 'EntityUuid' => [ - 'title' => '实体uuid', - 'description' => '', - 'type' => 'string', - 'example' => '8087b3e4aa6862852c100c8738cf****', - ], - 'MalwareType' => [ - 'title' => '实体恶意类型', - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun.siem.sas.alert_tag.webshell', - ], - 'IsAsset' => [ - 'type' => 'string', - ], - 'IsMalware' => [ - 'type' => 'string', - ], - 'Tags' => [ - 'type' => 'string', - ], - 'AgentDisposalMethod' => [ - 'type' => 'string', + 'EntityId' => ['title' => '', 'description' => 'The entity ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '12345****'], + 'EntityType' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n" + .'- ip: IP address'."\n" + .'- domain: domain name'."\n" + .'- url: URL'."\n" + .'- process: process'."\n" + .'- file: file'."\n" + .'- host: host', 'type' => 'string', 'example' => 'ip'], + 'OpcodeMap' => [ + 'title' => '', + 'description' => 'The key-value pairs of opcode and oplevel.', + 'type' => 'object', + 'additionalProperties' => ['description' => 'The key-value pairs of opcode and oplevel.', 'type' => 'string', 'example' => '{"7","2"}', 'title' => ''], + 'example' => '12345', ], - 'AgentDisposalPlaybookUuid' => [ - 'type' => 'string', + 'OpcodeSet' => [ + 'title' => '', + 'description' => 'The recommended playbook opcodes for entity disposition.', + 'type' => 'array', + 'items' => ['description' => 'The recommended playbook opcodes for entity disposition.', 'type' => 'string', 'example' => '7', 'title' => ''], + 'example' => '[1,3]', ], - 'AgentDisposalSuggestion' => [ - 'type' => 'string', + 'EntityInfo' => ['title' => '', 'description' => 'The entity information.', 'type' => 'object', 'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c****","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246b****","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-2023****"}'], + 'Dispose' => ['title' => '', 'description' => 'The disposition object.', 'type' => 'string', 'example' => '192.168.*.*'], + 'Scope' => [ + 'title' => '', + 'description' => 'The disposition scope. The list of user IDs that can perform the disposition.', + 'type' => 'array', + 'items' => ['description' => 'The disposition scope. The list of user IDs that can perform the disposition.', 'type' => 'any', 'example' => '[127608589417****]', 'title' => ''], + 'example' => '176618589410****', ], - 'AgentConfidence' => [ - 'type' => 'string', + 'PlaybookList' => [ + 'title' => '', + 'description' => 'The list of playbooks that can dispose of the entity.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'OpCode' => ['title' => '', 'description' => 'The playbook opcode, which corresponds to the recommended playbook opcode for entity disposition.', 'type' => 'string', 'example' => '7'], + 'OpLevel' => ['title' => '', 'description' => 'Indicates whether the playbook is selected by default for one-click event disposition. Valid values:'."\n" + ."\n" + .'- 2: Selected. '."\n" + .'- 1: Displayed but not selected.', 'type' => 'string', 'example' => '2'], + 'Description' => ['title' => '', 'description' => 'The playbook description.', 'type' => 'string', 'example' => 'WafBlockIP'], + 'DisplayName' => ['title' => '', 'description' => 'The display name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP'], + 'TaskConfig' => ['title' => '', 'description' => 'The opcode configuration.', 'type' => 'string', 'example' => '{"opCode":"3"}'], + 'Name' => ['title' => '', 'description' => 'The playbook name, which is the unique identifier of the playbook.', 'type' => 'string', 'example' => 'kill_process_isolate_file'], + 'Uuid' => ['title' => '', 'description' => 'The playbook UUID, which is the unique identifier of the playbook.', 'type' => 'string', 'example' => 'kill_process_isolate_file'], + 'ParamConfig' => [ + 'title' => '', + 'description' => 'The parameter list and corresponding parameter properties of the playbook.', + 'type' => 'array', + 'items' => ['description' => 'The input parameter list and input parameter format requirements of the current playbook.', 'type' => 'any', 'example' => '{'."\n" + .' "ParamConfig": ['."\n" + .' {'."\n" + .' "Field": "dispose",'."\n" + .' "Necessary": true,'."\n" + .' "CheckField": "[{"fieldPath":"$.ip","fieldName":"ip"}]"'."\n" + .' },'."\n" + .' {'."\n" + .' "Field": "alert",'."\n" + .' "Necessary": true,'."\n" + .' "CheckField": "[{"fieldPath":"$.host_uuid","fieldName":"host_uuid"}]"'."\n" + .' },'."\n" + .' {'."\n" + .' "Field": "scope",'."\n" + .' "Necessary": true,'."\n" + .' "Value": "$.main_user_id"'."\n" + .' },'."\n" + .' {'."\n" + .' "Field": "startTime",'."\n" + .' "Necessary": true'."\n" + .' },'."\n" + .' {'."\n" + .' "Field": "endTime",'."\n" + .' "Necessary": true'."\n" + .' }'."\n" + .' ]'."\n" + .'}', 'title' => ''], + 'example' => '', + ], + 'WafPlaybook' => ['title' => '', 'description' => 'Indicates whether this is a WAF playbook. Valid values:'."\n" + ."\n" + .'- true: Yes.'."\n" + .'- false: No.', 'type' => 'boolean', 'example' => 'false'], + 'Available' => ['description' => 'Indicates whether the playbook is available. Valid values:'."\n" + ."\n" + .'- 1: Available.'."\n" + .'- 0: Unavailable.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'UnAvailableCode' => ['description' => 'The code that indicates why the playbook is unavailable. Valid values:'."\n" + ."\n" + .'- PARAM_INVALID: The input parameters are invalid. '."\n" + .'- NO_INGESTION: The corresponding product is not connected.', 'type' => 'string', 'example' => 'PARAM_INVALID', 'title' => ''], + 'DisposeStatus' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'ErrorMessage' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '[{"name":"云安全中心-云服务器安全","code":"1"}]', ], + 'AlertNum' => ['title' => '', 'description' => 'The number of alerts associated with the entity.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve entities and playbooks for disposition', + 'summary' => 'Retrieves the list of entities that require disposition and the list of playbooks.', + 'changeSet' => [ + ['createdAt' => '2024-11-04T11:26:51.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-01-18T11:56:37.000Z', 'description' => 'Error codes changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 0,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"AlertNum\\": 1,\\n \\"EventNum\\": 1,\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"EntityType\\": \\"ip\\",\\n \\"EntityName\\": \\"123.123.123.123\\",\\n \\"EntityInfo\\": \\"{\\\\\\"file_path\\\\\\": \\\\\\"c:/www/leixi.jsp\\\\\\",\\\\\\"file_hash\\\\\\": \\\\\\"aa0ca926ad948cd820e0a3d9a18c****\\\\\\",\\\\\\"host_uuid\\\\\\": \\\\\\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\\\\\",\\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\",\\\\\\"host_name\\\\\\": \\\\\\"launch-advisor-2023****\\\\\\"}\\",\\n \\"SubUserId\\": 0,\\n \\"EntityId\\": \\"12345****\\",\\n \\"EntityUuid\\": \\"8087b3e4aa6862852c100c8738cf****\\",\\n \\"MalwareType\\": \\"aliyun.siem.sas.alert_tag.webshell\\",\\n \\"IsAsset\\": \\"1\\",\\n \\"IsMalware\\": \\"0\\",\\n \\"Tags\\": \\"[{\\\\\\"tagKey1\\\\\\":\\\\\\"tagValue1\\\\\\"},{\\\\\\"tagKey2\\\\\\":\\\\\\"tagValue2\\\\\\"}]\\",\\n \\"AgentDisposalMethod\\": \\"delete_file\\",\\n \\"AgentDisposalPlaybookUuid\\": \\"12XAD-SFQ-WAF-2ca2\\",\\n \\"AgentDisposalSuggestion\\": \\"{}\\",\\n \\"AgentConfidence\\": \\"85\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'ListEntities', - ], - 'DescribeEntityInfo' => [ - 'summary' => 'Queries the details of an entity.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeAndPlaybook'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeDisposeAndPlaybook', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"EntityId\\": 0,\\n \\"EntityType\\": \\"ip\\",\\n \\"OpcodeMap\\": {\\n \\"key\\": \\"{\\\\\\"7\\\\\\",\\\\\\"2\\\\\\"}\\"\\n },\\n \\"OpcodeSet\\": [\\n \\"7\\"\\n ],\\n \\"EntityInfo\\": {\\n \\"file_path\\": \\"c:/www/leixi.jsp\\",\\n \\"file_hash\\": \\"aa0ca926ad948cd820e0a3d9a18c****\\",\\n \\"host_uuid\\": \\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\",\\n \\"malware_type\\": \\"${aliyun.siem.sas.alert_tag.webshell}\\",\\n \\"host_name\\": \\"launch-advisor-2023****\\"\\n },\\n \\"Dispose\\": \\"192.168.*.*\\",\\n \\"Scope\\": [\\n \\"[127608589417****]\\"\\n ],\\n \\"PlaybookList\\": [\\n {\\n \\"OpCode\\": \\"7\\",\\n \\"OpLevel\\": \\"2\\",\\n \\"Description\\": \\"WafBlockIP\\",\\n \\"DisplayName\\": \\"WafBlockIP\\",\\n \\"TaskConfig\\": \\"{\\\\\\"opCode\\\\\\":\\\\\\"3\\\\\\"}\\",\\n \\"Name\\": \\"kill_process_isolate_file\\",\\n \\"Uuid\\": \\"kill_process_isolate_file\\",\\n \\"ParamConfig\\": [\\n \\"{\\\\n\\\\t\\\\\\"ParamConfig\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"dispose\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{"fieldPath":"$.ip","fieldName":"ip"}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"alert\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{"fieldPath":"$.host_uuid","fieldName":"host_uuid"}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"scope\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"Value\\\\\\": \\\\\\"$.main_user_id\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"startTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"endTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\"\\n ],\\n \\"WafPlaybook\\": false,\\n \\"Available\\": \\"1\\",\\n \\"UnAvailableCode\\": \\"PARAM_INVALID\\",\\n \\"DisposeStatus\\": \\"\\",\\n \\"ErrorMessage\\": \\"\\"\\n }\\n ],\\n \\"AlertNum\\": 1\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'DescribeDisposeStrategyPlaybook' => [ + 'summary' => 'Retrieves the list of playbooks used in a disposal policy.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'EntityId', - 'in' => 'formData', - 'schema' => [ - 'title' => '实体逻辑ID。', - 'description' => 'The logical ID of the entity.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '12345', - ], - ], - [ - 'name' => 'EntityIdentity', - 'in' => 'formData', - 'schema' => [ - 'title' => '实体特征值，可以对处置实体进行模糊搜索。', - 'description' => 'The feature value of the entity. Fuzzy match is supported.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'test22.php', - ], - ], - [ - 'name' => 'IncidentUuid', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The start time of the query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000'], ], [ - 'name' => 'SophonTaskId', + 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => 'soar处置策略ID。', - 'description' => 'The ID of the SOAR handling policy.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa', - ], + 'schema' => ['title' => '', 'description' => 'The end time of the query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: The assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<EventEntityInfo>', - 'description' => 'BaseResponse'."\n", + 'title' => 'BaseResponse<List<StrategyPlaybookList>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'EntityId' => [ - 'title' => '实体逻辑id。', - 'description' => 'The logical ID of the entity.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '12345', - ], - 'EntityType' => [ - 'title' => '实体类型，ip:ip, 域名：domain， url：url， 进程：process， 文件：file， 主机：host。', - 'description' => 'The type of the entity. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* domain'."\n" - .'* url'."\n" - .'* process'."\n" - .'* file'."\n" - .'* host'."\n", - 'type' => 'string', - 'example' => 'ip', - ], - 'EntityInfo' => [ - 'title' => '实体信息。', - 'description' => 'The information about the entry.'."\n", - 'type' => 'object', - 'example' => '{ location: "xian", net_connect_dir: "in", malware_type: "${aliyun.siem.sas.alert_tag.login_unusual_account}" }', - ], - 'TipInfo' => [ - 'title' => '威胁情报信息。', - 'description' => 'The information about the risk Intelligence.'."\n", - 'type' => 'object', - 'example' => '{'."\n" - .' "Ip": {'."\n" - .' "queryHot": "0",'."\n" - .' "country": "China",'."\n" - .' "province": "shanxi",'."\n" - .' "ip": "221.11.XX.XXX",'."\n" - .' "asn": "4837",'."\n" - .' "asn_label": "CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN"'."\n" - .' }'."\n" - .'}', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'PlaybookName' => ['title' => '', 'description' => 'The unique name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP'], + 'PlaybookUuid' => ['title' => '', 'description' => 'The UUID of the playbook.', 'type' => 'string', 'example' => 'system_aliyun_clb_process_book'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeDisposeStrategyPlaybook', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"EntityId\\": 12345,\\n \\"EntityType\\": \\"ip\\",\\n \\"EntityInfo\\": {\\n \\"test\\": \\"test\\",\\n \\"test2\\": 1\\n },\\n \\"TipInfo\\": {\\n \\"Ip\\": {\\n \\"queryHot\\": \\"0\\",\\n \\"country\\": \\"China\\",\\n \\"province\\": \\"shanxi\\",\\n \\"ip\\": \\"221.11.XX.XXX\\",\\n \\"asn\\": \\"4837\\",\\n \\"asn_label\\": \\"CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN\\"\\n }\\n }\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeEntityInfo', - ], - 'PostEventDisposeAndWhiteruleList' => [ - 'summary' => 'Submits event handling information.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeStrategyPlaybook'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeDisposeStrategyPlaybook', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"PlaybookName\\": \\"WafBlockIP\\",\\n \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeEntityInfo' => [ + 'summary' => 'Retrieves the details of an entity.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'IncidentUuid', + 'name' => 'EntityId', 'in' => 'formData', - 'schema' => [ - 'title' => '事件id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The logical ID of the entity.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '12345'], ], [ - 'name' => 'Status', + 'name' => 'EntityIdentity', 'in' => 'formData', - 'schema' => [ - 'title' => '事件状态。 取值：'."\n" - .'- 0:未处理 '."\n" - .'-1:处理中 '."\n" - .'-5：处理失败 '."\n" - .'-10:已处理', - 'description' => 'The status of the event. Valid values:'."\n" - ."\n" - .'* 0: unhandled'."\n" - .'* 1: handing'."\n" - .'* 5: handling failed'."\n" - .'* 10: handled'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['title' => '', 'description' => 'The feature value of the entity. You can perform a fuzzy search for the entity.', 'type' => 'string', 'required' => false, 'example' => 'test22.php'], ], [ - 'name' => 'Remark', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '事件备注。', - 'description' => 'The remarks of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'dealed', - ], + 'schema' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ - 'name' => 'EventDispose', + 'name' => 'SophonTaskId', 'in' => 'formData', - 'schema' => [ - 'title' => '事件处置配置 json对象。', - 'description' => 'The configuration of event handling. The value is a JSON object.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '['."\n" - .' {'."\n" - .' "playbookName": "WafBlockIP",'."\n" - .' "entityId": "104466118",'."\n" - .' "scope": ['."\n" - .' "176618589410****"'."\n" - .' ],'."\n" - .' "startTime": 1604168946281,'."\n" - .' "endTime": 1614168946281'."\n" - .' },'."\n" - .' {'."\n" - .' "playbookName": "WafBlockIP",'."\n" - .' "entityId": "104466118",'."\n" - .' "scope": ['."\n" - .' {'."\n" - .' "instanceId": "waf-cn-n6w1oy1****",'."\n" - .' "domains": ['."\n" - .' "lmfip.wafqax.***"'."\n" - .' ]'."\n" - .' }'."\n" - .' ],'."\n" - .' "startTime": 1604168946281,'."\n" - .' "endTime": 1614168946281'."\n" - .' }'."\n" - .']', - ], - ], - [ - 'name' => 'ReceiverInfo', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警接收人配置 json对象', - 'description' => 'The configuration of the alert recipient. The value is a JSON object.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '{'."\n" - .' "messageTitle": "test",'."\n" - .' "receiver": "xiaowang",'."\n" - .' "channel": "message"'."\n" - .'}', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the SOAR response policy.', 'type' => 'string', 'required' => false, 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. The administrator can use this ID to switch to the view of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - [ - 'name' => 'ThreatLevel', - 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], - ], - [ - 'name' => 'Owner', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件责任人账号uid', - 'type' => 'string', - 'example' => '1234567890xxxxxx', - ], - ], - [ - 'name' => 'ResponseSource', - 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], - ], - [ - 'name' => 'DisposeStrategyIds', - 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<String>', - 'description' => 'BaseResponse'."\n", + 'title' => 'BaseResponse<EventEntityInfo>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'string', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'EntityId' => ['title' => '', 'description' => 'The logical ID of the entity.', 'type' => 'integer', 'format' => 'int64', 'example' => '12345'], + 'EntityType' => ['title' => '', 'description' => 'The type of the entity. Valid values:'."\n" + ."\n" + .'- ip: IP address'."\n" + ."\n" + .'- domain: domain name'."\n" + ."\n" + .'- url: URL'."\n" + ."\n" + .'- process: process'."\n" + ."\n" + .'- file: file'."\n" + ."\n" + .'- host: host', 'type' => 'string', 'example' => 'ip'], + 'EntityInfo' => ['title' => '', 'description' => 'The information about the entity.', 'type' => 'object', 'example' => '{ location: "xian", net_connect_dir: "in", malware_type: "${aliyun.siem.sas.alert_tag.login_unusual_account}" }'], + 'TipInfo' => ['title' => '', 'description' => 'The threat intelligence information.', 'type' => 'object', 'example' => '{'."\n" + .' "Ip": {'."\n" + .' "queryHot": "0",'."\n" + .' "country": "China",'."\n" + .' "province": "shanxi",'."\n" + .' "ip": "221.11.XX.XXX",'."\n" + .' "asn": "4837",'."\n" + .' "asn_label": "CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN"'."\n" + .' }'."\n" + .'}'], + ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeEntityInfo', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostEventDisposeAndWhiteruleList', - ], - 'DescribeWafScope' => [ - 'summary' => 'Queries the protected domain names of the WAF instance for a user to which an entity belongs.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEntityInfo'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeEntityInfo', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"EntityId\\": 12345,\\n \\"EntityType\\": \\"ip\\",\\n \\"EntityInfo\\": {\\n \\"test\\": \\"test\\",\\n \\"test2\\": 1\\n },\\n \\"TipInfo\\": {\\n \\"Ip\\": {\\n \\"queryHot\\": \\"0\\",\\n \\"country\\": \\"China\\",\\n \\"province\\": \\"shanxi\\",\\n \\"ip\\": \\"221.11.XX.XXX\\",\\n \\"asn\\": \\"4837\\",\\n \\"asn_label\\": \\"CHINAXXX-Backbone - CHINA UNICOM ChinaXXX Backbone, CN\\"\\n }\\n }\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeEventCountByThreatLevel' => [ + 'summary' => 'You can obtain the count for each event type.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ - 'name' => 'EntityId', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '实体ID。', - 'description' => 'The ID of the entity.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '20617784', - ], + 'schema' => ['description' => 'Start time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], + ], + [ + 'name' => 'EndTime', + 'in' => 'formData', + 'schema' => ['description' => 'End time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1577808000000', 'title' => '', 'required' => false], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'View type.'."\n" + ."\n" + .'- 0: View for the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: View for all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'Resource directory member account ID.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'Region where the Data Management Center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<WafScope>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => 'PlainResponse<EventCounter>', + 'description' => 'PlainResponse\\<eventcounter>\\</eventcounter>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'InstanceId' => [ - 'title' => 'waf实例ID。', - 'description' => 'The ID of the WAF instance.'."\n", - 'type' => 'string', - 'example' => 'waf-cn-tl123ast****', - ], - 'Aliuid' => [ - 'title' => 'siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'Domains' => [ - 'title' => 'waf实例下的防护的域名列表。', - 'description' => 'The domain names that are protected by the WAF instance.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The domain name that is protected by the WAF instance.'."\n", - 'type' => 'string', - 'example' => '[123***.com, 456***.com]', + 'title' => '', + 'description' => 'Response data.', + 'type' => 'object', + 'properties' => [ + 'EventNum' => ['description' => 'Total number of events.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''], + 'UndealEventNum' => ['description' => 'Number of unhandled events.', 'type' => 'integer', 'format' => 'int64', 'example' => '75', 'title' => ''], + 'HighLevelEventNum' => ['description' => 'Number of high-risk events.', 'type' => 'integer', 'format' => 'int64', 'example' => '20', 'title' => ''], + 'MediumLevelEventNum' => ['description' => 'Number of medium-risk events.', 'type' => 'integer', 'format' => 'int64', 'example' => '3', 'title' => ''], + 'LowLevelEventNum' => ['description' => 'Number of low-risk events.', 'type' => 'integer', 'format' => 'int64', 'example' => '52', 'title' => ''], + 'SeriousLevelEventNum' => ['description' => 'Number of critical events.', 'type' => 'integer', 'format' => 'int64', 'example' => '0', 'title' => ''], + 'InfoLevelEventNum' => ['description' => 'Number of informational events.', 'type' => 'integer', 'format' => 'int64', 'example' => '0', 'title' => ''], + 'EventDailyNum' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Date' => ['description' => 'Date.', 'type' => 'string', 'example' => '2025-10-06', 'title' => ''], + 'EventNum' => ['description' => 'Total number of security events.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''], + 'UndealEventNum' => ['description' => 'Number of unhandled security events.', 'type' => 'integer', 'format' => 'int64', 'example' => '34', 'title' => ''], ], - 'example' => '[123.com, 456.com]', + 'description' => '', + 'title' => '', + 'example' => '', ], + 'description' => 'Daily event statistics.', + 'title' => '', + 'example' => '', ], ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['description' => 'Indicates whether the request succeeded. Valid values:'."\n" + ."\n" + .'- true: The request succeeded.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Code' => ['description' => 'HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''], + 'Message' => ['description' => 'Response message.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'RequestId' => ['description' => 'Request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"EventNum\\": 100,\\n \\"UndealEventNum\\": 75,\\n \\"HighLevelEventNum\\": 20,\\n \\"MediumLevelEventNum\\": 3,\\n \\"LowLevelEventNum\\": 52,\\n \\"SeriousLevelEventNum\\": 0,\\n \\"InfoLevelEventNum\\": 0,\\n \\"EventDailyNum\\": [\\n {\\n \\"Date\\": \\"2025-10-06\\",\\n \\"EventNum\\": 100,\\n \\"UndealEventNum\\": 34\\n }\\n ]\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'title' => 'DescribeEventCountByThreatLevel', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n \\"Aliuid\\": 0,\\n \\"Domains\\": [\\n \\"[123***.com, 456***.com]\\"\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeWafScope', - ], - 'DescribeEventDispose' => [ - 'summary' => 'Queries the handling policies of a historical event.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventCountByThreatLevel'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeEventCountByThreatLevel', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'DescribeEventDispose' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The number of the page to return. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '1', 'example' => '1'], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 500.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'maximum' => '500', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries to return on each page. The maximum value is 500.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'maximum' => '500', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region based on the region where your assets are deployed. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are deployed in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are deployed in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'BaseResponse<EventDisposeConfig>', - 'description' => 'BaseResponse'."\n", + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'Status' => [ - 'title' => '事件状态。 0:未处理 1:处理中 5：处理失败 10:已处理。', - 'description' => 'The status of the event. Valid values:'."\n" - ."\n" - .'* 0: not handled'."\n" - .'* 1: handing'."\n" - .'* 5: handling failed'."\n" - .'* 10: handled'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'Remark' => [ - 'title' => '事件备注。', - 'description' => 'The description of the event.'."\n", - 'type' => 'string', - 'example' => 'dealed', - ], + 'Status' => ['title' => '', 'description' => 'The status of the event. Valid values:'."\n" + ."\n" + .'- 0: unhandled'."\n" + ."\n" + .'- 1: handling'."\n" + ."\n" + .'- 5: failed'."\n" + ."\n" + .'- 10: handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'Remark' => ['title' => '', 'description' => 'The remarks on the event.', 'type' => 'string', 'example' => 'dealed'], 'EventDispose' => [ - 'title' => '事件处置配置 json对象。', - 'description' => 'An array consisting of JSON objects that are configured for event handling.'."\n", + 'title' => '', + 'description' => 'The JSON object of the event handling configuration.', 'type' => 'array', - 'items' => [ - 'description' => 'The JSON object that is configured for event handling.'."\n", - 'type' => 'any', - 'example' => '{ playbookName: "WafBlockIP", sophonTaskId: "400442a5-4f98-45ed-97db-5ab117eb0b8f", … }', - ], + 'items' => ['description' => 'The JSON object of the event handling configuration.', 'type' => 'any', 'title' => '', 'example' => '{ playbookName: "WafBlockIP", sophonTaskId: "400442a5-4f98-45ed-97db-5ab117eb0b8f", … }'], 'example' => '{ playbookName: "使用安全组封禁入方向IP", sophonTaskId: "400442a5-4f98-45ed-97db-5ab117eb0b8f", … }', ], 'ReceiverInfo' => [ - 'title' => '告警接收人配置 json对象', - 'description' => 'The JSON object that is configured for an alert recipient.'."\n", + 'title' => '', + 'description' => 'The JSON object of the alert recipient configuration.', 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '事件处置结果接收人记录ID。', - 'description' => 'The ID of the recipient who receives the event handling result.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123', - ], - 'GmtCreate' => [ - 'title' => '创建时间。', - 'description' => 'The creation time.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '修改时间。', - 'description' => 'The modification time.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'IncidentUuid' => [ - 'title' => '事件ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'MessageTitle' => [ - 'title' => '消息title。', - 'description' => 'The message title.'."\n", - 'type' => 'string', - 'example' => 'siem event dealed message', - ], - 'Receiver' => [ - 'title' => '接收人联系方式。', - 'description' => 'The contact information of the recipient.'."\n", - 'type' => 'string', - 'example' => '138xxxxxx', - ], - 'Channel' => [ - 'title' => '联系方式渠道。 取值：'."\n" - .'- message:短信 '."\n" - .'- mail：邮件', - 'description' => 'The channel of the contact information. Valid values:'."\n" - ."\n" - .'* message'."\n" - .'* mail'."\n", - 'type' => 'string', - 'example' => 'message', - ], - 'Status' => [ - 'title' => '发送状态 0:未发送 1:已发送', - 'description' => 'Indicates whether the message is sent. Valid values:'."\n" - ."\n" - .'* 0: not sent'."\n" - .'* 1: sent'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], + 'Id' => ['title' => '', 'description' => 'The record ID of the recipient for the event handling result.', 'type' => 'integer', 'format' => 'int64', 'example' => '123'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the record was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the record was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'IncidentUuid' => ['title' => '', 'description' => 'The globally unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'MessageTitle' => ['title' => '', 'description' => 'The title of the message.', 'type' => 'string', 'example' => 'siem event dealed message'], + 'Receiver' => ['title' => '', 'description' => 'The contact information of the recipient.', 'type' => 'string', 'example' => '138xxxxxx'], + 'Channel' => ['title' => '', 'description' => 'The channel to send the notification. Valid values:'."\n" + ."\n" + .'- message: text message'."\n" + ."\n" + .'- mail: email', 'type' => 'string', 'example' => 'message'], + 'Status' => ['title' => '', 'description' => 'The sending status of the notification. Valid values:'."\n" + ."\n" + .'- 0: not sent'."\n" + ."\n" + .'- 1: sent', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], + 'example' => '', ], ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true'."\n" + ."\n" + .'- false', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Status\\": 0,\\n \\"Remark\\": \\"dealed\\",\\n \\"EventDispose\\": [\\n \\"{ playbookName: \\\\\\"WafBlockIP\\\\\\", sophonTaskId: \\\\\\"400442a5-4f98-45ed-97db-5ab117eb0b8f\\\\\\", … }\\"\\n ],\\n \\"ReceiverInfo\\": {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"MessageTitle\\": \\"siem event dealed message\\",\\n \\"Receiver\\": \\"138xxxxxx\\",\\n \\"Channel\\": \\"message\\",\\n \\"Status\\": 1\\n }\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'staticInfo' => ['returnType' => 'synchronous'], 'title' => 'DescribeEventDispose', - ], - 'DescribeEventCountByThreatLevel' => [ - 'summary' => 'Queries the number of events by type.', - 'methods' => [ - 'get', - 'post', + 'summary' => 'Queries the policy handling history for an event.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventDispose'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeEventDispose', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Status\\": 0,\\n \\"Remark\\": \\"dealed\\",\\n \\"EventDispose\\": [\\n \\"{ playbookName: \\\\\\"WafBlockIP\\\\\\", sophonTaskId: \\\\\\"400442a5-4f98-45ed-97db-5ab117eb0b8f\\\\\\", … }\\"\\n ],\\n \\"ReceiverInfo\\": {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"MessageTitle\\": \\"siem event dealed message\\",\\n \\"Receiver\\": \\"138xxxxxx\\",\\n \\"Channel\\": \\"message\\",\\n \\"Status\\": 1\\n }\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeImportedLogCount' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -7937,1123 +5642,544 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], + 'abilityTreeCode' => '195544', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'StartTime', - 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], - ], - [ - 'name' => 'EndTime', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The region where the management hub of Threat Analysis is located. Select the region of the management hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view.'."\n" - ."\n" - .'* 0: view of the current Alibaba Cloud account.'."\n" - .'* 1: view of all accounts for the enterprise.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'string', 'required' => false, 'pattern' => '^\\d+$', 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the member in the resource directory.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], - ], - [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'string', 'required' => false, 'pattern' => '^\\d+$', 'title' => '', 'example' => '113091674488****'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<EventCounter>', - 'description' => 'PlainResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<DescribeImportedLogCountResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The returned data.', 'type' => 'object', 'properties' => [ - 'EventNum' => [ - 'title' => '事件总数。', - 'description' => 'The total number of events.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - 'UndealEventNum' => [ - 'title' => '未处理事件数。', - 'description' => 'The number of unhandled events.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '75', - ], - 'HighLevelEventNum' => [ - 'title' => '高风险事件数。', - 'description' => 'The number of high-risk events.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '20', - ], - 'MediumLevelEventNum' => [ - 'title' => '中风险事件数。', - 'description' => 'The number of medium-risk events.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '3', - ], - 'LowLevelEventNum' => [ - 'title' => '低分险事件数。', - 'description' => 'The number of low-risk events.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '52', - ], - 'SeriousLevelEventNum' => [ - 'type' => 'integer', - 'format' => 'int64', - ], - 'InfoLevelEventNum' => [ - 'type' => 'integer', - 'format' => 'int64', - ], - 'EventDailyNum' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Date' => [ - 'type' => 'string', - ], - 'EventNum' => [ - 'type' => 'integer', - 'format' => 'int64', - ], - 'UndealEventNum' => [ - 'type' => 'integer', - 'format' => 'int64', - ], - ], - ], - ], + 'TotalLogCount' => ['title' => '', 'description' => 'The total number of logs.', 'type' => 'integer', 'format' => 'int32', 'example' => '59'], + 'ImportedLogCount' => ['title' => '', 'description' => 'The number of ingested logs.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'UnImportedLogCount' => ['title' => '', 'description' => 'The number of logs that are not ingested.', 'type' => 'integer', 'format' => 'int32', 'example' => '49'], ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeImportedLogCount', + 'summary' => 'Queries the number of imported logs.', + 'changeSet' => [ + ['createdAt' => '2024-12-16T08:46:55.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-07-08T11:46:03.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"EventNum\\": 100,\\n \\"UndealEventNum\\": 75,\\n \\"HighLevelEventNum\\": 20,\\n \\"MediumLevelEventNum\\": 3,\\n \\"LowLevelEventNum\\": 52,\\n \\"SeriousLevelEventNum\\": 0,\\n \\"InfoLevelEventNum\\": 0,\\n \\"EventDailyNum\\": [\\n {\\n \\"Date\\": \\"2025-10-06\\",\\n \\"EventNum\\": 100,\\n \\"UndealEventNum\\": 34\\n }\\n ]\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeEventCountByThreatLevel', - ], - 'DescribeDisposeAndPlaybook' => [ - 'summary' => 'Queries the list of entities and playbooks that need to be handled.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeImportedLogCount'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeImportedLogCount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"TotalLogCount\\": 59,\\n \\"ImportedLogCount\\": 10,\\n \\"UnImportedLogCount\\": 49\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'DescribeLogFields' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas104PTS', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'EntityType', - 'in' => 'formData', - 'schema' => [ - 'title' => '实体类型。取值：'."\n" - .'- ip：ip'."\n" - .'- process：进程'."\n" - .'- file：文件机', - 'description' => 'The entity type. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* process'."\n" - .'* file'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ip', - ], - ], - [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - ], - [ - 'name' => 'EntityUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '实体uuid。', - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - ], - [ - 'name' => 'CurrentPage', + 'name' => 'LogType', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The log source for the rule.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_sas_alert'], ], [ - 'name' => 'PageSize', + 'name' => 'LogSource', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries to return on each page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The log source for the rule.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_sas_alert'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member whose view the administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the threat analysis Management Hub is located. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<DisposeAndScopeView>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'PlainResponse<List<CustomizeRuleField>>', + 'description' => 'PlainResponse\\<List>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'EntityId' => [ - 'title' => '实体id。', - 'description' => 'The entity ID'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '12345', - ], - 'EntityType' => [ - 'title' => '实体类型。取值：'."\n" - .'- ip:ip'."\n" - .'- domain：域名'."\n" - .'- url：url'."\n" - .'- process：进程'."\n" - .'- file：文件'."\n" - .'- host：主机', - 'type' => 'string', - 'example' => 'ip', - ], - 'OpcodeMap' => [ - 'title' => '实体id。', - 'description' => 'The key-value pairs each of which consists of opcode and oplevel.'."\n", - 'type' => 'object', - 'additionalProperties' => [ - 'type' => 'string', - 'example' => '{"7","2"}', - 'description' => 'The key-value pair that consists of opcode and oplevel.'."\n", - ], - 'example' => '12345', - ], - 'OpcodeSet' => [ - 'title' => '实体处置推荐剧本code。', - 'description' => 'The codes of the playbooks that are recommended for entity handling.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The code of the playbook that is recommended for entity handling.'."\n", - 'type' => 'string', - 'example' => '7', - ], - 'example' => '[1,3]', - ], - 'EntityInfo' => [ - 'title' => '实体信息。', - 'description' => 'The entity information.'."\n", - 'type' => 'object', - 'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c09d0","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246bcbb3","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-20230531"}', - ], - 'Dispose' => [ - 'title' => '处置对象。', - 'description' => 'The object for handling.'."\n", - 'type' => 'string', - 'example' => '192.168.1.1', - ], - 'Scope' => [ - 'title' => '处置作用域，可进行处置用户id列表。', - 'description' => 'The IDs of the users who can handle objects.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The ID of the user who can handle objects.'."\n", - 'type' => 'any', - 'example' => '[1276085894174392]', - ], - 'example' => '176618589410****', - ], - 'PlaybookList' => [ - 'title' => '能够处置该实体的剧本列表。', - 'description' => 'The playbooks that can handle the entity.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'OpCode' => [ - 'title' => '剧本opcode，与处置实体的推荐剧本opcode相对应。', - 'description' => 'The opcode of the playbook, which corresponds to the opcode of the playbook recommended for entity handling.'."\n", - 'type' => 'string', - 'example' => '7', - ], - 'OpLevel' => [ - 'title' => '事件一键处置是否默认勾选，2：勾选 1：只展示不勾选。', - 'description' => 'Indicates whether quick event handling is selected by default. Valid values:'."\n" - ."\n" - .'* 2: Quick event handling is selected.'."\n" - .'* 1: Quick event handling is displayed but not selected.'."\n", - 'type' => 'string', - 'example' => '2', - ], - 'Description' => [ - 'title' => '剧本描述。', - 'description' => 'The playbook description.'."\n", - 'type' => 'string', - 'example' => 'WafBlockIP', - ], - 'DisplayName' => [ - 'title' => '剧本显示名称。', - 'description' => 'The display name of the playbook.'."\n", - 'type' => 'string', - 'example' => 'WafBlockIP', - ], - 'TaskConfig' => [ - 'title' => 'opcode配置。', - 'description' => 'The opcode configuration.'."\n", - 'type' => 'string', - 'example' => '{"opCode":"3"}', - ], - 'Name' => [ - 'title' => '剧本名称，剧本唯一标识。', - 'description' => 'The playbook name, which is the unique identifier of the playbook.'."\n", - 'type' => 'string', - 'example' => 'kill_process_isolate_file', - ], - 'Uuid' => [ - 'title' => '剧本uuid，剧本唯一标识。', - 'type' => 'string', - 'example' => 'kill_process_isolate_file', - ], - 'ParamConfig' => [ - 'title' => '剧本的参数列表以及对应参数属性', - 'description' => 'The playbook parameters and the corresponding properties.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The input parameters and format requirements of the current playbook.'."\n", - 'type' => 'any', - 'example' => '{'."\n" - .' "ParamConfig": ['."\n" - .' {'."\n" - .' "Field": "dispose",'."\n" - .' "Necessary": true,'."\n" - .' "CheckField": "[{"fieldPath":"$.ip","fieldName":"ip"}]"'."\n" - .' },'."\n" - .' {'."\n" - .' "Field": "alert",'."\n" - .' "Necessary": true,'."\n" - .' "CheckField": "[{"fieldPath":"$.host_uuid","fieldName":"host_uuid"}]"'."\n" - .' },'."\n" - .' {'."\n" - .' "Field": "scope",'."\n" - .' "Necessary": true,'."\n" - .' "Value": "$.main_user_id"'."\n" - .' },'."\n" - .' {'."\n" - .' "Field": "startTime",'."\n" - .' "Necessary": true'."\n" - .' },'."\n" - .' {'."\n" - .' "Field": "endTime",'."\n" - .' "Necessary": true'."\n" - .' }'."\n" - .' ]'."\n" - .'}', - ], - ], - 'WafPlaybook' => [ - 'title' => '是否是waf剧本。', - 'description' => 'Indicates whether the playbook is intended for Web Application Firewall (WAF). Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'false', - ], - 'Available' => [ - 'type' => 'string', - ], - ], - ], - 'example' => '', - ], - 'AlertNum' => [ - 'title' => '该实体关联的告警数。', - 'description' => 'The number of alerts that are associated with the entity.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - ], - ], + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'FieldName' => ['title' => '', 'description' => 'The name of the rule field.', 'type' => 'string', 'example' => 'activity_name'], + 'FieldDesc' => ['title' => '', 'description' => 'The Medusa code for the field description.', 'type' => 'string', 'example' => 'sas.cloudsiem.prod.activity_name'], + 'LogCode' => ['title' => '', 'description' => 'The log source to which the field belongs.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'], + 'ActivityName' => ['title' => '', 'description' => 'The log type to which the field belongs.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY'], + 'FieldType' => ['title' => '', 'description' => 'The data type of the field. Valid values:'."\n" + ."\n" + .'- varchar: string'."\n" + ."\n" + .'- bigint: number', 'type' => 'string', 'example' => 'varchar'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], 'example' => '123456', ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeLogFields', + 'summary' => 'Retrieves the list of configurable fields for custom rules.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"EntityId\\": 0,\\n \\"EntityType\\": \\"ip\\",\\n \\"OpcodeMap\\": {\\n \\"key\\": \\"{\\\\\\"7\\\\\\",\\\\\\"2\\\\\\"}\\"\\n },\\n \\"OpcodeSet\\": [\\n \\"7\\"\\n ],\\n \\"EntityInfo\\": {\\n \\"file_path\\": \\"c:/www/leixi.jsp\\",\\n \\"file_hash\\": \\"aa0ca926ad948cd820e0a3d9a18c****\\",\\n \\"host_uuid\\": \\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\",\\n \\"malware_type\\": \\"${aliyun.siem.sas.alert_tag.webshell}\\",\\n \\"host_name\\": \\"launch-advisor-2023****\\"\\n },\\n \\"Dispose\\": \\"192.168.*.*\\",\\n \\"Scope\\": [\\n \\"[127608589417****]\\"\\n ],\\n \\"PlaybookList\\": [\\n {\\n \\"OpCode\\": \\"7\\",\\n \\"OpLevel\\": \\"2\\",\\n \\"Description\\": \\"WafBlockIP\\",\\n \\"DisplayName\\": \\"WafBlockIP\\",\\n \\"TaskConfig\\": \\"{\\\\\\"opCode\\\\\\":\\\\\\"3\\\\\\"}\\",\\n \\"Name\\": \\"kill_process_isolate_file\\",\\n \\"Uuid\\": \\"kill_process_isolate_file\\",\\n \\"ParamConfig\\": [\\n \\"{\\\\n\\\\t\\\\\\"ParamConfig\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"dispose\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{"fieldPath":"$.ip","fieldName":"ip"}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"alert\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"CheckField\\\\\\": \\\\\\"[{"fieldPath":"$.host_uuid","fieldName":"host_uuid"}]\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"scope\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true,\\\\n\\\\t\\\\t\\\\t\\\\\\"Value\\\\\\": \\\\\\"$.main_user_id\\\\\\"\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"startTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t},\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"Field\\\\\\": \\\\\\"endTime\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"Necessary\\\\\\": true\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\"\\n ],\\n \\"WafPlaybook\\": false,\\n \\"Available\\": \\"1\\"\\n }\\n ],\\n \\"AlertNum\\": 1\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeDisposeAndPlaybook', - ], - 'DescribeCloudSiemEvents' => [ - 'summary' => 'Queries events in SIEM.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogFields'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeLogFields', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"FieldName\\": \\"activity_name\\",\\n \\"FieldDesc\\": \\"sas.cloudsiem.prod.activity_name\\",\\n \\"LogCode\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"ActivityName\\": \\"HTTP_ACTIVITY\\",\\n \\"FieldType\\": \\"varchar\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeLogSource' => [ + 'summary' => 'Retrieves a list of configurable log sources for custom rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'StartTime', + 'name' => 'LogType', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The log type of the rule.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY'], ], [ - 'name' => 'EndTime', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'ThreadLevel', + 'name' => 'RoleFor', 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'title' => '事件威胁等级，格式为json数组。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk levels of the events. The value is a JSON array. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The risk level of the event. The value is a JSON string. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["remind","serious"]'."\n", - ], - 'required' => false, - 'example' => '["serious","suspicious","remind"]', - 'maxItems' => 100, - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'EventName', + 'name' => 'RegionId', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is deployed. You must select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '事件名称。', - 'description' => 'The name of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ECS unusual log in', + 'title' => 'PlainResponse<List<LogSource>>', + 'description' => 'PlainResponse\\<List>', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'LogSource' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'], + 'LogSourceName' => ['title' => '', 'description' => 'The Medusa code of the log source for the rule.', 'type' => 'string', 'example' => 'sas.cloudsiem.prod.cloud_siem_aegis_sas_alert'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '123456', + ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 500 => [ + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeLogSource', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogSource'], + ], + ], + 'ramActions' => [ [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The ID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeLogSource', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"LogSourceName\\": \\"sas.cloudsiem.prod.cloud_siem_aegis_sas_alert\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeLogType' => [ + 'summary' => 'Retrieves the log types that can be configured for custom rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'AssetId', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件关联的资产ID。', - 'description' => 'The ID of the asset that is associated with the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '6c740667-80b2-476d-8924-2e706feb****', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'EntityUuid', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '事件关联的实体Uuid。', - 'type' => 'string', - 'example' => '6c740667-80b2-476d-8924-2e706feb****', - ], + 'schema' => ['description' => 'The type of the view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in an enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'Status', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '事件状态。 取值：'."\n" - .'- 0:未处理'."\n" - .'- 1:处理中'."\n" - .'- 5：处理失败'."\n" - .'- 10:已处理', - 'description' => 'The status of the event. Valid values:'."\n" - ."\n" - .'* 0: unhandled'."\n" - .'* 1: handling'."\n" - .'* 5: handling failed'."\n" - .'* 10: handled'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'OrderField', + 'name' => 'RegionId', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: for assets in the Chinese mainland and China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: for assets in regions outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '事件列表排列字段。 取值：'."\n" - .'- GmtModified：基于事件产生事件排序（默认）'."\n" - .'- ThreatScore：基于事件威胁评分排序。', - 'description' => 'The sort field. Valid values:'."\n" - ."\n" - .'* GmtModified: sorts the events by creation time. This is the default value.'."\n" - .'* ThreatScore: sorts the events by risk score.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ThreatScore', + 'title' => 'PlainResponse<List<LogType>>', + 'description' => 'PlainResponse\\<List\\<LogType>>', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'LogType' => ['title' => '', 'description' => 'The log type for the rule.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY'], + 'LogTypeName' => ['title' => '', 'description' => 'The code for the log type name.', 'type' => 'string', 'example' => 'sas.cloudsiem.prod.http_activity'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '123456', + ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 500 => [ + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeLogType', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogType'], + ], + ], + 'ramActions' => [ [ - 'name' => 'Order', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件列表排列方向。 取值：'."\n" - .'- desc：降序排列'."\n" - .'- asc：升序排列。', - 'description' => 'The sort order. Valid values:'."\n" - ."\n" - .'* desc: descending order'."\n" - .'* asc: ascending order'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'desc', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeLogType', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"LogType\\": \\"HTTP_ACTIVITY\\",\\n \\"LogTypeName\\": \\"sas.cloudsiem.prod.http_activity\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeOperators' => [ + 'summary' => 'Retrieves the list of operators for custom rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'CurrentPage', - 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'PageSize', + 'name' => 'SceneType', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The scenario for the operator. Valid values:'."\n" + ."\n" + .'- If you leave this parameter empty, the default scenario is used.'."\n" + ."\n" + .'- AGGREGATE: The aggregate function scenario.', 'type' => 'string', 'required' => false, 'example' => 'AGGREGATE'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that are managed by your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region based on your asset location. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets in the Chinese mainland and China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Assets outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<SiemEvent>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'PlainResponse<List<CustomizeRuleOperator>>', + 'description' => 'PlainResponse\\<List>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'GmtCreate' => [ - 'title' => '事件发生时间。', - 'description' => 'The time when the event occurred.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '事件最后更新时间。', - 'description' => 'The time when the event was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => '事件归属主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account to which the event belongs.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'AlertNum' => [ - 'title' => '事件关联告警数。', - 'description' => 'The number of alerts that are associated with the event.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '4', - ], - 'AssetNum' => [ - 'title' => '事件关联资产数。', - 'description' => 'The number of assets that are associated with the event.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '4', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'IncidentName' => [ - 'title' => '事件名称。', - 'description' => 'The name of the event.'."\n", - 'type' => 'string', - 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', - ], - 'IncidentNameEn' => [ - 'title' => '事件英文名称。', - 'description' => 'The event name in English.'."\n", - 'type' => 'string', - 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', - ], - 'Description' => [ - 'title' => '事件描述。', - 'description' => 'The description of the event.'."\n", - 'type' => 'string', - 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc', - ], - 'DescriptionEn' => [ - 'title' => '事件英文描述。', - 'description' => 'The event description in English.'."\n", - 'type' => 'string', - 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc', - ], - 'DataSources' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The sources of the alert.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The source.'."\n", - 'type' => 'string', - 'example' => '[sas,waf]', - ], - 'example' => '[sas,waf]', - ], - 'ThreatLevel' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" - ."\n" - .'* serious: high.'."\n" - .'* suspicious: medium.'."\n" - .'* remind: low.'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'ThreatScore' => [ - 'title' => '事件的威胁分值, 范围 0~100, 分值越高风险等级越高。', - 'description' => 'The risk score of the event. Valid values: 0 to 100. A higher value indicates a higher risk level.'."\n", - 'type' => 'number', - 'format' => 'float', - 'example' => '90.2', - ], - 'ExtContent' => [ - 'title' => '事件扩展信息 json格式。', - 'description' => 'The extended event information in the JSON format.'."\n", - 'type' => 'string', - 'example' => '{"event_transfer_type":"customize_rule"}', - ], - 'Status' => [ - 'title' => '事件状态。 取值：'."\n" - .'- 0:未处理 '."\n" - .'-1:处理中 '."\n" - .'-5：处理失败 '."\n" - .'-10:已处理', - 'description' => 'The status of the event. Valid values:'."\n" - ."\n" - .'* 0: unhandled.'."\n" - .'* 1: handling.'."\n" - .'* 5: handling failed.'."\n" - .'* 10: handled.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'AttCkLabels' => [ - 'title' => 'ATTCT&攻击技术标签集合。', - 'description' => 'The tags of the ATT\\&CK techniques.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The tag of the ATT\\&CK technique.'."\n", - 'type' => 'string', - 'example' => '["T1595.002 Vulnerability Scanning"]', - ], - 'example' => '["T1595.002 Vulnerability Scanning"]', - ], - 'AttckStages' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'TacticId' => [ - 'type' => 'string', - ], - 'TacticName' => [ - 'type' => 'string', - ], - 'AlertNum' => [ - 'type' => 'integer', - 'format' => 'int32', - ], - ], - ], - ], - 'ReferAccount' => [ - 'description' => 'the refer account info.', - 'type' => 'string', - 'example' => '127608589417****', - ], - 'IncidentType' => [ - 'type' => 'string', - ], - 'RuleId' => [ - 'type' => 'string', - ], - 'Remark' => [ - 'title' => '事件备注。', - 'description' => 'The remarks of the event.'."\n", - 'type' => 'string', - 'example' => 'dealed', - ], - ], + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Operator' => ['title' => '', 'description' => 'The operator.', 'type' => 'string', 'example' => '<='], + 'OperatorName' => ['title' => '', 'description' => 'The display name of the operator.', 'type' => 'string', 'example' => '<='], + 'OperatorDescCn' => ['title' => '', 'description' => 'The Chinese description of the operator.', 'type' => 'string', 'example' => 'arger than or equal to'], + 'OperatorDescEn' => ['title' => '', 'description' => 'The English description of the operator.', 'type' => 'string', 'example' => 'larger than or equal to'], + 'SupportDataType' => ['title' => '', 'description' => 'The data types that the operator supports. Multiple data types are separated by commas.', 'type' => 'string', 'example' => 'varchar'], + 'SupportTag' => [ + 'title' => '', + 'description' => 'The scenarios that the operator supports. Multiple scenarios are separated by commas, such as aggregation (AGGREGATE). The default value is empty.', + 'type' => 'array', + 'items' => ['description' => 'The scenarios that the operator supports. Multiple scenarios are separated by commas, such as aggregation (AGGREGATE). The default value is empty.', 'type' => 'string', 'title' => '', 'example' => '[AGGREGATE]'], + 'example' => '[AGGREGATE]', ], + 'Index' => ['title' => '', 'description' => 'The position of the operator in the operator list.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], 'example' => '123456', ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeOperators', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"AlertNum\\": 4,\\n \\"AssetNum\\": 4,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DataSources\\": [\\n \\"[sas,waf]\\"\\n ],\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"ThreatScore\\": 90.2,\\n \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n \\"Status\\": 0,\\n \\"AttCkLabels\\": [\\n \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n ],\\n \\"AttckStages\\": [\\n {\\n \\"TacticId\\": \\"TA0001\\",\\n \\"TacticName\\": \\"Persistence\\",\\n \\"AlertNum\\": 21\\n }\\n ],\\n \\"ReferAccount\\": \\"127608589417****\\",\\n \\"IncidentType\\": \\"graph\\",\\n \\"RuleId\\": \\"crecr-21d7pogu9v4a****\\",\\n \\"Remark\\": \\"dealed\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeCloudSiemEvents', - ], - 'DescribeCloudSiemEventDetail' => [ - 'summary' => 'Queries the details of an event.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeOperators'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeOperators', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Operator\\": \\"<=\\",\\n \\"OperatorName\\": \\"<=\\",\\n \\"OperatorDescCn\\": \\"arger than or equal to\\",\\n \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n \\"SupportDataType\\": \\"varchar\\",\\n \\"SupportTag\\": [\\n \\"[AGGREGATE]\\"\\n ],\\n \\"Index\\": 3\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeProdCount' => [ + 'summary' => 'Queries the number of Alibaba Cloud, Tencent Cloud, and Huawei Cloud products that can be integrated with Threat Analysis.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -9065,831 +6191,374 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], + 'abilityTreeCode' => '195547', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - ], - [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['title' => '', 'description' => 'The type of the view.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. This parameter allows an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region for the Management Center based on the region where your assets reside. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<SiemEvent>', - 'description' => 'PlainResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<DescribeProdCountResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'GmtCreate' => [ - 'title' => '事件发生时间。', - 'description' => 'The time when the event occurred.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '事件最后更新时间。', - 'description' => 'The time when the event was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => '事件归属主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account to which the event belongs.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'AlertNum' => [ - 'title' => '事件关联告警数。', - 'description' => 'The number of alerts that are associated with the event.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '4', - ], - 'AssetNum' => [ - 'title' => '事件关联资产数。', - 'description' => 'The number of assets that are associated with the event.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '4', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'IncidentName' => [ - 'title' => '事件名称。', - 'description' => 'The name of the event.'."\n", - 'type' => 'string', - 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', - ], - 'IncidentNameEn' => [ - 'title' => '事件英文名称。', - 'description' => 'The name of the event in English.'."\n", - 'type' => 'string', - 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', - ], - 'Description' => [ - 'title' => '事件描述。', - 'description' => 'The description of the event.'."\n", - 'type' => 'string', - 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc', - ], - 'DescriptionEn' => [ - 'title' => '事件英文描述。', - 'description' => 'The description of the event in English.'."\n", - 'type' => 'string', - 'example' => 'The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc', - ], - 'DataSources' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The source of the alert.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The source.'."\n", - 'type' => 'string', - 'example' => '[sas,waf]', - ], - 'example' => '[sas,waf]', - ], - 'ThreatLevel' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'ThreatScore' => [ - 'title' => '事件的威胁分值, 范围 0~100, 分值越高风险等级越高。', - 'description' => 'The risk score of the event. The score ranges from 0 to 100. A higher score indicates a higher risk level.'."\n", - 'type' => 'number', - 'format' => 'float', - 'example' => '90.2', - ], - 'ExtContent' => [ - 'title' => '事件扩展信息 json格式。', - 'description' => 'The extended information of the event in the JSON format.'."\n", - 'type' => 'string', - 'example' => '{"event_transfer_type":"customize_rule"}', - ], - 'Status' => [ - 'title' => '事件状态。 取值：'."\n" - .'- 0:未处理 '."\n" - .'-1:处理中 '."\n" - .'-5：处理失败 '."\n" - .'-10:已处理', - 'description' => 'The status of the event. Valid values:'."\n" - ."\n" - .'* 0: not handled'."\n" - .'* 1: handing'."\n" - .'* 5: handling failed'."\n" - .'* 10: handled'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'AttCkLabels' => [ - 'title' => 'ATTCT&攻击技术标签集合。', - 'description' => 'The tags of the ATT\\&CK attacks.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The tag.'."\n", - 'type' => 'string', - 'example' => '["T1595.002 Vulnerability Scanning"]', - ], - 'example' => '["T1595.002 Vulnerability Scanning"]', - ], - 'AttckStages' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'TacticId' => [ - 'type' => 'string', - ], - 'TacticName' => [ - 'type' => 'string', - ], - 'AlertNum' => [ - 'type' => 'integer', - 'format' => 'int32', - ], - ], - ], - ], - 'ReferAccount' => [ - 'description' => 'Users associated with the event.', - 'type' => 'string', - 'example' => '17661858****/****,176618448****/****', - ], - 'IncidentType' => [ - 'type' => 'string', - ], - 'RuleId' => [ - 'type' => 'string', - ], - 'Remark' => [ - 'title' => '事件备注。', - 'description' => 'The remarks of the event.'."\n", - 'type' => 'string', - 'example' => 'dealed', - ], + 'AliyunProdCount' => ['title' => '', 'description' => 'The number of Alibaba Cloud products.', 'type' => 'integer', 'format' => 'int32', 'example' => '19'], + 'HcloudProdCount' => ['title' => '', 'description' => 'The number of Huawei Cloud products.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'], + 'QcloudProdCount' => ['title' => '', 'description' => 'The number of Tencent Cloud products.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'], + 'IdcProdCount' => ['title' => '', 'description' => 'The number of IDC products.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'], + 'AliyunImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected Alibaba Cloud products.', 'title' => '', 'example' => '2'], + 'HcloudImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected Huawei Cloud products.', 'title' => '', 'example' => '2'], + 'QcloudImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected Tencent Cloud products.', 'title' => '', 'example' => '2'], + 'IdcImportedCount' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The number of automatically connected IDC products.', 'title' => '', 'example' => '2'], ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeProdCount', + 'changeSet' => [ + ['createdAt' => '2024-08-13T11:50:56.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-07-18T01:29:00.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"AlertNum\\": 4,\\n \\"AssetNum\\": 4,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"IncidentNameEn\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"Description\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DescriptionEn\\": \\"The threat event contains 13 Miner Network,1 Execute suspicious encoded commands on Linux, etc\\",\\n \\"DataSources\\": [\\n \\"[sas,waf]\\"\\n ],\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"ThreatScore\\": 90.2,\\n \\"ExtContent\\": \\"{\\\\\\"event_transfer_type\\\\\\":\\\\\\"customize_rule\\\\\\"}\\",\\n \\"Status\\": 0,\\n \\"AttCkLabels\\": [\\n \\"[\\\\\\"T1595.002 Vulnerability Scanning\\\\\\"]\\"\\n ],\\n \\"AttckStages\\": [\\n {\\n \\"TacticId\\": \\"TA0008\\",\\n \\"TacticName\\": \\"Persistence\\",\\n \\"AlertNum\\": 21\\n }\\n ],\\n \\"ReferAccount\\": \\"17661858****/****,176618448****/****\\",\\n \\"IncidentType\\": \\"graph\\",\\n \\"RuleId\\": \\"net-attack/101\\",\\n \\"Remark\\": \\"dealed\\"\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeCloudSiemEventDetail', - ], - 'DescribeCloudSiemAssetsCounter' => [ - 'summary' => 'Queries the number of assets that are associated with an event by asset type.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeProdCount'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeProdCount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"AliyunProdCount\\": 19,\\n \\"HcloudProdCount\\": 2,\\n \\"QcloudProdCount\\": 2,\\n \\"IdcProdCount\\": 2,\\n \\"AliyunImportedCount\\": 2,\\n \\"HcloudImportedCount\\": 2,\\n \\"QcloudImportedCount\\": 2,\\n \\"IdcImportedCount\\": 2\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'DescribeScopeUsers' => [ + 'summary' => 'Retrieves the list of users in the playbook scope.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - ], - [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the view of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select the region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<CloudSiemEventAssetCounter>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => 'BaseResponse<List<SoarScope>>', + 'description' => 'BaseResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'AssetType' => [ - 'title' => '资产类型。取值：'."\n" - .'- ip:ip'."\n" - .'- domain：域名'."\n" - .'- url：url'."\n" - .'- process：进程'."\n" - .'- file：文件'."\n" - .'- host：主机', - 'description' => 'The type of the asset. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* domain'."\n" - .'* url'."\n" - .'* process'."\n" - .'* file'."\n" - .'* host'."\n", - 'type' => 'string', - 'example' => 'domain', - ], - 'AssetNum' => [ - 'title' => '资产数量。', - 'description' => 'The number of assets.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', + 'AliUid' => ['title' => '', 'description' => 'The user ID in Security Information and Event Management (SIEM).', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789****'], + 'UserName' => ['title' => '', 'description' => 'The username.', 'type' => 'string', 'example' => 'test001'], + 'UserId' => ['title' => '多云用户ID。', 'description' => 'The multicloud user ID.', 'type' => 'string', 'example' => '123456789****'], + 'CloudCode' => ['title' => '云code。 取值：'."\n" + .'- qcloud：腾讯云'."\n" + .'- hcloud：华为云', 'description' => 'The cloud code. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud'."\n" + ."\n" + .'- hcloud: Huawei Cloud', 'type' => 'string', 'example' => 'qcloud'], + 'InstanceId' => ['title' => '', 'description' => 'The ID of the Web Application Firewall (WAF) instance.', 'type' => 'string', 'example' => 'waf-cn-tl123ast****'], + 'Domains' => [ + 'title' => '', + 'description' => 'The list of domain names protected by the WAF instance.', + 'type' => 'array', + 'items' => ['description' => 'The list of domain names protected by the WAF instance.', 'type' => 'string', 'title' => '', 'example' => '[123***.com, 456***.com]'], + 'example' => '[123.com, 456.com]', ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeScopeUsers', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AssetType\\": \\"domain\\",\\n \\"AssetNum\\": 1\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeCloudSiemAssetsCounter', - ], - 'DescribeCloudSiemAssets' => [ - 'summary' => 'Queries the assets that are associated with an event.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeScopeUsers'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeScopeUsers', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AliUid\\": 0,\\n \\"UserName\\": \\"test001\\",\\n \\"UserId\\": \\"123456789****\\",\\n \\"CloudCode\\": \\"qcloud\\",\\n \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n \\"Domains\\": [\\n \\"[123***.com, 456***.com]\\"\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeServiceStatus' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - ], + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - ], - [ - 'name' => 'AssetType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '资产类型。取值：'."\n" - .'- ip：ip'."\n" - .'- domain：域名'."\n" - .'- url：url'."\n" - .'- process:进程'."\n" - .'- file:文件'."\n" - .'- host:主机', - 'description' => 'The type of the asset. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* domain'."\n" - .'* url'."\n" - .'* process'."\n" - .'* file'."\n" - .'* host'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ip', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management hub. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: For assets in the Chinese mainland and China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: For assets in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], - [ - 'name' => 'AssetName', - 'in' => 'formData', + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '资产名称。', - 'type' => 'string', - 'example' => 'test123', + 'title' => 'CloudSiemSuccessResponse<Boolean>', + 'description' => 'CloudSiemSuccessResponse', + 'type' => 'object', + 'properties' => [ + 'Data' => ['title' => '', 'description' => 'The return value.'."\n" + ."\n" + .'- true: The authorization is granted.'."\n" + ."\n" + .'- false: The authorization is not granted.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'example' => '', ], ], - [ - 'name' => 'AssetUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '资产uuid。', - 'type' => 'string', - 'example' => '123456-2222-3333-5555-3435345****', - ], + ], + 'errorCodes' => [ + 500 => [ + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], - [ - 'name' => 'CurrentPage', - 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeServiceStatus', + 'summary' => 'Checks whether a resource directory is authorized for threat analysis.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeServiceStatus'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeServiceStatus', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'DescribeStorage' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], + 'security' => [ [ - 'name' => 'PageSize', - 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'abilityTreeCode' => '190429', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], + ], + 'parameters' => [ [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member whose view you want to use. This parameter is available only for administrators.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '137820528780****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region for the center based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or the China (Hong Kong) region.'."\n" + ."\n" + .'- ap-southeast-1: Select this value if your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<AssetInfo>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'CloudSiemResponse<Boolean>', + 'description' => 'CloudSiemResponse', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Id' => [ - 'title' => '资产ID。', - 'description' => 'The ID of the asset.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123', - ], - 'GmtCreate' => [ - 'title' => '资产同步时间。', - 'description' => 'The time when the asset was synchronized.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '资产最后更新时间。', - 'description' => 'The time when the asset was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => 'siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1276085894174392', - ], - 'SubUserId' => [ - 'title' => '资产关联账号ID。', - 'description' => 'The ID of the associated account to which the asset belongs.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '176555323***', - ], - 'IncidentUuid' => [ - 'title' => '事件ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '事件关联告警ID。', - 'description' => 'The UUID of the alert associated with the event.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'AssetName' => [ - 'title' => '资产名称。', - 'description' => 'The name of the asset.'."\n", - 'type' => 'string', - 'example' => 'zsw-agentless-centos****', - ], - 'AssetType' => [ - 'title' => '资产类型。取值：'."\n" - .'- ip:ip'."\n" - .'- domain：域名'."\n" - .'- url：url'."\n" - .'- process：进程'."\n" - .'- file：文件'."\n" - .'- host：主机', - 'description' => 'The type of the asset. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* domain'."\n" - .'* url'."\n" - .'* process'."\n" - .'* file'."\n" - .'* host'."\n", - 'type' => 'string', - 'example' => 'domain', - ], - 'AssetInfo' => [ - 'title' => '资产展示信息 json数组格式。', - 'description' => 'The display information of the asset is in the JSON format.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Key' => [ - 'title' => '告警详细属性key。', - 'description' => 'The attribute key.'."\n", - 'type' => 'string', - 'example' => 'suspicious.wbd.wb.trojanpath', - ], - 'KeyName' => [ - 'title' => '告警详细数据名称。', - 'description' => 'The name of the key.'."\n", - 'type' => 'string', - 'example' => 'Trojan Path', - ], - 'Values' => [ - 'title' => '告警详细数据值。', - 'description' => 'The value of the key.'."\n", - 'type' => 'string', - 'example' => '/root/test33.php', - ], - ], - ], - 'example' => '[{"KeyName": "${aliyun.siem.asset.asset_name}","Values": "zsw-agentless-ubuntu20","Key": "asset_name"}]', - ], - 'AssetId' => [ - 'title' => '资产逻辑ID。', - 'description' => 'The logical ID of the asset.'."\n", - 'type' => 'string', - 'example' => '0616caeb-acb8-45e0-8520-4ee5fbe251f0', - ], - 'CloudCode' => [ - 'title' => '实体来源云code。 取值：'."\n" - .'- aliyun：阿里云'."\n" - .'- qcloud：腾讯云'."\n" - .'- hcloud：华为云', - 'description' => 'The cloud code of the entity. Valid values:'."\n" - ."\n" - .'* aliyun: Alibaba Cloud'."\n" - .'* qcloud: Tencent Cloud'."\n" - .'* hcloud: Huawei Cloud'."\n", - 'type' => 'string', - 'example' => 'aliyun', - ], - ], - ], - ], - ], - 'example' => '123456', - ], + 'Data' => ['title' => '', 'description' => 'Indicates whether the project and Logstore created by the threat analysis service exist in your Simple Log Service. Valid values:'."\n" + ."\n" + .'- true: The project and Logstore exist.'."\n" + ."\n" + .'- false: The project and Logstore do not exist.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => 'CCEEE128-6607-503E-AAA6-C5E57D94****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ['errorCode' => 'SLS.Operation.Error', 'errorMessage' => 'SLS service is unavailable!', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'DescribeStorage', + 'summary' => 'Checks the status of the storage for the threat analysis feature. The storage is a Logstore in Simple Log Service.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 1276085894174392,\\n \\"SubUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"AssetName\\": \\"zsw-agentless-centos****\\",\\n \\"AssetType\\": \\"domain\\",\\n \\"AssetInfo\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"AssetId\\": \\"0616caeb-acb8-45e0-8520-4ee5fbe251f0\\",\\n \\"CloudCode\\": \\"aliyun\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeCloudSiemAssets', - ], - 'DescribeAlertsWithEvent' => [ - 'summary' => 'Queries the alerts that are associated with an event.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeStorage'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeStorage', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"CCEEE128-6607-503E-AAA6-C5E57D94****\\"\\n}","type":"json"}]', + ], + 'DescribeUserBuyStatus' => [ + 'summary' => 'Checks whether the current Alibaba Cloud account or its associated enterprise organization has purchased threat analysis.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -9901,2492 +6570,1910 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], + 'abilityTreeCode' => '157646', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'IncidentUuid', + 'name' => 'SubUserId', 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The ID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123XXXXXX'], ], [ - 'name' => 'Level', + 'name' => 'RegionId', 'in' => 'formData', - 'style' => 'repeatList', + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region for the management center based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '威胁等级，格式为json数组。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk levels. The value is a JSON array. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The risk level. The value is a JSON string. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["remind","serious"]'."\n", + 'title' => 'CloudSiemSuccessResponse<UserBuyOrderStatusResult>', + 'description' => 'CloudSiemSuccessResponse', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'description' => 'The response parameters.', + 'type' => 'object', + 'properties' => [ + 'MasterUserId' => ['title' => '', 'description' => 'The ID of the master account of the resource directory.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXX'], + 'MasterUserName' => ['title' => '', 'description' => 'The display name of the master account of the resource directory.', 'type' => 'string', 'example' => 'rd_master_xxx'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that purchased threat analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXX'], + 'MainUserName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account that purchased threat analysis.', 'type' => 'string', 'example' => 'sas_account_xxx'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the currently logged-on Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXX'], + 'SubUserName' => ['title' => '', 'description' => 'The name of the currently logged-on Alibaba Cloud account.', 'type' => 'string', 'example' => 'sas_account_xxx'], + 'Capacity' => ['title' => '', 'description' => 'The purchased capacity of Simple Log Service (SLS) for threat analysis. Unit: GB.', 'type' => 'integer', 'format' => 'int32', 'example' => '1024'], + 'SasInstanceId' => ['title' => '', 'description' => 'The ID of the Security Center instance.', 'type' => 'string', 'example' => 'sas-instance-xxxxx'], + 'CanBuy' => ['title' => '', 'description' => 'Indicates whether the current account can perform operations on threat analysis orders. Valid values:'."\n" + ."\n" + .'- true: The account can purchase, upgrade, or downgrade threat analysis.'."\n" + ."\n" + .'- false: The account cannot perform operations on threat analysis orders.', 'type' => 'boolean', 'example' => 'true'], + 'EndTime' => ['title' => '', 'description' => 'The expiration time of threat analysis. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'example' => '1669823999000'], + 'DurationDays' => ['title' => '', 'description' => 'The number of days before threat analysis expires.', 'type' => 'integer', 'format' => 'int64', 'example' => '3'], + 'RdOrder' => ['type' => 'integer', 'format' => 'int32', 'title' => '', 'description' => 'The type of the current order.'."\n" + ."\n" + .'- 0: The order includes threat analysis traffic and capacity.'."\n" + ."\n" + .'- 1: The order includes only threat analysis capacity.', 'example' => '1'], + ], + 'title' => '', + 'example' => '', + ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '81D8EC0C-0804-51AD-8C38-17ED0BC74892'], ], - 'required' => false, - 'example' => '["serious","suspicious","remind"]', - 'maxItems' => 100, + 'example' => '', ], ], - [ - 'name' => 'AlertTitle', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警标题。', - 'description' => 'The title of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'Scan-Try SNMP weak password'."\n", - ], + ], + 'errorCodes' => [ + 500 => [ + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"MasterUserId\\": 0,\\n \\"MasterUserName\\": \\"rd_master_xxx\\",\\n \\"MainUserId\\": 0,\\n \\"MainUserName\\": \\"sas_account_xxx\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxx\\",\\n \\"Capacity\\": 1024,\\n \\"SasInstanceId\\": \\"sas-instance-xxxxx\\",\\n \\"CanBuy\\": true,\\n \\"EndTime\\": 1669823999000,\\n \\"DurationDays\\": 3,\\n \\"RdOrder\\": 1\\n },\\n \\"RequestId\\": \\"81D8EC0C-0804-51AD-8C38-17ED0BC74892\\"\\n}","type":"json"}]', + 'title' => 'DescribeUserBuyStatus', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:47:27.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeUserBuyStatus'], ], + ], + 'ramActions' => [ [ - 'name' => 'AlertType', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警类型。', - 'type' => 'string', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeUserBuyStatus', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + ], + 'DescribeWafScope' => [ + 'summary' => 'Retrieves the list of domain names protected by Web Application Firewall (WAF) instances.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'AlertName', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警名称。', - 'type' => 'string', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'AssetName', + 'name' => 'EntityId', 'in' => 'formData', - 'schema' => [ - 'title' => '资产名称。', - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The entity ID.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '20617784'], ], [ - 'name' => 'AssetId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '资产id。', - 'type' => 'string', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'EntityName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '实体名称。', - 'type' => 'string', - ], + 'schema' => ['description' => 'The ID of a member. An administrator can use this parameter to assume the permissions of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'EntityId', + 'name' => 'RegionId', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '实体id。', - 'type' => 'string', + 'title' => 'BaseResponse<List<WafScope>>', + 'description' => 'BaseResponse\\<List>', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'InstanceId' => ['title' => '', 'description' => 'The ID of the WAF instance.', 'type' => 'string', 'example' => 'waf-cn-tl123ast****'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'Domains' => [ + 'title' => '', + 'description' => 'The list of domain names that are protected by the WAF instance.', + 'type' => 'array', + 'items' => ['description' => 'The domain names that are protected by the WAF instance.', 'type' => 'string', 'title' => '', 'example' => '[123***.com, 456***.com]'], + 'example' => '[123.com, 456.com]', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '123456', + ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 500 => [ + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeWafScope', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWafScope'], + ], + ], + 'ramActions' => [ [ - 'name' => 'SubUserId', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警关联账号ID。', - 'description' => 'The ID of the account within which the alert is generated.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '176555323***', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeWafScope', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n \\"Aliuid\\": 0,\\n \\"Domains\\": [\\n \\"[123***.com, 456***.com]\\"\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'DescribeWhiteRuleList' => [ + 'summary' => 'Queries the rules in the alert whitelist.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'Source', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警数据源。', - 'description' => 'The data source of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'sas', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'IsDefend', + 'name' => 'AlertType', 'in' => 'formData', - 'schema' => [ - 'title' => '是否已防御', - 'description' => 'Specifies whether an attack is defended. Valid values:'."\n" - ."\n" - .'* 0: detected'."\n" - .'* 1: blocked'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'scan'], ], [ - 'name' => 'StartTime', + 'name' => 'AlertName', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The alert name.', 'type' => 'string', 'required' => false, 'example' => 'Try SNMP weak password'], ], [ - 'name' => 'EndTime', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The universally unique identifier (UUID) of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view.'."\n" - ."\n" - .'* 0: view of the current Alibaba Cloud account.'."\n" - .'* 1: view of all accounts for the enterprise.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that are managed by the administrator account.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the member in the resource directory.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member. This parameter is used in a multi-account management scenario. An administrator can specify this parameter to query the data of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. You must select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are deployed in the Chinese mainland or in the China (Hong Kong) region.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are deployed in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<AlertDetail>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'PageResponse<List<WhitelistRule>>', + 'description' => 'PageResponse\\<List>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The return value.', 'type' => 'object', 'properties' => [ 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", + 'title' => '', + 'description' => 'The pagination information.', 'type' => 'object', 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], + 'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], + 'example' => '', ], 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", + 'title' => '', + 'description' => 'The detailed data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '告警唯一ID。', - 'description' => 'The unique ID of the alert.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '告警入库时间。', - 'description' => 'The time when the alert was received.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '告警最后更新时间。', - 'description' => 'The time when the alert was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'MainUserId' => [ - 'title' => '告警关联siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '告警id。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'LogTime' => [ - 'title' => '告警记录时间。', - 'description' => 'The time when the alert was recorded.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'AlertSrcProd' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The source of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'AlertTitle' => [ - 'title' => '告警标题。', - 'description' => 'The title of the alert.'."\n", - 'type' => 'string', - 'example' => 'Scan-Try SNMP weak password', - ], - 'AlertTitleEn' => [ - 'title' => '告警标题英文。', - 'description' => 'The alert title in English.'."\n", - 'type' => 'string', - 'example' => 'Scan-Try SNMP weak password', - ], - 'AlertType' => [ - 'title' => '告警类型。', - 'description' => 'The type of the alert.'."\n", - 'type' => 'string', - 'example' => 'Scan', - ], - 'AlertTypeEn' => [ - 'title' => '告警类型英文。', - 'description' => 'The alert type in English.'."\n", - 'type' => 'string', - 'example' => 'Scan', - ], - 'AlertTypeCode' => [ - 'title' => '告警类型美杜莎code。', - 'description' => 'The internal code of the alert type.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshellName', - ], - 'AlertName' => [ - 'title' => '告警名称。', - 'description' => 'The name of the alert.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameEn' => [ - 'title' => '告警名称。', - 'description' => 'The alert name in English.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameCode' => [ - 'title' => '告警名称美杜莎code。', - 'description' => 'The internal code of the alert name.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshell', - ], - 'AlertLevel' => [ - 'title' => '威胁等级。 取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" - ."\n" - .'* serious: high.'."\n" - .'* suspicious: medium.'."\n" - .'* remind: low.'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'AssetList' => [ - 'title' => '资产列表。', - 'description' => 'The details of the asset.'."\n", - 'type' => 'string', - 'example' => '['."\n" - .' {'."\n" - .' "is_main_asset": "1",'."\n" - .' "asset_name": "47.245.*",'."\n" - .' "port": "22",'."\n" - .' "ip": "47.245.*",'."\n" - .' "asset_type": "ip",'."\n" - .' "location": "ap-southeast-1",'."\n" - .' "asset_id": "47.245.*",'."\n" - .' "net_connect_dir": "in"'."\n" - .' }'."\n" - .']', - ], - 'OccurTime' => [ - 'title' => '告警发生时间。', - 'description' => 'The time when the alert was triggered.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'StartTime' => [ - 'title' => '告警首次发生时间。', - 'description' => 'The time at which the alert was first generated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'EndTime' => [ - 'title' => '告警结束时间。', - 'description' => 'The time when the alert was closed.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'AlertSrcProdModule' => [ - 'title' => '事件关联告警来源产品子模块。', - 'description' => 'The sub-module of the alert source.'."\n", - 'type' => 'string', - 'example' => 'waf', - ], - 'AlertDesc' => [ - 'title' => '告警描述。', - 'description' => 'The description of the alert.'."\n", - 'type' => 'string', - 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', - ], - 'AlertDescEn' => [ - 'title' => '告警英文描述。', - 'description' => 'The alert description in English.'."\n", - 'type' => 'string', - 'example' => 'The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.', - ], - 'AlertDescCode' => [ - 'title' => '告警描述美杜莎code。', - 'description' => 'The internal code of the alert description.'."\n", - 'type' => 'string', - 'example' => 'security_event_config.event_name.webshell'."\n", - ], - 'AlertDetail' => [ - 'title' => '告警详情。', - 'description' => 'The details of the alert.'."\n", - 'type' => 'string', - 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "21.92.*.*"}', - ], - 'LogUuid' => [ - 'title' => '告警log UUID。', - 'description' => 'The UUID of the alert log.'."\n", - 'type' => 'string', - 'example' => 'cfw_d12e285a-a042-4d7e-be89-f8a795ef****', - ], - 'EntityList' => [ - 'title' => '实体详情（标准化/开启索引）', - 'description' => 'The details of the entity.'."\n", - 'type' => 'string', - 'example' => '[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]', - ], - 'AttCk' => [ - 'title' => 'ATTCT&攻击技术标签。', - 'description' => 'The tag of the ATT\\&CK technique.'."\n", - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'SubUserId' => [ - 'title' => '产生告警阿里账号ID。', - 'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '176555323***', - ], - 'SubUserName' => [ - 'title' => '产生告警阿里账号ID。', - 'type' => 'string', - 'example' => '176555323***', - ], - 'CloudCode' => [ - 'title' => '云code。 取值：'."\n" - .'- aliyun：阿里云'."\n" - .'- qcloud：腾讯云'."\n" - .'- hcloud：华为云', - 'description' => 'The code of the cloud service provider. Valid values:'."\n" - ."\n" - .'* aliyun: Alibaba Cloud.'."\n" - .'* qcloud: Tencent Cloud.'."\n" - .'* hcloud: Huawei Cloud.'."\n", - 'type' => 'string', - 'example' => 'aliyun', - ], - 'IsDefend' => [ - 'title' => '是否已防御', - 'description' => 'Indicates whether an attack is defended against. Valid values:'."\n" - ."\n" - .'* 0: detected.'."\n" - .'* 1: blocked.'."\n", - 'type' => 'string', - 'example' => '1', - ], - 'AlertInfoList' => [ - 'title' => '告警详细数据。', - 'description' => 'The displayed details of the alert.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Key' => [ - 'title' => '告警详细属性key。', - 'description' => 'The attribute key.'."\n", - 'type' => 'string', - 'example' => 'suspicious.wbd.wb.trojanpath', - ], - 'KeyName' => [ - 'title' => '告警详细数据名称。', - 'description' => 'The name of the key.'."\n", - 'type' => 'string', - 'example' => 'Trojan Path'."\n", - ], - 'Values' => [ - 'title' => '告警详细数据值。', - 'description' => 'The value of the key.'."\n", - 'type' => 'string', - 'example' => '/root/test33.php', + 'Id' => ['title' => '', 'description' => 'The unique ID of the whitelist rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the rule was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'SubAliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to create the rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***'], + 'AlertType' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'example' => 'scan'], + 'AlertTypeId' => ['title' => '', 'description' => 'The ID of the alert type.', 'type' => 'string', 'example' => 'scan'], + 'AlertName' => ['title' => '', 'description' => 'The alert name.', 'type' => 'string', 'example' => 'Try SNMP weak password'], + 'AlertNameId' => ['title' => '', 'description' => 'The ID of the alert name.', 'type' => 'string', 'example' => 'Try SNMP weak password'], + 'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- 1: enabled'."\n" + ."\n" + .'- 0: disabled', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'IncidentUuid' => ['title' => '', 'description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'AlertUuid' => ['title' => '', 'description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'], + 'Expression' => [ + 'title' => '', + 'description' => 'The rule conditions, which are in the JSON array format.', + 'type' => 'object', + 'properties' => [ + 'Logic' => ['description' => 'The logical relation for the conditions.', 'type' => 'string', 'title' => '', 'example' => '(1&2)|(3&4)'], + 'Conditions' => [ + 'description' => 'The array of rule conditions.', + 'type' => 'array', + 'items' => [ + 'description' => 'The array of rule conditions.', + 'type' => 'object', + 'properties' => [ + 'ItemId' => ['description' => 'The condition ID.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '1'], + 'Operator' => ['description' => 'The operator. Valid values:'."\n" + ."\n" + .'- `=`: equals'."\n" + ."\n" + .'- `<>`: does not equal'."\n" + ."\n" + .'- `in`: includes'."\n" + ."\n" + .'- `not in`: does not include'."\n" + ."\n" + .'- `REGEXP`: matches a regular expression'."\n" + ."\n" + .'- `NOT REGEXP`: does not match a regular expression', 'type' => 'string', 'title' => '', 'example' => 'REGEXP'], + 'IsNot' => ['description' => 'Indicates whether to negate the result. Valid values:'."\n" + ."\n" + .'- true: The result is negated.'."\n" + ."\n" + .'- false: The result is not negated.', 'type' => 'boolean', 'title' => '', 'example' => 'false'], + 'Left' => [ + 'description' => 'The left operand of the condition.', + 'type' => 'object', + 'properties' => [ + 'Value' => ['description' => 'The variable of the left operand.', 'type' => 'string', 'title' => '', 'example' => 'ip'], + 'IsVar' => ['description' => 'Indicates whether the left operand is a variable. Valid values:'."\n" + ."\n" + .'- true: variable'."\n" + ."\n" + .'- false: constant', 'type' => 'boolean', 'title' => '', 'example' => 'true'], + 'Type' => ['description' => 'Specifies whether the value is a constant. Valid values:'."\n" + ."\n" + .'- true: The value is a constant.'."\n" + ."\n" + .'- false: The value is not a constant.', 'type' => 'string', 'title' => '', 'example' => 'false'], + 'Modifier' => ['description' => 'The remarks.', 'type' => 'string', 'title' => '', 'example' => 'length'], + 'ModifierParam' => [ + 'description' => 'The key-value pair for the remarks.', + 'type' => 'object', + 'additionalProperties' => ['type' => 'any', 'description' => 'The key-value pair for the remarks.', 'title' => '', 'example' => '{"tage":"description"}'], + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', + ], + 'Right' => [ + 'description' => 'The right operand.', + 'type' => 'object', + 'properties' => [ + 'Value' => ['description' => 'The value of the right operand.', 'type' => 'string', 'title' => '', 'example' => '12345'], + 'IsVar' => ['description' => 'Specifies whether the right operand is a constant or a runtime variable. A runtime variable obtains a value from the runtime context. Valid values:'."\n" + ."\n" + .'- true: runtime variable'."\n" + ."\n" + .'- false: constant', 'type' => 'boolean', 'title' => '', 'example' => 'false'], + 'Type' => ['description' => 'The data type.', 'type' => 'string', 'title' => '', 'example' => 'String'], + 'Modifier' => ['description' => 'The remarks.', 'type' => 'string', 'title' => '', 'example' => 'length'], + 'ModifierParam' => [ + 'description' => 'The key-value pair for the remarks.', + 'type' => 'object', + 'additionalProperties' => ['type' => 'any', 'description' => 'The key-value pair for the remarks.', 'title' => '', 'example' => '{"tage":"description"}'], + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], ], - 'example' => 'aliyun', - ], - 'ExtendContent' => [ - 'type' => 'string', - ], - 'ProductId' => [ - 'type' => 'string', - ], - 'VendorId' => [ - 'type' => 'string', - ], - 'DetectionRuleId' => [ - 'type' => 'string', + 'example' => '[{"conditions":[{"isNot":false,"itemId":0,"left":{"value":"host_uuid.host_name"},"operator":"containsString","right":{"value":"Cloud-MCH"}}]}]', ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DescribeWhiteRuleList', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"MainUserId\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"LogTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertTitle\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertTitleEn\\": \\"Scan-Try SNMP weak password\\",\\n \\"AlertType\\": \\"Scan\\",\\n \\"AlertTypeEn\\": \\"Scan\\",\\n \\"AlertTypeCode\\": \\"security_event_config.event_name.webshellName\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameEn\\": \\"Try SNMP weak password\\",\\n \\"AlertNameCode\\": \\"security_event_config.event_name.webshell\\",\\n \\"AlertLevel\\": \\"remind\\",\\n \\"AssetList\\": \\"[\\\\n {\\\\n \\\\\\"is_main_asset\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"asset_name\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"port\\\\\\": \\\\\\"22\\\\\\",\\\\n \\\\\\"ip\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"asset_type\\\\\\": \\\\\\"ip\\\\\\",\\\\n \\\\\\"location\\\\\\": \\\\\\"ap-southeast-1\\\\\\",\\\\n \\\\\\"asset_id\\\\\\": \\\\\\"47.245.*\\\\\\",\\\\n \\\\\\"net_connect_dir\\\\\\": \\\\\\"in\\\\\\"\\\\n }\\\\n]\\",\\n \\"OccurTime\\": \\"2021-01-06 16:37:29\\",\\n \\"StartTime\\": \\"2021-01-06 16:37:29\\",\\n \\"EndTime\\": \\"2021-01-06 16:37:29\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AlertDesc\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescEn\\": \\"The detection model found a suspicious Webshell file on your server, which may be a backdoor file implanted to maintain permissions after the attacker successfully invaded the website.\\",\\n \\"AlertDescCode\\": \\"security_event_config.event_name.webshell\\\\n\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"21.92.*.*\\\\\\"}\\",\\n \\"LogUuid\\": \\"cfw_d12e285a-a042-4d7e-be89-f8a795ef****\\",\\n \\"EntityList\\": \\"[{"entity_user_id":"198921674491****","entity_account_id":"N/A","entity_uuid":"6245f979d5dd9ef8dd19bdc72228****","entity_type":"host","entity_name":"zhh-test-20240409","is_comprised":"1","os_type":"linux","entity_id":"a88f44dd-b8d4-4ded-831c-77a4835****","host_uuid":"a88f44dd-b8d4-4ded-831c-77a4835****","host_name":"zhh-test-2024****"}]\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"176555323***\\",\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"IsDefend\\": \\"1\\",\\n \\"AlertInfoList\\": [\\n {\\n \\"Key\\": \\"suspicious.wbd.wb.trojanpath\\",\\n \\"KeyName\\": \\"Trojan Path\\\\n\\",\\n \\"Values\\": \\"/root/test33.php\\"\\n }\\n ],\\n \\"ExtendContent\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99****\\\\\\"}\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"VendorId\\": \\"aliyun\\",\\n \\"DetectionRuleId\\": \\"dr-48zs4tk7qfd4rjd9****\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeAlertsWithEvent', - ], - 'DescribeAlertSourceWithEvent' => [ - 'summary' => 'Queries the data sources of the alert that is associated with an event.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWhiteRuleList'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeWhiteRuleList', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"SubAliuid\\": 0,\\n \\"AlertType\\": \\"scan\\",\\n \\"AlertTypeId\\": \\"scan\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameId\\": \\"Try SNMP weak password\\",\\n \\"Status\\": 1,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"Expression\\": {\\n \\"Logic\\": \\"(1&2)|(3&4)\\",\\n \\"Conditions\\": [\\n {\\n \\"ItemId\\": 1,\\n \\"Operator\\": \\"REGEXP\\",\\n \\"IsNot\\": false,\\n \\"Left\\": {\\n \\"Value\\": \\"ip\\",\\n \\"IsVar\\": true,\\n \\"Type\\": \\"false\\",\\n \\"Modifier\\": \\"length\\",\\n \\"ModifierParam\\": {\\n \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n }\\n },\\n \\"Right\\": {\\n \\"Value\\": \\"12345\\",\\n \\"IsVar\\": false,\\n \\"Type\\": \\"String\\",\\n \\"Modifier\\": \\"length\\",\\n \\"ModifierParam\\": {\\n \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n }\\n }\\n }\\n ]\\n }\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'EnableAccessForCloudSiem' => [ + 'summary' => 'Grants permissions to Threat Analysis and creates the AliyunServiceRoleForSasCloudSiem service-linked role.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '158612', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'IncidentUuid', + 'name' => 'AutoSubmit', 'in' => 'formData', - 'schema' => [ - 'title' => '事件全局唯一id。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['description' => 'Specifies whether to automatically add alert logs from Security Center, Web Application Firewall (WAF), and Cloud Firewall. By default, alert logs are automatically added.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all member accounts.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* Valid values: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select the region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<AlertSource>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<Boolean>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'SourceName' => [ - 'title' => '告警数据源名称。', - 'description' => 'The name of the alert data source.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'Source' => [ - 'title' => '告警数据源名称美杜莎code。', - 'description' => 'The internal code of the alert data source.'."\n", - 'type' => 'string', - 'example' => 'aliyun.siem.alert_datasource.sas', - ], - ], - ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'EnableAccessForCloudSiem', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:47:27.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SourceName\\": \\"sas\\",\\n \\"Source\\": \\"aliyun.siem.alert_datasource.sas\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAlertSourceWithEvent', - ], - 'DescribeAlertType' => [ - 'summary' => 'Queries the threat types that you can select when you create a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableAccessForCloudSiem'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:EnableAccessForCloudSiem', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'EnableServiceForCloudSiem' => [ + 'summary' => 'Enables resource directory authorization for threat analysis. This operation can be called only by a resource directory administrator.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'RuleType', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则类型。 取值：'."\n" - .'- predefine：预定义'."\n" - .'- customize：自定义', - 'description' => 'The type of rule. Valid values:'."\n" - .'- predefine: the defined rule by system'."\n" - .'- customize: the customed rule by user', - 'type' => 'string', - 'required' => false, - 'example' => 'customize', - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], - ], - [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<AlertType>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<Boolean>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'AlertType' => [ - 'title' => '威胁类型。', - 'description' => 'The type of the risk.'."\n", - 'type' => 'string', - 'example' => 'WEBSHELL', - ], - 'AlertTypeMds' => [ - 'title' => '威胁类型美杜莎code。', - 'description' => 'The internal code of the risk type.'."\n", - 'type' => 'string', - 'example' => 'siem_rule_type_process_abnormal_command', - ], - ], - ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Data' => ['title' => '', 'description' => 'The return value. Valid values:'."\n" + ."\n" + .'- true: The service is enabled.'."\n" + ."\n" + .'- false: The service failed to be enabled.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AlertType\\": \\"WEBSHELL\\",\\n \\"AlertTypeMds\\": \\"siem_rule_type_process_abnormal_command\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAlertType', - ], - 'DeleteCustomizeRule' => [ - 'summary' => 'Deletes a rule by rule ID.', - 'methods' => [ - 'get', - 'post', + 'title' => 'EnableServiceForCloudSiem', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableServiceForCloudSiem'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:EnableServiceForCloudSiem', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'GetCapacity' => [ + 'summary' => 'Retrieves the current billable storage usage and subscription purchase volume for threat analysis. Units are in GB.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '155452', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ - 'name' => 'RuleId', - 'in' => 'formData', - 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', - ], - ], - [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'View type.'."\n" + ."\n" + .'- 0: View for the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: View for all accounts under your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'User ID of the member whose view the administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the service is deployed.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-shanghai', - ], + 'schema' => ['description' => 'Region where the Data Management Center for threat analysis is located. Choose a region based on where your assets are located.'."\n" + ."\n" + .'- cn-hangzhou: Select this if your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Select this if your assets are outside China.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<Integer>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemResponse<CloudSiemCapacityResponse>', + 'description' => 'CloudSiemResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'title' => '', + 'description' => 'Storage capacity details.', + 'type' => 'object', + 'properties' => [ + 'UsedCapacity' => ['description' => 'Current billable storage usage for threat analysis, in GB.', 'type' => 'number', 'format' => 'double', 'title' => '', 'example' => '10'], + 'PreservedCapacity' => ['description' => 'Purchased storage capacity for threat analysis, in GB.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '9000'], + 'ExistLogStore' => ['description' => 'Indicates whether the LogStore for threat analysis exists.'."\n" + ."\n" + .'- true: Logs are normal and log analysis is available.'."\n" + ."\n" + .'- false: Logs are being cleaned up and log analysis is unavailable.', 'type' => 'boolean', 'title' => '', 'example' => 'true'], + 'AgentManagedAssetQuota' => ['description' => 'Purchased quota for Agent-managed instances.', 'type' => 'integer', 'format' => 'int64', 'example' => '1', 'title' => ''], + 'AgentManagedAssetUsed' => ['description' => 'Used quota for Agent-managed instances.', 'type' => 'integer', 'format' => 'int64', 'example' => '1', 'title' => ''], + ], + 'example' => '', ], + 'RequestId' => ['description' => 'ID of the request.', 'type' => 'string', 'example' => '27D27DCB-D76B-5064-8B3B-0900DEF7****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'CloudSiemCustomizeRuleDeleteExcepiton', - 'errorMessage' => 'can not delete online customize rule.', - ], - ], 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ['errorCode' => 'Siem.Storage.Exception', 'errorMessage' => 'The request timed out, try again.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"UsedCapacity\\": 10,\\n \\"PreservedCapacity\\": 9000,\\n \\"ExistLogStore\\": true,\\n \\"AgentManagedAssetQuota\\": 1,\\n \\"AgentManagedAssetUsed\\": 1\\n },\\n \\"RequestId\\": \\"27D27DCB-D76B-5064-8B3B-0900DEF7****\\"\\n}","type":"json"}]', + 'title' => 'GetCapacity', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": 123456,\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DeleteCustomizeRule', - ], - 'DescribeAggregateFunction' => [ - 'summary' => 'Queries the aggregate functions that are supported for a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetCapacity'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetCapacity', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'GetEntitiyStat' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ + 'name' => 'IncidentUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The incident ID.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + ], + [ + 'name' => 'EntityType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false], + ], + [ + 'name' => 'AssetName', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false], + ], + [ + 'name' => 'AssetUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false], + ], + [ + 'name' => 'EntityName', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false], + ], + [ + 'name' => 'EntityUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false], + ], + [ + 'name' => 'IsAsset', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The asset ID associated with the incident.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****'], + ], + [ + 'name' => 'IsMalwareEntity', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The sort order of the incident list. Valid values:'."\n" + ."\n" + .'- desc: descending order.'."\n" + .'- asc: ascending order.', 'type' => 'string', 'required' => false, 'example' => 'desc'], + ], + [ + 'name' => 'Tags', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The entity tags. The value is a JSON array string in the following format: \\"[{\\"tagKey1\\":\\"tagValue1\\"},{\\"tagKey2\\":\\"tagValue2\\"}]\\"', 'type' => 'string', 'required' => false, 'example' => 'sys:agent:dispose'], + ], + [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: single-account logon.'."\n" + .'- 1: global view.'."\n" + .'- 2: switched view.'."\n" + .'- 3: partial view.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1637941677243702', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the threat detection and response data management center resides. Select the management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: the asset belongs to the Chinese mainland or Hong Kong (China).'."\n" + .'- ap-southeast-1: the asset belongs to a region outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<RuleAggregateFunction>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => '', + 'description' => 'BaseResponse<List<EntitiyStat>>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The response data.', 'type' => 'array', 'items' => [ + 'description' => 'The capacity details.', 'type' => 'object', 'properties' => [ - 'Function' => [ - 'title' => '聚合函数。', - 'description' => 'The aggregate function.'."\n", - 'type' => 'string', - 'example' => 'count', - ], - 'FunctionName' => [ - 'title' => '聚合函数显示名称。', - 'description' => 'The display name of the aggregate function.'."\n", - 'type' => 'string', - 'example' => 'Count', - ], + 'EntityType' => ['title' => '', 'description' => 'The entity type.', 'type' => 'string', 'example' => 'ip'], + 'EntityNum' => ['description' => 'The number of entities.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''], + 'EntityUuid' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '5cde2118666ffda40783ebd7cec9a60a'], ], + 'title' => '', + 'example' => '', ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: successful.'."\n" + .'- false: failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The response message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Query entity counts', + 'summary' => 'Queries entity counts.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class with configuration examples is provided. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Function\\": \\"count\\",\\n \\"FunctionName\\": \\"Count\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAggregateFunction', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"EntityType\\": \\"ip\\",\\n \\"EntityNum\\": 3,\\n \\"EntityUuid\\": \\"5cde2118666ffda40783ebd7cec9a60a\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', ], - 'DescribeCustomizeRuleCount' => [ - 'summary' => 'Queries the number of custom rules.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - 'http', - ], + 'GetStorage' => [ + 'summary' => 'Retrieves the storage settings created by the Threat Analysis and Response product in your Simple Log Service (SLS). These settings include the storage duration and storage region.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', + 'abilityTreeCode' => '179222', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used by an administrator to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '127XXXX'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management hub for threat analysis is located. Select a region for the management hub based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or the China (Hong Kong) region.'."\n" + ."\n" + .'- ap-southeast-1: Select this value if your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<CustomizeRuleCounter>', - 'description' => 'PlainResponse'."\n", + 'title' => 'CloudSiemResponse<CloudSiemStorageResponse>', + 'description' => 'CloudSiemResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The details of the storage settings.', 'type' => 'object', 'properties' => [ - 'InUseRuleNum' => [ - 'title' => '全部规则数。', - 'description' => 'The total number of rules.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '20', - ], - 'HighRuleNum' => [ - 'title' => '高危规则数。', - 'description' => 'The number of rules that are used to identify high-risk threats.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '12', - ], - 'MediumRuleNum' => [ - 'title' => '中危规则数。', - 'description' => 'The number of rules that are used to identify medium-risk threats.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '5', - ], - 'LowRuleNum' => [ - 'title' => '低危规则数。', - 'description' => 'The number of rules that are used to identify low-risk threats.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'TotalRuleNum' => [ - 'title' => '总规则数', - 'description' => '总规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'CustomizeRuleNum' => [ - 'title' => '自定义规则数', - 'description' => '自定义规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'PredefinedRuleNum' => [ - 'title' => '预定义规则数', - 'description' => '预定义规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'UnEventRuleNum' => [ - 'title' => '不产生事件规则数', - 'description' => '不产生事件规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'ExpertRuleNum' => [ - 'title' => '专家规则数', - 'description' => '专家规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '7', - ], - 'GraphComputingRuleNum' => [ - 'title' => '图计算规则数', - 'description' => '图计算规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'SingleAlertRuleNum' => [ - 'title' => '告警透传规则数', - 'description' => '告警透传规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'AggregationRuleNum' => [ - 'title' => '同类聚合规则数', - 'description' => '同类聚合规则数。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], + 'Ttl' => ['title' => '', 'description' => 'The storage duration in days. The default value is 180. The value must be an integer from 30 to 3000.', 'type' => 'integer', 'format' => 'int32', 'example' => '180'], + 'Region' => ['title' => '', 'description' => 'The storage region.'."\n" + ."\n" + .'If the Data Management hub is in the **cn-hangzhou** region, the default value of **Region** is \\`cn-shanghai\\`. If the Data Management hub is in the **ap-southeast-1** region, the default value of **Region** is \\`ap-southeast-1\\`.', 'type' => 'string', 'example' => 'cn-shanghai'], + 'DisplayRegion' => ['title' => '', 'description' => 'Indicates whether you have permission to change the storage region. The default value is false. Valid values:'."\n" + ."\n" + .'- true: You have permission.'."\n" + ."\n" + .'- false: You do not have permission.', 'type' => 'boolean', 'example' => 'false'], + 'CanOperate' => ['title' => '', 'description' => 'Indicates whether you can change the storage region. You can change the storage region only once. The default value is false. Valid values:'."\n" + ."\n" + .'- true: You can change the storage region.'."\n" + ."\n" + .'- false: You cannot change the storage region.', 'type' => 'boolean', 'example' => 'false'], ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '97A31C3A-3F9F-5866-8979-5159E3DC****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'GetStorage', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"InUseRuleNum\\": 20,\\n \\"HighRuleNum\\": 12,\\n \\"MediumRuleNum\\": 5,\\n \\"LowRuleNum\\": 3,\\n \\"TotalRuleNum\\": 10,\\n \\"CustomizeRuleNum\\": 10,\\n \\"PredefinedRuleNum\\": 10,\\n \\"UnEventRuleNum\\": 3,\\n \\"ExpertRuleNum\\": 7,\\n \\"GraphComputingRuleNum\\": 2,\\n \\"SingleAlertRuleNum\\": 3,\\n \\"AggregationRuleNum\\": 3\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeCustomizeRuleCount', - ], - 'DescribeCustomizeRuleTest' => [ - 'summary' => 'Queries the historical simulation data that is used in a simulation test scenario.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetStorage'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetStorage', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Ttl\\": 180,\\n \\"Region\\": \\"cn-shanghai\\",\\n \\"DisplayRegion\\": false,\\n \\"CanOperate\\": false\\n },\\n \\"RequestId\\": \\"97A31C3A-3F9F-5866-8979-5159E3DC****\\"\\n}","type":"json"}]', + ], + 'ListAccountAccessId' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '195478', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'Id', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', + 'title' => '', + 'description' => 'The code for the multicloud environment.', + 'type' => 'string', + 'required' => true, + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], [ - 'name' => 'RoleType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select the region of the Management Center based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['type' => 'integer', 'format' => 'int64', 'required' => false, 'description' => 'The user ID of a member. This parameter allows an administrator to switch to the member\'s view.', 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'RegionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['type' => 'integer', 'format' => 'int32', 'required' => false, 'description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<CustomizeRuleTest>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListAccountAccessIdResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'Id' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'Status' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：初始状态'."\n" - .'- 10：模拟数据测试'."\n" - .'- 15：业务数据测试中'."\n" - .'- 20：业务数据测试结束'."\n" - .'- 100：规则上线', - 'description' => 'The status of the rule. Valid values:'."\n" + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that corresponds to the multicloud AccessKey ID.', 'type' => 'integer', 'format' => 'int64', 'example' => 'ABCXXXXXXXX'], + 'AccessIdMd5' => ['title' => '', 'description' => 'The MD5 value of the multicloud AccessKey ID.', 'type' => 'string', 'example' => 'abcXXXXXXXX'], + 'AccountStr' => ['title' => '', 'description' => 'The information of the account to which the multicloud AccessKey ID belongs. The format is: Alibaba Cloud account ID|Alibaba Cloud account name|Multicloud AccessKey ID.', 'type' => 'string', 'example' => '123xxxxxx|xxxx|ABCXXXXX'], + 'Bound' => ['title' => '', 'description' => 'Indicates whether the AccessKey ID is attached to threat analysis. Valid values:'."\n" ."\n" - .'* 0: The rule is in the initial state.'."\n" - .'* 10: The simulation data is tested.'."\n" - .'* 15: The business data is being tested.'."\n" - .'* 20: The business data test ends.'."\n" - .'* 100: The rule takes effect.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'SimulateData' => [ - 'title' => '模拟测试历史用例数据。', - 'description' => 'The historical data that is used in the simulation test.'."\n", - 'type' => 'string', - 'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]', + .'- 0: Not attached.'."\n" + ."\n" + .'- 1: Attached.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'AccessId' => ['title' => '', 'description' => 'The attached AccessKey ID.', 'type' => 'string', 'example' => 'ABCXXXXXXXX'], + 'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code for the multicloud environment.', + 'type' => 'string', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', + ], ], + 'title' => '', + 'example' => '', ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'ListAccountAccessId', + 'summary' => 'Lists the AccessKey IDs for attached multicloud accounts.', + 'changeSet' => [ + ['createdAt' => '2024-07-18T01:29:00.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Id\\": 123456789,\\n \\"Status\\": 0,\\n \\"SimulateData\\": \\"[{\\\\\\"key1\\\\\\":\\\\\\"value1\\\\\\",\\\\\\"key2\\\\\\":\\\\\\"value2\\\\\\",\\\\\\"key3\\\\\\":\\\\\\"value3\\\\\\",\\\\\\"key4\\\\\\":\\\\\\"value4\\\\\\",\\\\\\"key5\\\\\\":\\\\\\"value5\\\\\\"}]\\"\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeCustomizeRuleTest', - ], - 'DescribeCustomizeRuleTestHistogram' => [ - 'summary' => 'Queries the chart that displays the test results of business data for a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountAccessId'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListAccountAccessId', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SubUserId\\": 0,\\n \\"AccessIdMd5\\": \\"abcXXXXXXXX\\",\\n \\"AccountStr\\": \\"123xxxxxx|xxxx|ABCXXXXX\\",\\n \\"Bound\\": 1,\\n \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListAccountsByLog' => [ + 'summary' => 'Queries the accounts associated with a log.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '196080', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'Id', + 'name' => 'ProdCode', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => true, 'example' => 'qcloud_waf'], + ], + [ + 'name' => 'LogCodes', + 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', + 'title' => '', + 'description' => 'The list of log codes. The value must be a JSON array.', + 'type' => 'array', + 'items' => ['description' => 'The list of log codes. The value must be a JSON array.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["cloud_siem_hcloud_waf_alert_log"]'], + 'required' => true, + 'example' => '["cloud_siem_hcloud_waf_alert_log"]', + 'maxItems' => 100, ], ], [ - 'name' => 'RoleType', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', + 'title' => '', + 'description' => 'The code of the multicloud environment.', + 'type' => 'string', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun', 'idc'], + 'example' => 'hcloud', ], ], [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], + ], + [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter allows an administrator to switch to the perspective of a member account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<CustomizeRuleAlertHistogram>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListAccountsByLogResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The return value for the request.'."\n", + 'title' => '', + 'description' => 'The return value of the request.', 'type' => 'array', 'items' => [ + 'description' => 'The return value of the request.', 'type' => 'object', 'properties' => [ - 'From' => [ - 'title' => '告警时间区间的开始时间戳 单位：秒。', - 'description' => 'The start of the time range for querying alerts. The value is a UNIX timestamp. Unit: seconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1599897188', - ], - 'To' => [ - 'title' => '告警时间区间的结束时间戳 单位：秒。', - 'description' => 'The end of the time range for querying alerts. The value is a UNIX timestamp. Unit: seconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1599997188', - ], - 'Count' => [ - 'title' => '当前查询结果在该子时间区间内产生的告警数。', - 'description' => 'The number of alerts that are generated in the query time range.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '125', - ], - ], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used for Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'], + 'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'AccountName' => ['title' => '', 'description' => 'The name of the Alibaba Cloud account.', 'type' => 'string', 'example' => 'sas_account_xxx'], + 'Imported' => ['title' => '', 'description' => 'Indicates whether the account has been added. Valid values:'."\n" + .'-1: The account has been added.'."\n" + .'-0: The account has not been added.', 'type' => 'integer', 'format' => 'int32', 'example' => '123xxxxxxx'], + 'LogCode' => ['title' => '', 'description' => 'The log code.', 'type' => 'string', 'example' => 'cloud_siem_waf_xxxxx'], + 'ProdCode' => ['title' => '', 'description' => 'The code of the product that corresponds to the log.', 'type' => 'string', 'example' => 'qcloud_waf'], + ], + 'title' => '', + 'example' => '', ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListAccountsByLog', + 'changeSet' => [ + ['createdAt' => '2024-08-13T11:50:56.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-04-17T12:47:28.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"From\\": 1599897188,\\n \\"To\\": 1599997188,\\n \\"Count\\": 125\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeCustomizeRuleTestHistogram', - ], - 'DescribeLogFields' => [ - 'summary' => 'Queries the fields that can be configured for a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountsByLog'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListAccountsByLog', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"SubUserId\\": 0,\\n \\"MainUserId\\": 0,\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"AccountName\\": \\"sas_account_xxx\\",\\n \\"Imported\\": 0,\\n \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n \\"ProdCode\\": \\"qcloud_waf\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListAllProds' => [ + 'summary' => 'Lists the cloud products supported by Threat Analysis for data ingestion.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '195975', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'LogType', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_aegis_sas_alert', - ], - ], - [ - 'name' => 'LogSource', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_aegis_sas_alert', - ], - ], - [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management hub for Threat Analysis. Select the region that corresponds to the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<CustomizeRuleField>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<ListAllProdsResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'FieldName' => [ - 'title' => '规则字段名称。', - 'description' => 'The name of the field.'."\n", - 'type' => 'string', - 'example' => 'activity_name', - ], - 'FieldDesc' => [ - 'title' => '字段描述美杜莎code。', - 'description' => 'The internal code of the field description.'."\n", - 'type' => 'string', - 'example' => 'sas.cloudsiem.prod.activity_name', - ], - 'LogCode' => [ - 'title' => '字段所属日志源。', - 'description' => 'The log source to which the field belongs.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_sas_alert', - ], - 'ActivityName' => [ - 'title' => '字段所属日志类型。', - 'description' => 'The type of the log to which the field belongs.'."\n", - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY', - ], - 'FieldType' => [ - 'title' => '字段数据类型。 取值：'."\n" - .'- varchar：字符串'."\n" - .'- bigint：数字', - 'description' => 'The data type of the field. Valid values:'."\n" - ."\n" - .'* varchar'."\n" - .'* bigint'."\n", - 'type' => 'string', - 'example' => 'varchar', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'TotalCount' => ['title' => '', 'description' => 'The total number of logs.', 'type' => 'integer', 'format' => 'int32', 'example' => '19'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'ProdList' => [ + 'title' => '', + 'description' => 'The list of products.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'ProdCode' => ['title' => '', 'description' => 'The code of the cloud product.', 'type' => 'string', 'example' => 'sas'], + 'TotalLogCount' => ['title' => '', 'description' => 'The total number of logs for the product.', 'type' => 'integer', 'format' => 'int32', 'example' => '19'], + 'ImportedLogCount' => ['title' => '', 'description' => 'The number of ingested logs for the product.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'ModifyTime' => ['title' => '', 'description' => 'The time when logs were last ingested for the product.', 'type' => 'string', 'example' => '2023-11-23 12:12:12'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The multicloud code. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', + 'type' => 'string', + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '1', ], ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListAllProds', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:47:28.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"FieldName\\": \\"activity_name\\",\\n \\"FieldDesc\\": \\"sas.cloudsiem.prod.activity_name\\",\\n \\"LogCode\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"ActivityName\\": \\"HTTP_ACTIVITY\\",\\n \\"FieldType\\": \\"varchar\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeLogFields', - ], - 'DescribeLogSource' => [ - 'summary' => 'Queries the log sources that can be configured for a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAllProds'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:DescribeProdCount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"TotalCount\\": 19,\\n \\"PageSize\\": 10,\\n \\"CurrentPage\\": 1,\\n \\"ProdList\\": [\\n {\\n \\"ProdCode\\": \\"sas\\",\\n \\"TotalLogCount\\": 19,\\n \\"ImportedLogCount\\": 10,\\n \\"ModifyTime\\": \\"2023-11-23 12:12:12\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ]\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListAutomateResponseConfigs' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas104PTS'], ], 'parameters' => [ [ - 'name' => 'LogType', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志类型。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'HTTP_ACTIVITY', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123'], + ], + [ + 'name' => 'SubUserId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the user who created the rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '17108579417****'], + ], + [ + 'name' => 'PlaybookUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The unique identifier of the playbook.', 'type' => 'string', 'required' => false, 'example' => 'system_aliyun_aegis_kill_quara_book'], + ], + [ + 'name' => 'RuleName', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The name of the automated response rule.', 'type' => 'string', 'required' => false, 'example' => 'cfw kill quara book'], + ], + [ + 'name' => 'AutoResponseType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The type of the automated response. Valid values:'."\n" + ."\n" + .'- **event**'."\n" + ."\n" + .'- **alert**', 'type' => 'string', 'required' => false, 'example' => 'event'], + ], + [ + 'name' => 'ActionType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The type of the handling action. Valid values:'."\n" + ."\n" + .'- **doPlaybook**: executes a playbook.'."\n" + ."\n" + .'- **changeEventStatus**: changes the status of an event.'."\n" + ."\n" + .'- **changeThreatLevel**: changes the threat level of an event.', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook'], + ], + [ + 'name' => 'Status', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- **0**: disabled'."\n" + ."\n" + .'- **100**: enabled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'], + ], + [ + 'name' => 'CurrentPage', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The page number. The value must be 1 or greater.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member to which the administrator switches.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- **cn-hangzhou**: your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- **ap-southeast-1**: your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + [ + 'name' => 'ResponseRuleType', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'description' => 'The type of the response rule.'."\n" + ."\n" + .'- preset: predefined'."\n" + ."\n" + .'- custom: custom', 'required' => false, 'title' => '', 'example' => 'custom'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<LogSource>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => 'PageResponse<List<CloudSiemAutomateResponseConfig>>', + 'description' => 'PageResponse\\<List>', 'type' => 'object', 'properties' => [ + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- **true**: The request was successful.'."\n" + ."\n" + .'- **false**: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The request status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'LogSource' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_sas_alert', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'PageInfo' => [ + 'title' => '', + 'description' => 'The pagination information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['title' => '', 'description' => 'The page number of the returned page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], - 'LogSourceName' => [ - 'title' => '规则对应的日志源美杜莎code。', - 'description' => 'The internal code of the log source.'."\n", - 'type' => 'string', - 'example' => 'sas.cloudsiem.prod.cloud_siem_aegis_sas_alert', + 'example' => '', + ], + 'ResponseData' => [ + 'title' => '', + 'description' => 'The detailed data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Id' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the rule was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is associated with the rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the user who created the rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '17108579417****'], + 'RuleName' => ['title' => '', 'description' => 'The name of the automated response rule.', 'type' => 'string', 'example' => 'cfw kill quara book'], + 'AutoResponseType' => ['title' => '', 'description' => 'The type of the automated response. Valid values:'."\n" + ."\n" + .'- **event**'."\n" + ."\n" + .'- **alert**', 'type' => 'string', 'example' => 'event'], + 'ExecutionCondition' => ['title' => '', 'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.', 'type' => 'string', 'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]'], + 'ActionType' => ['title' => '', 'description' => 'The handling action. Multiple values are separated by commas. Valid values:'."\n" + ."\n" + .'- **doPlaybook**: executes a playbook.'."\n" + ."\n" + .'- **changeEventStatus**: changes the status of an event.'."\n" + ."\n" + .'- **changeThreatLevel**: changes the threat level of an event.', 'type' => 'string', 'example' => 'doPlaybook,changeEventStatus'], + 'ActionConfig' => ['title' => '', 'description' => 'The action configuration of the automated response rule. The value is a JSON array.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "actionType": "doPlaybook",'."\n" + .' "playbookName": "WafBlockIP",'."\n" + .' "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n" + .' }'."\n" + .']'], + 'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- **0**: disabled'."\n" + ."\n" + .'- **100**: enabled', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'DataType' => ['description' => 'The data type of the condition field in the automated response rule.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => 'varchar'], + 'ResponseRuleType' => ['type' => 'string', 'description' => 'The type of the response rule.'."\n" + ."\n" + .'- preset: predefined'."\n" + ."\n" + .'- custom: custom', 'title' => '', 'example' => 'custom'], + ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListAutomateResponseConfigs', + 'summary' => 'Retrieves a list of automated response rules.', + 'changeSet' => [ + ['createdAt' => '2025-06-05T12:36:47.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"LogSourceName\\": \\"sas.cloudsiem.prod.cloud_siem_aegis_sas_alert\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeLogSource', - ], - 'DescribeLogType' => [ - 'summary' => 'Queries the log types that can be configured for a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAutomateResponseConfigs'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListAutomateResponseConfigs', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"SubUserId\\": 0,\\n \\"RuleName\\": \\"cfw kill quara book\\",\\n \\"AutoResponseType\\": \\"event\\",\\n \\"ExecutionCondition\\": \\"[{\\\\\\"left\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"alert_name\\\\\\"},\\\\\\"operator\\\\\\":\\\\\\"containsString\\\\\\",\\\\\\"right\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"webshell_online\\\\\\"}}]\\",\\n \\"ActionType\\": \\"doPlaybook,changeEventStatus\\",\\n \\"ActionConfig\\": \\"[\\\\n {\\\\n \\\\\\"actionType\\\\\\": \\\\\\"doPlaybook\\\\\\",\\\\n \\\\\\"playbookName\\\\\\": \\\\\\"WafBlockIP\\\\\\",\\\\n \\\\\\"playbookUuid\\\\\\": \\\\\\"bdad6220-6584-41b2-9704-fc6584568758\\\\\\"\\\\n }\\\\n]\\",\\n \\"Status\\": 0,\\n \\"DataType\\": 0,\\n \\"ResponseRuleType\\": \\"custom\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'ListBindAccount' => [ + 'summary' => 'Lists multicloud accounts bound to Threat Analysis.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'RoleType', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', + 'title' => '', + 'description' => 'The code of the cloud service provider. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', + 'type' => 'string', + 'required' => true, + 'enumValueTitles' => [], + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. Select the region of the data management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'RegionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that are managed by the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<LogType>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => '', + 'description' => 'The information about the bound accounts.', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The result set.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'LogType' => [ - 'title' => '规则对应的日志类型。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY', - ], - 'LogTypeName' => [ - 'title' => '日志类型名称美杜莎code。', - 'description' => 'The internal code of the log type.'."\n", + 'AccountName' => ['title' => '', 'description' => 'The name of the account.', 'type' => 'string', 'example' => 'XXXX Company'], + 'AccessId' => ['title' => '', 'description' => 'The AccessKey ID of the account.', 'type' => 'string', 'example' => 'ABCXXXXXXXX'], + 'DataSourceCount' => ['title' => '', 'description' => 'The number of data sources that are bound to the account.', 'type' => 'integer', 'format' => 'int64', 'example' => '2'], + 'ModifyTime' => ['title' => '', 'description' => 'The time when the binding was modified.', 'type' => 'string', 'example' => '2023-11-10 12:20:35'], + 'CreateUser' => ['title' => '', 'description' => 'The user who bound the account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'BindId' => ['title' => '', 'description' => 'The binding ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123xxxxxxx'], + 'AccountId' => ['title' => '', 'description' => 'The ID of the cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code of the cloud service provider. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', 'type' => 'string', - 'example' => 'sas.cloudsiem.prod.http_activity', + 'enumValueTitles' => [], + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AccountName\\": \\"XXXX Company\\",\\n \\"AccessId\\": \\"ABCXXXXXXXX\\",\\n \\"DataSourceCount\\": 2,\\n \\"ModifyTime\\": \\"2023-11-10 12:20:35\\",\\n \\"CreateUser\\": \\"123xxxxxxx\\",\\n \\"BindId\\": 0,\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'ListBindAccount', + 'changeSet' => [ + ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"LogType\\": \\"HTTP_ACTIVITY\\",\\n \\"LogTypeName\\": \\"sas.cloudsiem.prod.http_activity\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeLogType', - ], - 'DescribeOperators' => [ - 'summary' => 'Queries the operator of a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindAccount'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListBindAccount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'translator' => 'machine', + ], + 'ListBindDataSources' => [ + 'summary' => 'Queries all bound data sources.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'SceneType', - 'in' => 'formData', - 'schema' => [ - 'title' => '操作符使用场景类型。 取值：'."\n" - .'- 不传：默认场景'."\n" - .'- AGGREGATE：聚合函数场景', - 'description' => 'The type of the scenario in which the operator is used. Valid values:'."\n" - ."\n" - .'* If you do not specify this parameter, the default scenario is used.'."\n" - .'* AGGREGATE: AGGREGATE scenario.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'AGGREGATE', - ], - ], - [ - 'name' => 'RoleType', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], ], [ - 'name' => 'RoleFor', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', + 'title' => '', + 'description' => 'The code of the multicloud environment.', + 'type' => 'string', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PlainResponse<List<CustomizeRuleOperator>>', - 'description' => 'PlainResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListBindDataSourcesResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Operator' => [ - 'title' => '操作符。', - 'description' => 'The operator.'."\n", - 'type' => 'string', - 'example' => '<=', - ], - 'OperatorName' => [ - 'title' => '操作符显示名称。', - 'description' => 'The name of the operator.'."\n", - 'type' => 'string', - 'example' => '<=', - ], - 'OperatorDescCn' => [ - 'title' => '操作符中文描述。', - 'description' => 'The description of the operator in Chinese.'."\n", - 'type' => 'string', - 'example' => 'arger than or equal to', - ], - 'OperatorDescEn' => [ - 'title' => '操作符英文描述。', - 'description' => 'The description of the operator in English.'."\n", - 'type' => 'string', - 'example' => 'larger than or equal to', - ], - 'SupportDataType' => [ - 'title' => '当前操作符可以支持的数据类型 以逗号分隔。', - 'description' => 'The data types that are supported by the operator. The data types are separated by commas (,).'."\n", + 'AccountName' => ['title' => '', 'description' => 'The name of the multicloud account.', 'type' => 'string', 'example' => 'sas_tq_account_xxxx'], + 'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value that is calculated by Threat Analysis based on specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + 'DataSourceType' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- obs: Huawei Cloud OBS.'."\n" + ."\n" + .'- wafApi: Tencent Cloud WAF download API.'."\n" + ."\n" + .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'example' => 'obs'], + 'DataSourceName' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'example' => 'waf_kafka'], + 'DataSourceRemark' => ['title' => '', 'description' => 'The remarks of the data source.', 'type' => 'string', 'example' => 'waf_kafka'], + 'LogCount' => ['title' => '', 'description' => 'The number of logs added to the data source.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'TaskCount' => ['title' => '', 'description' => 'The number of log collection tasks created for the data source.', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code of the multicloud environment. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', 'type' => 'string', - 'example' => 'varchar', - ], - 'SupportTag' => [ - 'title' => '操作符支持场景 多个场景以逗号分隔 如聚合（AGGREGATE）等 默认为空。', - 'description' => 'The scenarios that are supported by the operator. Multiple scenarios are separated by commas (,), such as AGGREGATE scenarios. By default, this parameter is empty.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The scenario that is supported by the operator. Multiple scenarios are separated by commas (,), such as AGGREGATE scenarios. By default, this parameter is empty.'."\n", - 'type' => 'string', - 'example' => '[AGGREGATE]', - ], - 'example' => '[AGGREGATE]', - ], - 'Index' => [ - 'title' => '操作符所处操作符列表位置。', - 'description' => 'The position of the operator in the operator list.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'ListBindDataSources', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindDataSources'], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Operator\\": \\"<=\\",\\n \\"OperatorName\\": \\"<=\\",\\n \\"OperatorDescCn\\": \\"arger than or equal to\\",\\n \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n \\"SupportDataType\\": \\"varchar\\",\\n \\"SupportTag\\": [\\n \\"[AGGREGATE]\\"\\n ],\\n \\"Index\\": 3\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeOperators', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListBindDataSources', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AccountName\\": \\"sas_tq_account_xxxx\\",\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"DataSourceType\\": \\"obs\\",\\n \\"DataSourceName\\": \\"waf_kafka\\",\\n \\"DataSourceRemark\\": \\"waf_kafka\\",\\n \\"LogCount\\": 1,\\n \\"TaskCount\\": 0,\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], 'ListCloudSiemCustomizeRules' => [ - 'summary' => 'Queries custom rules.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - 'http', - ], + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '规则ID。', - 'description' => 'The ID of the custom rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '10223', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'string', 'required' => false, 'example' => '10223'], ], [ 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The start time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The end time of the query. The value is a UNIX timestamp. Unit: milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ 'name' => 'ThreatLevel', 'in' => 'formData', 'style' => 'repeatList', 'schema' => [ - 'title' => '威胁等级，格式为json数组。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The threat level. The value must be a JSON array. Valid values:'."\n" + 'title' => '', + 'description' => 'The threat level. The value is a JSON array. Valid values:'."\n" ."\n" - .'* **serious**: high-risk.'."\n" - .'* **suspicious**: medium-risk.'."\n" - .'* **remind**: low-risk.'."\n", + .'- **serious**: high'."\n" + ."\n" + .'- **suspicious**: medium'."\n" + ."\n" + .'- **remind**: low', 'type' => 'array', - 'items' => [ - 'description' => 'The threat level. The value must be a JSON array. Valid values:'."\n" - ."\n" - .'* **serious**: high-risk.'."\n" - .'* **suspicious**: medium-risk.'."\n" - .'* **remind**: low-risk.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["remind","serious"]'."\n", - ], + 'items' => ['description' => 'The threat level. The value is a JSON array. Valid values:'."\n" + ."\n" + .'- **serious**: high'."\n" + ."\n" + .'- **suspicious**: medium'."\n" + ."\n" + .'- **remind**: low', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["remind","serious"]'."\n"], 'required' => false, 'example' => '["serious","suspicious","remind"]', 'maxItems' => 100, @@ -12395,533 +8482,277 @@ [ 'name' => 'AlertType', 'in' => 'formData', - 'schema' => [ - 'title' => '告警类型。', - 'description' => 'The alert type.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'scan', - ], + 'schema' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'scan'], ], [ 'name' => 'RuleName', 'in' => 'formData', - 'schema' => [ - 'title' => '规则名称, 仅支持字母、数字、下划线、点。', - 'description' => 'The name of the rule. The name can contain letters, digits, underscores (\\_), and periods (.).'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'waf_scan', - ], + 'schema' => ['title' => '', 'description' => 'The name of the rule. The name can contain letters, digits, underscores (\\_), and periods (.).', 'type' => 'string', 'required' => false, 'example' => 'waf_scan'], ], [ 'name' => 'RuleType', 'in' => 'formData', - 'schema' => [ - 'title' => '规则类型。 取值：'."\n" - .'- predefine：预定义'."\n" - .'- customize：自定义', - 'description' => 'The type of the rule. Valid values:'."\n" - ."\n" - .'* **predefine**'."\n" - .'* **customize**'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'customize', - ], + 'schema' => ['title' => '', 'description' => 'The type of the rule. Valid values:'."\n" + ."\n" + .'- **predefine**: predefined'."\n" + ."\n" + .'- **customize**: custom', 'type' => 'string', 'required' => false, 'example' => 'customize'], ], [ 'name' => 'Status', 'in' => 'formData', - 'schema' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：初始状态'."\n" - .'- 10：模拟数据测试'."\n" - .'- 15：业务数据测试中'."\n" - .'- 20：业务数据测试结束'."\n" - .'- 100：规则上线', - 'description' => 'The status of the rule. Valid values:'."\n" - ."\n" - .'* **0**: The rule is in the initial state.'."\n" - .'* **10**: The simulation data is tested.'."\n" - .'* **15**: The business data is being tested.'."\n" - .'* **20**: The business data test is complete.'."\n" - .'* **100**: The rule is in effect.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- **0**: initial'."\n" + ."\n" + .'- **10**: testing with simulated data'."\n" + ."\n" + .'- **15**: testing with business data'."\n" + ."\n" + .'- **20**: testing with business data is complete'."\n" + ."\n" + .'- **100**: published', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'], ], [ 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'title' => '规则列表排列字段。 取值：'."\n" - .'- GmtModified：基于修改时间排序'."\n" - .'- Id：基于规则id排序（默认）', - 'description' => 'The field that is used to sort the rules. Valid values:'."\n" - ."\n" - .'* GmtModified: The rules are sorted based on the modification time.'."\n" - .'* Id (default): The rules are sorted based on the rule ID.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'Id', - ], + 'schema' => ['title' => '', 'description' => 'The field that you use to sort the custom rules. Valid values:'."\n" + ."\n" + .'- GmtModified: sorts the rules by modification time.'."\n" + ."\n" + .'- Id: sorts the rules by rule ID. This is the default value.', 'type' => 'string', 'required' => false, 'example' => 'Id'], ], [ 'name' => 'Order', 'in' => 'formData', - 'schema' => [ - 'title' => '事件列表排列方向。 取值：'."\n" - .'- desc：降序排列'."\n" - .'- asc：升序排列。', - 'description' => 'The sort method. Valid values:'."\n" - ."\n" - .'* desc: descending order.'."\n" - .'* asc: ascending order.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'desc', - ], + 'schema' => ['title' => '', 'description' => 'The order in which you want to sort the custom rules. Valid values:'."\n" + ."\n" + .'- desc: descending order'."\n" + ."\n" + .'- asc: ascending order', 'type' => 'string', 'required' => false, 'example' => 'desc'], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The page number. Pages start from page 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. The value can be up to 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - ."\n" - .'* 0: view of the current Alibaba Cloud account.'."\n" - .'* 1: view of all accounts for the enterprise.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all members in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the destination account to which you switch the view from the management account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID that is used to switch the administrator\'s view to the view of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* **cn-hangzhou**: Your assets reside in regions in China.'."\n" - .'* **ap-southeast-1**: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is deployed. You must select the region where your assets reside. Valid values:'."\n" + ."\n" + .'- **cn-hangzhou**: your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- **ap-southeast-1**: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'PageResponse<List<CloudSiemCustomizeRule>>', - 'description' => 'PageResponse\\<List>'."\n", + 'description' => 'PageResponse\\<List\\<CloudSiemCustomizeRule>>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* **true**'."\n" - .'* **false**'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- **true**: The request was successful.'."\n" + ."\n" + .'- **false**: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", + 'title' => '', + 'description' => 'The pagination information.', 'type' => 'object', 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], + 'CurrentPage' => ['title' => '', 'description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], + 'example' => '', ], 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", + 'title' => '', + 'description' => 'The detailed data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the custom rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '自定义规则创建时间。', - 'description' => 'The time when the custom rule was created.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '自定义规则最后更新时间。', - 'description' => 'The time when the custom rule was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => 'siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'RuleName' => [ - 'title' => '规则名称。', - 'description' => 'The name of the rule.'."\n", - 'type' => 'string', - 'example' => 'waf_scan', - ], - 'RuleDesc' => [ - 'title' => '规则描述。', - 'description' => 'The description of the rule.'."\n", - 'type' => 'string', - 'example' => 'this rule is for waf scan', - ], - 'RuleType' => [ - 'title' => '规则类型。 取值：'."\n" - .'- predefine：预定义'."\n" - .'- customize：自定义', - 'description' => 'The type of the rule. Valid values:'."\n" - ."\n" - .'* **predefine**'."\n" - .'* **customize**'."\n", - 'type' => 'string', - 'example' => 'customize', - ], - 'ThreatLevel' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" - ."\n" - .'* **serious**: high-risk.'."\n" - .'* **suspicious**: medium-risk.'."\n" - .'* **remind**: low-risk.'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'AlertType' => [ - 'title' => '威胁类型。', - 'description' => 'The type of the risk.'."\n", - 'type' => 'string', - 'example' => 'WEBSHELL', - ], - 'AlertTypeMds' => [ - 'title' => '威胁类型美杜莎code。', - 'description' => 'The internal code of the risk type.'."\n", - 'type' => 'string', - 'example' => '${siem_rule_type_process_abnormal_command}', - ], - 'LogType' => [ - 'title' => '规则对应的日志类型。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'example' => 'ALERT_ACTIVITY', - ], - 'LogTypeMds' => [ - 'title' => '规则对应的日志类型美杜莎code。', - 'description' => 'The internal code of the log type.'."\n", - 'type' => 'string', - 'example' => '${sas.cloudsiem.prod.alert_activity}', - ], - 'LogSource' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_sas_alert', - ], - 'LogSourceMds' => [ - 'title' => '规则对应的日志源美杜莎code。', - 'description' => 'The internal code of the log source.'."\n", - 'type' => 'string', - 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}', - ], - 'RuleCondition' => [ - 'title' => '规则查询条件json(需要对html转义字符进行反向转义)。', - 'description' => 'The query condition of the rule. The value is in the JSON format. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]', - ], - 'RuleGroup' => [ - 'title' => '日志聚合字段,json数组格式(需要对html转义字符进行反向转义)。', - 'description' => 'The log aggregation field. The value is in the JSON format. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '["asset_id"]', - ], - 'RuleThreshold' => [ - 'title' => '规则阈值配置json(需要对html转义字符进行反向转义)。', - 'description' => 'The threshold configurations of the rule in the JSON format. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}', - ], - 'QueryCycle' => [ - 'title' => '规则窗口长度(需要对html转义字符进行反向转义)。', - 'description' => 'The window length of the rule. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '{"time":"1","unit":"HOUR"}', - ], - 'AttCk' => [ - 'title' => '告警附加字段attck', - 'description' => 'The alert additional field for ATT\\&CK.'."\n", - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'EventTransferSwitch' => [ - 'title' => '告警是否转换事件开关。 取值：'."\n" - .'- 0：不转换'."\n" - .'- 1：转换', - 'description' => 'Indicates whether the system generates an event for the alert. Valid values:'."\n" - ."\n" - .'* **0**: no.'."\n" - .'* **1**: yes.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'EventTransferType' => [ - 'title' => '事件生成方式。 取值：'."\n" - .'- default:默认内置方式'."\n" - .'- singleToSingle：每个告警生成一个事件'."\n" - .'- allToSingle：周期内告警生成一个事件', - 'description' => 'The method that is used to generate an event. Valid values:'."\n" - ."\n" - .'* **default**: built-in method.'."\n" - .'* **singleToSingle**: The system generates an event for each alert.'."\n" - .'* **allToSingle**: The system generates an event for alerts within a period of time.'."\n", - 'type' => 'string', - 'example' => 'allToSingle', - ], - 'EventTransferExt' => [ - 'title' => '事件生成扩展信息 当eventTransferType值为allToSingle该字段有值 表示告警聚合窗口的周期长度以及周期单位(需要对html转义字符进行反向转义)。', - 'description' => 'The extended information about event generation. If the value of **eventTransferType** is **allToSingle**, the value of this parameter indicates the length and unit of the alert aggregation window. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '{"time":"1","unit":"MINUTE"}', - ], - 'Status' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：初始状态'."\n" - .'- 10：模拟数据测试'."\n" - .'- 15：业务数据测试中'."\n" - .'- 20：业务数据测试结束'."\n" - .'- 100：规则上线', - 'description' => 'The status of the rule. Valid values:'."\n" - ."\n" - .'* **0**: The rule is in the initial state.'."\n" - .'* **10**: The simulation data is tested.'."\n" - .'* **15**: The business data is being tested.'."\n" - .'* **20**: The business data test is complete.'."\n" - .'* **100**: The rule is in effect.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'DataType' => [ - 'description' => 'The type of the view. Valid values:'."\n" - ."\n" - .'0: view of the current Alibaba Cloud account. 1: view of all accounts for the enterprise.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], + 'Id' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the custom rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the custom rule was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'RuleName' => ['title' => '', 'description' => 'The name of the rule.', 'type' => 'string', 'example' => 'waf_scan'], + 'RuleDesc' => ['title' => '', 'description' => 'The description of the rule.', 'type' => 'string', 'example' => 'this rule is for waf scan'], + 'RuleType' => ['title' => '', 'description' => 'The type of the rule. Valid values:'."\n" + ."\n" + .'- **predefine**: predefined'."\n" + ."\n" + .'- **customize**: custom', 'type' => 'string', 'example' => 'customize'], + 'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- **serious**: high'."\n" + ."\n" + .'- **suspicious**: medium'."\n" + ."\n" + .'- **remind**: low', 'type' => 'string', 'example' => 'remind'], + 'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'], + 'AlertTypeMds' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'example' => '${siem_rule_type_process_abnormal_command}'], + 'LogType' => ['title' => '', 'description' => 'The log type that is associated with the rule.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY'], + 'LogTypeMds' => ['title' => '', 'description' => 'The Medusa code of the log type that is associated with the rule.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.alert_activity}'], + 'LogSource' => ['title' => '', 'description' => 'The log source that is associated with the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'], + 'LogSourceMds' => ['title' => '', 'description' => 'The Medusa code of the log source that is associated with the rule.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}'], + 'RuleCondition' => ['title' => '', 'description' => 'The query condition of the rule, which is a JSON-formatted string that represents an array. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]'], + 'RuleGroup' => ['title' => '', 'description' => 'The aggregation field of the log, which is a JSON-formatted string that represents an array. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '["asset_id"]'], + 'RuleThreshold' => ['title' => '', 'description' => 'The threshold of the rule, which is a JSON-formatted string. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}'], + 'QueryCycle' => ['title' => '', 'description' => 'The window length of the rule, which is a JSON-formatted string. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '{"time":"1","unit":"HOUR"}'], + 'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK attack technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'], + 'EventTransferSwitch' => ['title' => '', 'description' => 'Indicates whether to convert alerts into events. Valid values:'."\n" + ."\n" + .'- **0**: no'."\n" + ."\n" + .'- **1**: yes', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'EventTransferType' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n" + ."\n" + .'- **default**: the default method'."\n" + ."\n" + .'- **singleToSingle**: An event is generated for each alert.'."\n" + ."\n" + .'- **allToSingle**: An event is generated for all alerts within a period.', 'type' => 'string', 'example' => 'allToSingle'], + 'EventTransferExt' => ['title' => '', 'description' => 'The extended information for event generation. This parameter is returned only when **EventTransferType** is set to **allToSingle**. The value is a JSON-formatted string that indicates the window length and unit for alert aggregation. You must unescape the HTML escape characters in the string.', 'type' => 'string', 'example' => '{"time":"1","unit":"MINUTE"}'], + 'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- **0**: initial'."\n" + ."\n" + .'- **10**: testing with simulated data'."\n" + ."\n" + .'- **15**: testing with business data'."\n" + ."\n" + .'- **20**: testing with business data is complete'."\n" + ."\n" + .'- **100**: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'DataType' => ['description' => 'The view type.'."\n" + ."\n" + .'0: the view of the current Alibaba Cloud account.'."\n" + .'1: the view of all members in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '1'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListCloudSiemCustomizeRules', + 'summary' => 'Retrieves a list of custom rules.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemCustomizeRules'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListCloudSiemCustomizeRules', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"RuleName\\": \\"waf_scan\\",\\n \\"RuleDesc\\": \\"this rule is for waf scan\\",\\n \\"RuleType\\": \\"customize\\",\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"AlertType\\": \\"WEBSHELL\\",\\n \\"AlertTypeMds\\": \\"${siem_rule_type_process_abnormal_command}\\",\\n \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n \\"LogTypeMds\\": \\"${sas.cloudsiem.prod.alert_activity}\\",\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"LogSourceMds\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}\\",\\n \\"RuleCondition\\": \\"[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]\\",\\n \\"RuleGroup\\": \\"["asset_id"]\\",\\n \\"RuleThreshold\\": \\"{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}\\",\\n \\"QueryCycle\\": \\"{"time":"1","unit":"HOUR"}\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"EventTransferSwitch\\": 1,\\n \\"EventTransferType\\": \\"allToSingle\\",\\n \\"EventTransferExt\\": \\"{"time":"1","unit":"MINUTE"}\\",\\n \\"Status\\": 0,\\n \\"DataType\\": 1\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'ListCloudSiemCustomizeRules', ], 'ListCloudSiemPredefinedRules' => [ - 'summary' => 'Queries predefined rules.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - 'http', - ], + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '10223', - ], + 'schema' => ['title' => '', 'description' => 'The rule ID.', 'type' => 'string', 'required' => false, 'example' => '10223'], ], [ 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The start of the time range to query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The end of the time range to query. This value is a UNIX timestamp in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1577808000000'], ], [ 'name' => 'ThreatLevel', 'in' => 'formData', 'style' => 'repeatList', 'schema' => [ - 'title' => '威胁等级，格式为json数组。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. The value is a JSON array. Valid values:'."\n" + 'title' => '', + 'description' => 'The threat level. The value is a JSON array. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", + .'- remind: low', 'type' => 'array', - 'items' => [ - 'description' => 'The risk level. The value is a JSON string. Valid values:'."\n" - ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["remind","serious"]'."\n", - ], + 'items' => ['description' => 'The threat level. The value is a JSON array. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'required' => false, 'title' => '', 'example' => '["remind","serious"]'."\n"], 'required' => false, 'example' => '["serious","suspicious","remind"]', 'maxItems' => 100, @@ -12930,421 +8761,228 @@ [ 'name' => 'AlertType', 'in' => 'formData', - 'schema' => [ - 'title' => '告警类型。', - 'description' => 'The alert type.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'scan', - ], + 'schema' => ['title' => '', 'description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'scan'], ], [ 'name' => 'RuleName', 'in' => 'formData', - 'schema' => [ - 'title' => '规则名称, 仅支持字母、数字、下划线、点。', - 'description' => 'The name of the rule. The name can contain letters, digits, underscores (\\_), and periods (.).'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'waf_scan', - ], + 'schema' => ['title' => '', 'description' => 'The rule name. The name can contain only letters, digits, underscores (\\_), and periods (.).', 'type' => 'string', 'required' => false, 'example' => 'waf_scan'], ], [ 'name' => 'RuleType', 'in' => 'formData', - 'schema' => [ - 'title' => '规则类型。 取值：'."\n" - .'- predefine：预定义'."\n" - .'- customize：自定义', - 'description' => 'The type of the rule. Valid values:'."\n" - ."\n" - .'* predefine'."\n" - .'* customize'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'customize', - ], + 'schema' => ['title' => '', 'description' => 'The rule type. Valid values:'."\n" + ."\n" + .'- predefine: predefined'."\n" + ."\n" + .'- customize: custom', 'type' => 'string', 'required' => false, 'example' => 'customize'], ], [ 'name' => 'EventTransferType', 'in' => 'formData', - 'schema' => [ - 'title' => '事件生成方式。 取值：'."\n" - .'- default:默认内置方式'."\n" - .'- singleToSingle：每个告警生成一个事件'."\n" - .'- allToSingle：周期内告警生成一个事件', - 'description' => 'The method that is used to generate an event. Valid values:'."\n" - ."\n" - .'* default: built-in method.'."\n" - .'* singleToSingle: The system generates an event for each alert.'."\n" - .'* allToSingle: The system generates an event for alerts within a period of time.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'allToSingle', - ], + 'schema' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n" + ."\n" + .'- default: the default built-in method'."\n" + ."\n" + .'- singleToSingle: An event is generated for each alert.'."\n" + ."\n" + .'- allToSingle: An event is generated for all alerts in an epoch.', 'type' => 'string', 'required' => false, 'example' => 'allToSingle'], ], [ 'name' => 'AttCk', 'in' => 'formData', - 'schema' => [ - 'title' => 'att&ck。', - 'description' => 'The ATT\\&CK information.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'T1595.002 Vulnerability Scanning', - ], + 'schema' => ['title' => 'att&ck。', 'description' => 'The ATT\\&CK technique.', 'type' => 'string', 'required' => false, 'example' => 'T1595.002 Vulnerability Scanning'], ], [ 'name' => 'LogSource', 'in' => 'formData', - 'schema' => [ - 'title' => '日志源。', - 'description' => 'The log source.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_aegis_sas_alert', - ], + 'schema' => ['title' => '', 'description' => 'The log source.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_alb_flow_log'], ], [ 'name' => 'Status', 'in' => 'formData', - 'schema' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：初始状态'."\n" - .'- 10：模拟数据测试'."\n" - .'- 15：业务数据测试中'."\n" - .'- 20：业务数据测试结束'."\n" - .'- 100：规则上线', - 'description' => 'The status of the rule. Valid values:'."\n" - ."\n" - .'* 0: The rule is in the initial state.'."\n" - .'* 10: The simulation data is tested.'."\n" - .'* 15: The business data is being tested.'."\n" - .'* 20: The business data test ends.'."\n" - .'* 100: The rule takes effect.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['title' => '', 'description' => 'The rule status. Valid values:'."\n" + ."\n" + .'- 0: initial'."\n" + ."\n" + .'- 10: testing with simulated data'."\n" + ."\n" + .'- 15: testing with production data'."\n" + ."\n" + .'- 20: testing with production data is complete'."\n" + ."\n" + .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0'], ], [ 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'title' => '规则列表排列字段。 取值：'."\n" - .'- GmtModified：基于修改时间排序'."\n" - .'- Id：基于规则id排序（默认）', - 'description' => 'The field that is used to sort the rules. Valid values:'."\n" - ."\n" - .'* GmtModified: The rules are sorted based on the modification time.'."\n" - .'* Id (default): The rules are sorted based on the rule ID.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'Id', - ], + 'schema' => ['title' => '', 'description' => 'The field to sort the rules by. Valid values:'."\n" + ."\n" + .'- GmtModified: Sorts by modification time.'."\n" + ."\n" + .'- Id: Sorts by rule ID. This is the default value.', 'type' => 'string', 'required' => false, 'example' => 'Id'], ], [ 'name' => 'Order', 'in' => 'formData', - 'schema' => [ - 'title' => '事件列表排列方向。 取值：'."\n" - .'- desc：降序排列'."\n" - .'- asc：升序排列。', - 'description' => 'The sort method. Valid values:'."\n" - ."\n" - .'* desc: descending order.'."\n" - .'* asc: ascending order.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'desc', - ], + 'schema' => ['title' => '', 'description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- desc: descending'."\n" + ."\n" + .'- asc: ascending', 'type' => 'string', 'required' => false, 'example' => 'desc'], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view.'."\n" - ."\n" - .'* 0: view of the current Alibaba Cloud account.'."\n" - .'* 1: view of all accounts for the enterprise.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the destination account to which you switch the view from the management account.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID that the administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of the threat analysis feature is located. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: assets in the Chinese mainland or China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'PageResponse<List<CloudSiemPredefinedRule>>', - 'description' => 'PageResponse\\<List>'."\n", + 'description' => 'PageResponse\\<List>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", + 'title' => '', + 'description' => 'The pagination information.', 'type' => 'object', 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], + 'CurrentPage' => ['title' => '', 'description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], + 'example' => '', ], 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", + 'title' => '', + 'description' => 'The detailed data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '预定义规则ID。', - 'description' => 'The ID of the predefined rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '规则创建时间。', - 'description' => 'The time when the rule was created.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '规则修改时间。', - 'description' => 'The time when the rule was modified.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'RuleName' => [ - 'title' => '规则名称。', - 'description' => 'The name of the rule.'."\n", - 'type' => 'string', - 'example' => 'siem_base64-command-exec_aegis-proc', - ], - 'RuleNameCn' => [ - 'title' => '规则中文名称。', - 'description' => 'The rule name in Chinese.'."\n", - 'type' => 'string', - 'example' => 'siem_base64-command-exec_aegis-proc', - ], - 'RuleNameEn' => [ - 'title' => '规则英文名称。', - 'description' => 'The rule name in English.'."\n", - 'type' => 'string', - 'example' => 'siem_base64-command-exec_aegis-proc', - ], - 'RuleNameMds' => [ - 'title' => '规则名称美杜莎code。', - 'description' => 'The internal code of the rule name.'."\n", - 'type' => 'string', - 'example' => '${siem_rule_name_siem_cfw-attack-count-level-up_cfw-attack}', - ], - 'RuleDescMds' => [ - 'title' => '规则描述美杜莎code。', - 'description' => 'The internal code of the rule description.'."\n", - 'type' => 'string', - 'example' => '${siem_rule_description_siem_cfw-attack-count-level-up_cfw-attack}', - ], - 'ThreatLevel' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" - ."\n" - .'* serious: high.'."\n" - .'* suspicious: medium.'."\n" - .'* remind: low.'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'AlertType' => [ - 'title' => '威胁类型。', - 'description' => 'The type of the risk.'."\n", - 'type' => 'string', - 'example' => 'WEBSHELL', - ], - 'Source' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_proc', - ], - 'EventTransferType' => [ - 'title' => '事件生成方式。 取值：'."\n" - .'- default:默认内置方式'."\n" - .'- singleToSingle：每个告警生成一个事件'."\n" - .'- allToSingle：周期内告警生成一个事件', - 'description' => 'The method that is used to generate an event. Valid values:'."\n" - ."\n" - .'* default: built-in method.'."\n" - .'* singleToSingle: The system generates an event for each alert.'."\n" - .'* allToSingle: The system generates an event for alerts within a period of time.'."\n", - 'type' => 'string', - 'example' => 'allToSingle', - ], - 'AttCk' => [ - 'title' => '告警附加字段attck', - 'description' => 'The alert additional field for ATT\\&CK.'."\n", - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'Status' => [ - 'title' => '预定义规则启用状态。 取值：'."\n" - .'- 0：初始状态'."\n" - .'- 100：规则上线', - 'description' => 'The status of the predefined rule. Valid values:'."\n" - ."\n" - .'* 0: The rule is in the initial state.'."\n" - .'* 100: The rule takes effect.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], + 'Id' => ['title' => '', 'description' => 'The ID of the predefined rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the rule was last modified.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'RuleName' => ['title' => '', 'description' => 'The rule name.', 'type' => 'string', 'example' => 'siem_base64-command-exec_aegis-proc'], + 'RuleNameCn' => ['title' => '', 'description' => 'The Chinese name of the rule.', 'type' => 'string', 'example' => 'siem_base64-command-exec_aegis-proc'], + 'RuleNameEn' => ['title' => '', 'description' => 'The English name of the rule.', 'type' => 'string', 'example' => 'siem_base64-command-exec_aegis-proc'], + 'RuleNameMds' => ['title' => '', 'description' => 'The Medusa code of the rule name.', 'type' => 'string', 'example' => '${siem_rule_name_siem_cfw-attack-count-level-up_cfw-attack}'], + 'RuleDescMds' => ['title' => '', 'description' => 'The Medusa code of the rule description.', 'type' => 'string', 'example' => '${siem_rule_description_siem_cfw-attack-count-level-up_cfw-attack}'], + 'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'example' => 'remind'], + 'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'], + 'Source' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_proc'], + 'EventTransferType' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n" + ."\n" + .'- default: the default built-in method'."\n" + ."\n" + .'- singleToSingle: An event is generated for each alert.'."\n" + ."\n" + .'- allToSingle: An event is generated for all alerts in an epoch.', 'type' => 'string', 'example' => 'allToSingle'], + 'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'], + 'Status' => ['title' => '', 'description' => 'The status of the predefined rule. Valid values:'."\n" + ."\n" + .'- 0: initial'."\n" + ."\n" + .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListCloudSiemPredefinedRules', + 'summary' => 'Retrieves a list of predefined rules.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemPredefinedRules'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListCloudSiemPredefinedRules', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"RuleName\\": \\"siem_base64-command-exec_aegis-proc\\",\\n \\"RuleNameCn\\": \\"siem_base64-command-exec_aegis-proc\\",\\n \\"RuleNameEn\\": \\"siem_base64-command-exec_aegis-proc\\",\\n \\"RuleNameMds\\": \\"${siem_rule_name_siem_cfw-attack-count-level-up_cfw-attack}\\",\\n \\"RuleDescMds\\": \\"${siem_rule_description_siem_cfw-attack-count-level-up_cfw-attack}\\",\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"AlertType\\": \\"WEBSHELL\\",\\n \\"Source\\": \\"cloud_siem_aegis_proc\\",\\n \\"EventTransferType\\": \\"allToSingle\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"Status\\": 0\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'ListCloudSiemPredefinedRules', ], 'ListCustomizeRuleTestResult' => [ - 'summary' => 'Queries the test results of a custom rule.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], + 'summary' => 'Retrieves the list of test results for a custom rule.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -13356,1047 +8994,454 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Valid values: 1 to 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The number of entries per page. The maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. This parameter is used by an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the region where your assets are deployed. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], [ 'name' => 'DetectionRuleId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The ID of the custom rule. You can obtain the rule ID from the rule list.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'dr-53np4nguf5jmh1vc****'], ], [ 'name' => 'VerifyType', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The verification result for the accuracy of alert fields based on the alert template.'."\n" + ."\n" + .'- true: The verification is passed. Alerts that are generated for enabled rules can be synchronized to the product.'."\n" + ."\n" + .'- false: The verification failed. Alerts cannot be synchronized to the product.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'true'], ], [ 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The start time.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '1723057091000'], ], [ 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The end time.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '1731797891000'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'PageResponse<List<CustomizeRuleAlert>>', - 'description' => 'PageResponse\\<List>'."\n", + 'description' => 'PageResponse\\<List>', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", + 'title' => '', + 'description' => 'The pagination information.', 'type' => 'object', 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - 'VerifiedCount' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'CurrentPage' => ['title' => '', 'description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], + 'VerifiedCount' => ['description' => 'The number of alerts that passed the verification.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '30'], ], + 'example' => '', ], 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", + 'title' => '', + 'description' => 'The detailed data.', 'type' => 'array', 'items' => [ 'type' => 'object', 'properties' => [ - 'Uuid' => [ - 'title' => '告警id。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'MainUserId' => [ - 'title' => '告警关联siem主账号id。', - 'description' => 'The ID of the Alibaba Cloud account that is associated with the alert in SIEM.'."\n", - 'type' => 'string', - 'example' => '127608589417****', - ], - 'SubUserId' => [ - 'title' => '告警史记关联阿里账号ID。', - 'description' => 'The ID of the Alibaba Cloud account within which the alert is generated.'."\n", - 'type' => 'string', - 'example' => '176555323***', - ], - 'LogType' => [ - 'title' => '规则对应的日志类型。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'example' => 'ALERT_ACTIVITY', - ], - 'LogSource' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_sas_alert', - ], - 'AlertSrcProd' => [ - 'title' => '事件关联告警来源产品。', - 'description' => 'The source of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'AlertSrcProdModule' => [ - 'title' => '事件关联告警来源产品子模块。', - 'description' => 'The sub-module of the source.'."\n", - 'type' => 'string', - 'example' => 'waf', - ], - 'AttCk' => [ - 'title' => 'ATTCT&攻击技术标签。', - 'description' => 'The tag of the ATT\\&CK attack.'."\n", - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'AlertDesc' => [ - 'title' => '告警描述。', - 'description' => 'The description of the alert.'."\n", - 'type' => 'string', - 'example' => 'The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior.', - ], - 'OnlineStatus' => [ - 'title' => '告警数据状态。 取值：'."\n" - .'- test：业务测试'."\n" - .'- online：上线', - 'description' => 'The status of the alert data. Valid values:'."\n" - ."\n" - .'* test: business test data.'."\n" - .'* online: online data.'."\n", - 'type' => 'string', - 'example' => 'test', - ], - 'EventName' => [ - 'title' => '告警名称，对应自定义规则名称。', - 'description' => 'The name of the alert, which corresponds to the name of the custom rule.'."\n", - 'type' => 'string', - 'example' => 'waf_scan', - ], - 'Level' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The threat level. Valid values:'."\n" - ."\n" - .'* serious: high.'."\n" - .'* suspicious: medium.'."\n" - .'* remind: low.'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'EventType' => [ - 'title' => '威胁类型 即告警类型。', - 'description' => 'The threat type, which indicates the alert type.'."\n", - 'type' => 'string', - 'example' => 'WEBSHELL', - ], - 'AlertDetail' => [ - 'title' => '告警详情 json格式。', - 'description' => 'The alert details in the JSON format.'."\n", - 'type' => 'string', - 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "218.92.XX.XX"}', - ], - 'LogTime' => [ - 'title' => '告警记录时间。', - 'description' => 'The time when the alert was recorded.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'VerifyType' => [ - 'type' => 'string', - ], + 'Uuid' => ['title' => '', 'description' => 'The UUID of the alert.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the main Alibaba Cloud account for Security Information and Event Management (SIEM) that is associated with the alert.', 'type' => 'string', 'example' => '127608589417****'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the member account that is associated with the alert.', 'type' => 'string', 'example' => '176555323***'], + 'LogType' => ['title' => '', 'description' => 'The log type that corresponds to the rule.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY'], + 'LogSource' => ['title' => '', 'description' => 'The log source that corresponds to the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'], + 'AlertSrcProd' => ['title' => '', 'description' => 'The source product of the alert that is associated with the event.', 'type' => 'string', 'example' => 'sas'], + 'AlertSrcProdModule' => ['title' => '', 'description' => 'The sub-module of the source product of the alert that is associated with the event.', 'type' => 'string', 'example' => 'waf'], + 'AttCk' => ['title' => '', 'description' => 'The ATT\\&CK attack technique tag.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'], + 'AlertDesc' => ['title' => '', 'description' => 'The description of the alert.', 'type' => 'string', 'example' => 'The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior。'], + 'OnlineStatus' => ['title' => '', 'description' => 'The status of the alert data. Valid values:'."\n" + ."\n" + .'- test: business test'."\n" + ."\n" + .'- online: published', 'type' => 'string', 'example' => 'test'], + 'EventName' => ['title' => '', 'description' => 'The name of the alert. This value corresponds to the name of the custom rule.', 'type' => 'string', 'example' => 'waf_scan'], + 'Level' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'example' => 'remind'], + 'EventType' => ['title' => '', 'description' => 'The threat type. This parameter is equivalent to the alert type.', 'type' => 'string', 'example' => 'WEBSHELL'], + 'AlertDetail' => ['title' => '', 'description' => 'The details of the alert, in JSON format.', 'type' => 'string', 'example' => '{"main_user_id": "165295629792****";"log_uuid_count": "99";"attack_ip": "218.92.XX.XX"}'], + 'LogTime' => ['title' => '', 'description' => 'The time when the alert was recorded.', 'type' => 'string', 'example' => '2023-01-06 16:37:29'], + 'VerifyType' => ['description' => 'The result of verifying the alert based on the alert template.'."\n" + ."\n" + .'- true: The verification is passed.'."\n" + ."\n" + .'- false: The verification failed.', 'type' => 'string', 'title' => '', 'example' => 'true'], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100,\\n \\"VerifiedCount\\": 30\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Uuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"MainUserId\\": \\"127608589417****\\",\\n \\"SubUserId\\": \\"176555323***\\",\\n \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"AlertDesc\\": \\"The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior。\\",\\n \\"OnlineStatus\\": \\"test\\",\\n \\"EventName\\": \\"waf_scan\\",\\n \\"Level\\": \\"remind\\",\\n \\"EventType\\": \\"WEBSHELL\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"218.92.XX.XX\\\\\\"}\\",\\n \\"LogTime\\": \\"2023-01-06 16:37:29\\",\\n \\"VerifyType\\": \\"true\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + 'staticInfo' => ['returnType' => 'synchronous'], 'title' => 'ListCustomizeRuleTestResult', - ], - 'PostCustomizeRule' => [ - 'summary' => 'Creates or updates a custom rule.', - 'methods' => [ - 'get', - 'post', + 'changeSet' => [ + ['createdAt' => '2025-03-27T06:13:13.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'https', - 'http', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCustomizeRuleTestResult'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListCustomizeRuleTestResult', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100,\\n \\"VerifiedCount\\": 30\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Uuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"MainUserId\\": \\"127608589417****\\",\\n \\"SubUserId\\": \\"176555323***\\",\\n \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"AlertSrcProd\\": \\"sas\\",\\n \\"AlertSrcProdModule\\": \\"waf\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"AlertDesc\\": \\"The account you logged in this time is not in the legal account category defined by you. Please confirm the legality of the login behavior。\\",\\n \\"OnlineStatus\\": \\"test\\",\\n \\"EventName\\": \\"waf_scan\\",\\n \\"Level\\": \\"remind\\",\\n \\"EventType\\": \\"WEBSHELL\\",\\n \\"AlertDetail\\": \\"{\\\\\\"main_user_id\\\\\\": \\\\\\"165295629792****\\\\\\";\\\\\\"log_uuid_count\\\\\\": \\\\\\"99\\\\\\";\\\\\\"attack_ip\\\\\\": \\\\\\"218.92.XX.XX\\\\\\"}\\",\\n \\"LogTime\\": \\"2023-01-06 16:37:29\\",\\n \\"VerifyType\\": \\"true\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'ListDataSourceLogs' => [ + 'summary' => 'Lists the logs for a data source.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Id', + 'name' => 'DataSourceInstanceId', 'in' => 'formData', - 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value that is calculated by threat analysis based on specific parameters.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], ], [ - 'name' => 'RuleName', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '规则名称。', - 'description' => 'The name of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'waf_scan', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxx'], ], [ - 'name' => 'RuleDesc', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则描述。', - 'description' => 'The description of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'this rule is for waf scan', - ], - ], - [ - 'name' => 'ThreatLevel', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" + 'title' => '', + 'description' => 'The code for the cloud service provider. Valid values:'."\n" ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'remind', - ], - ], - [ - 'name' => 'AttCk', - 'in' => 'formData', - 'schema' => [ - 'title' => 'att&ck。', - 'description' => 'att&ck.', - 'type' => 'string', - 'required' => false, - 'example' => 'T1595.002 Vulnerability Scanning'."\n", - ], - ], - [ - 'name' => 'AlertType', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁类型。', - 'description' => 'The risk type.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'WEBSHELL', - ], - ], - [ - 'name' => 'AlertTypeMds', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁类型美杜莎code。', - 'description' => 'The internal code of the risk type.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '${siem_rule_type_process_abnormal_command}', - ], - ], - [ - 'name' => 'LogType', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志类型。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ALERT_ACTIVITY', - ], - ], - [ - 'name' => 'LogTypeMds', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志类型美杜莎code。', - 'description' => 'The internal code of the log type.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '${security_event_config.event_name.webshellName_clientav}', - ], - ], - [ - 'name' => 'LogSource', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_aegis_sas_alert', - ], - ], - [ - 'name' => 'LogSourceMds', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则对应的日志源美杜莎code。', - 'description' => 'The internal code of the log source.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}', - ], - ], - [ - 'name' => 'RuleCondition', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则查询条件json。', - 'description' => 'The query condition of the rule. The value is in the JSON format.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]', - ], - ], - [ - 'name' => 'RuleGroup', - 'in' => 'formData', - 'schema' => [ - 'title' => '日志聚合字段,json数组格式。', - 'description' => 'The log aggregation field of the rule. The value is a JSON string.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '["asset_id"]', - ], - ], - [ - 'name' => 'RuleThreshold', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则阈值配置json。', - 'description' => 'The threshold configuration of the rule. The value is in the JSON format.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}', - ], - ], - [ - 'name' => 'QueryCycle', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则窗口长度。', - 'description' => 'The window length of the rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '{"time":"1","unit":"HOUR"}', - ], - ], - [ - 'name' => 'EventTransferSwitch', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警是否转换事件开关。 取值：'."\n" - .'- 0：不转换'."\n" - .'- 1：转换', - 'description' => 'Specifies whether to convert an alert to an event. Valid values:'."\n" + .'- qcloud: Tencent Cloud.'."\n" ."\n" - .'* 0: no'."\n" - .'* 1: yes'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'EventTransferType', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件生成方式。 取值：'."\n" - .'- default:默认内置方式'."\n" - .'- singleToSingle：每个告警生成一个事件'."\n" - .'- allToSingle：周期内告警生成一个事件', - 'description' => 'The event generation method. Valid values:'."\n" + .'- aliyun: Alibaba Cloud.'."\n" ."\n" - .'* default: The default method is used.'."\n" - .'* singleToSingle: The system generates an event for each alert.'."\n" - .'* allToSingle: The system generates an event for alerts within a period of time.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'allToSingle', - ], - ], - [ - 'name' => 'EventTransferExt', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件生成扩展信息 当eventTransferType值为allToSingle该字段有值 表示告警聚合窗口的周期长度以及周期单位。', - 'description' => 'The extended information about event generation. If eventTransferType is set to allToSingle, the value of this parameter indicates the length and unit of the alert aggregation window.'."\n", + .'- hcloud: Huawei Cloud.', 'type' => 'string', - 'required' => false, - 'example' => '{"time":"1","unit":"MINUTE"}', - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', + 'required' => true, + 'enumValueTitles' => [], + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management hub of threat analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<CloudSiemCustomizeRule>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<ListDataSourceLogsResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'Id' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the custom rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '自定义规则创建时间。', - 'description' => 'The time when the custom rule was created.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '自定义规则最后更新时间。', - 'description' => 'The time when the custom rule was last updated.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => 'siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'RuleName' => [ - 'title' => '规则名称。', - 'description' => 'The name of the rule.'."\n", - 'type' => 'string', - 'example' => 'waf_scan', - ], - 'RuleDesc' => [ - 'title' => '规则描述。', - 'description' => 'The description of the rule.'."\n", - 'type' => 'string', - 'example' => 'this rule is for waf scan', - ], - 'RuleType' => [ - 'title' => '规则类型。 取值：'."\n" - .'- predefine：预定义'."\n" - .'- customize：自定义', - 'description' => 'The type of the rule. Valid values:'."\n" - ."\n" - .'* predefine'."\n" - .'* customize'."\n", - 'type' => 'string', - 'example' => 'customize', + 'SubUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to which the log belongs.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'], + 'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. This ID is an MD5 hash value that is calculated by threat analysis based on specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + 'DataSourceInstanceName' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'example' => 'waf kafka'], + 'DataSourceInstanceRemark' => ['title' => '', 'description' => 'The remarks on the data source.', 'type' => 'string', 'example' => 'waf kafka'], + 'DataSourceInstanceLogs' => [ + 'title' => '', + 'description' => 'The list of logs for the data source.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. This ID is an MD5 hash value that is calculated by threat analysis based on specific parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + 'LogCode' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'example' => 'cloud_siem_waf_xxxxx'], + 'LogMdsCode' => ['title' => '', 'description' => 'The display code of the log.', 'type' => 'string', 'example' => '${siem.prod.cloud_siem_waf_xxxxx}'], + 'LogParams' => [ + 'title' => '', + 'description' => 'The detailed parameters for the log.', + 'type' => 'array', + 'items' => [ + 'description' => 'The log parameter.', + 'type' => 'object', + 'properties' => [ + 'ParaCode' => ['title' => '', 'description' => 'The code of the log parameter.', 'type' => 'string', 'example' => 'region_code'], + 'ParaValue' => ['title' => '', 'description' => 'The value of the log parameter.', 'type' => 'string', 'example' => 'ap-guangzhou'], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + 'TaskStatus' => ['title' => '', 'description' => 'The status of the log collection task. Valid values:'."\n" + ."\n" + .'- 1: collected.'."\n" + ."\n" + .'- 0: not collected.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '', ], - 'ThreatLevel' => [ - 'title' => '威胁等级。取值：'."\n" - .'- serious：高危'."\n" - .'- suspicious：中危'."\n" - .'- remind：低危', - 'description' => 'The risk level. Valid values:'."\n" + 'AccountId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'example' => '123xxxxxxx'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code for the cloud service provider. Valid values:'."\n" ."\n" - .'* serious: high'."\n" - .'* suspicious: medium'."\n" - .'* remind: low'."\n", - 'type' => 'string', - 'example' => 'remind', - ], - 'AlertType' => [ - 'title' => '威胁类型。', - 'description' => 'The risk type.'."\n", - 'type' => 'string', - 'example' => 'WEBSHELL', - ], - 'AlertTypeMds' => [ - 'title' => '威胁类型美杜莎code。', - 'description' => 'The internal code of the risk type.'."\n", - 'type' => 'string', - 'example' => '${siem_rule_type_process_abnormal_command}', - ], - 'LogType' => [ - 'title' => '规则对应的日志类型。', - 'description' => 'The log type of the rule.'."\n", - 'type' => 'string', - 'example' => 'ALERT_ACTIVITY', - ], - 'LogTypeMds' => [ - 'title' => '规则对应的日志类型美杜莎code。', - 'description' => 'The internal code of the log type.'."\n", - 'type' => 'string', - 'example' => '${security_event_config.event_name.webshellName_clientav}', - ], - 'LogSource' => [ - 'title' => '规则对应的日志源。', - 'description' => 'The log source of the rule.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_aegis_sas_alert', - ], - 'LogSourceMds' => [ - 'title' => '规则对应的日志源美杜莎code。', - 'description' => 'The internal code of the log source.'."\n", - 'type' => 'string', - 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}', - ], - 'RuleCondition' => [ - 'title' => '规则查询条件json(需要对html转义字符进行反向转义)。', - 'description' => 'The query condition of the rule. The value is in the JSON format. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]', - ], - 'RuleGroup' => [ - 'title' => '日志聚合字段,json数组格式(需要对html转义字符进行反向转义)。', - 'description' => 'The log aggregation field of the rule. The value is a JSON string. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '["asset_id"]', - ], - 'RuleThreshold' => [ - 'title' => '规则阈值配置json(需要对html转义字符进行反向转义)。', - 'description' => 'The threshold configuration of the rule. The value is in the JSON format. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}', - ], - 'QueryCycle' => [ - 'title' => '规则窗口长度(需要对html转义字符进行反向转义)。', - 'description' => 'The window length of the rule. The HTML escape characters are reversed.'."\n", - 'type' => 'string', - 'example' => '{"time":"1","unit":"HOUR"}', - ], - 'AttCk' => [ - 'title' => '告警附加字段attck', - 'description' => '告警附加字段attck', - 'type' => 'string', - 'example' => 'T1595.002 Vulnerability Scanning', - ], - 'EventTransferSwitch' => [ - 'title' => '告警是否转换事件开关。 取值：'."\n" - .'- 0：不转换'."\n" - .'- 1：转换', - 'description' => 'Indicates whether the system generates an event for the alert. Valid values:'."\n" + .'- qcloud: Tencent Cloud.'."\n" ."\n" - .'* 0: no'."\n" - .'* 1: yes'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'EventTransferType' => [ - 'title' => '事件生成方式。 取值：'."\n" - .'- default:默认内置方式'."\n" - .'- singleToSingle：每个告警生成一个事件'."\n" - .'- allToSingle：周期内告警生成一个事件', - 'description' => 'The event generation method. Valid values:'."\n" + .'- aliyun: Alibaba Cloud.'."\n" ."\n" - .'* default: The default method is used.'."\n" - .'* singleToSingle: The system generates an event for each alert.'."\n" - .'* allToSingle: The system generates an event for alerts within a period of time.'."\n", - 'type' => 'string', - 'example' => 'allToSingle', - ], - 'EventTransferExt' => [ - 'title' => '事件生成扩展信息 当eventTransferType值为allToSingle该字段有值 表示告警聚合窗口的周期长度以及周期单位(需要对html转义字符进行反向转义)。', - 'description' => 'The extended information about event generation. If eventTransferType is set to allToSingle, the value of this parameter indicates the length and unit of the alert aggregation window. The HTML escape characters are reversed.'."\n", + .'- hcloud: Huawei Cloud', 'type' => 'string', - 'example' => '{"time":"1","unit":"MINUTE"}', - ], - 'Status' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：初始状态'."\n" - .'- 10：模拟数据测试'."\n" - .'- 15：业务数据测试中'."\n" - .'- 20：业务数据测试结束'."\n" - .'- 100：规则上线', - 'description' => 'The rule status. Valid values:'."\n" - ."\n" - .'* 0: The rule is in the initial state.'."\n" - .'* 10: The simulation data is tested.'."\n" - .'* 15: The business data is being tested.'."\n" - .'* 20: The business data test ends.'."\n" - .'* 100: The rule takes effect.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'DataType' => [ - 'description' => '自动化响应规则条件字段数据类型。', - 'type' => 'integer', - 'format' => 'int32', - 'example' => 'varchar', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'CloudSiemCustomizeRuleUpdateExcepiton', - 'errorMessage' => 'this customize rule can only update in init status.', - ], - [ - 'errorCode' => 'CloudSiemCustomizeRuleConditionExceedExcepiton', - 'errorMessage' => 'the number of rule conditions cannot exceed 100.', - ], - [ - 'errorCode' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', - 'errorMessage' => 'the rule name is duplicated.', - ], - ], 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"RuleName\\": \\"waf_scan\\",\\n \\"RuleDesc\\": \\"this rule is for waf scan\\",\\n \\"RuleType\\": \\"customize\\",\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"AlertType\\": \\"WEBSHELL\\",\\n \\"AlertTypeMds\\": \\"${siem_rule_type_process_abnormal_command}\\",\\n \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n \\"LogTypeMds\\": \\"${security_event_config.event_name.webshellName_clientav}\\",\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"LogSourceMds\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}\\",\\n \\"RuleCondition\\": \\"[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]\\",\\n \\"RuleGroup\\": \\"["asset_id"]\\",\\n \\"RuleThreshold\\": \\"{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}\\",\\n \\"QueryCycle\\": \\"{"time":"1","unit":"HOUR"}\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"EventTransferSwitch\\": 1,\\n \\"EventTransferType\\": \\"allToSingle\\",\\n \\"EventTransferExt\\": \\"{"time":"1","unit":"MINUTE"}\\",\\n \\"Status\\": 0,\\n \\"DataType\\": 0\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostCustomizeRule', - ], - 'PostCustomizeRuleTest' => [ - 'summary' => 'Submits a custom rule for testing.', - 'methods' => [ - 'get', - 'post', + 'title' => 'ListDataSourceLogs', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceLogs'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataSourceLogs', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"SubUserId\\": 0,\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"DataSourceInstanceName\\": \\"waf kafka\\",\\n \\"DataSourceInstanceRemark\\": \\"waf kafka\\",\\n \\"DataSourceInstanceLogs\\": [\\n {\\n \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\",\\n \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n \\"LogMdsCode\\": \\"${siem.prod.cloud_siem_waf_xxxxx}\\",\\n \\"LogParams\\": [\\n {\\n \\"ParaCode\\": \\"region_code\\",\\n \\"ParaValue\\": \\"ap-guangzhou\\"\\n }\\n ],\\n \\"TaskStatus\\": 1\\n }\\n ],\\n \\"AccountId\\": \\"123xxxxxxx\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListDataSourceTypes' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Id', - 'in' => 'formData', - 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', - ], - ], - [ - 'name' => 'TestType', - 'in' => 'formData', - 'schema' => [ - 'title' => '测试类型。 取值：'."\n" - .'- simulate：模拟数据测试'."\n" - .'- business：业务数据测试'."\n" - .'- 15：业务数据测试中', - 'description' => 'The test type. Valid values:'."\n" - ."\n" - .'* simulate: simulation data test'."\n" - .'* business: business data test'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'simulate', - ], - ], - [ - 'name' => 'SimulatedData', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '模拟测试数据 只有在测试类型为simulate情况下赋值。', - 'description' => 'The simulation data for the test. This parameter is available only when TestType is set to simulate.'."\n", + 'title' => '', + 'description' => 'The code of the multicloud service.', 'type' => 'string', - 'required' => false, - 'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]', - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', + 'required' => true, + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region of the management center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListDataSourceTypesResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'any', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'DataSourceType' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- obs: Huawei Cloud OBS.'."\n" + ."\n" + .'- wafApi: Tencent Cloud WAF download API.'."\n" + ."\n" + .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'example' => 'obs'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The code of the multicloud service.', + 'type' => 'string', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IllegalParameter', 'errorMessage' => 'The specified parameter %s is not valid, only support %s', 'description' => ''], + ], 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListDataSourceTypes', + 'summary' => 'Lists the types of multicloud data sources that Threat Analysis supports.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceTypes'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataSourceTypes', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostCustomizeRuleTest', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"DataSourceType\\": \\"obs\\",\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'PostFinishCustomizeRuleTest' => [ - 'summary' => 'Ends the test of a custom rule.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - 'http', - ], + 'ListDelivery' => [ + 'summary' => 'Lists the products and logs that are connected to threat analysis for an enterprise or a member, and the data shipping status of these logs.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -14404,3905 +9449,2723 @@ ], 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', - 'riskType' => 'none', - 'chargeType' => 'free', + 'operationType' => 'list', + 'abilityTreeCode' => '155305', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ - 'name' => 'Id', - 'in' => 'formData', - 'schema' => [ - 'title' => '自定义规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123456789', - ], - ], - [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: The view for the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view for all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The Alibaba Cloud account ID of a member. An administrator can use this parameter to view data from the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the data management center for threat analysis. Select the region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Select this value if your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemResponse<CloudSiemAnalyzeResponse>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'any', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'title' => '', + 'description' => 'The returned data.', + 'type' => 'object', + 'properties' => [ + 'ProjectName' => ['title' => '', 'description' => 'The name of your Simple Log Service (SLS) project for threat analysis. The format is \\`aliyun-cloudsiem-data-${aliUid}-${region}\\`.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-127608589417****-cn-shanghai'], + 'LogStoreName' => ['title' => '', 'description' => 'The name of your LogStore for threat analysis. The format is \\`cloud\\_siem\\`.', 'type' => 'string', 'example' => 'cloud-siem'], + 'SearchUrl' => ['title' => '', 'description' => 'The URL of the Search & Analysis page in the SLS console.', 'type' => 'string', 'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n" + .'/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true'], + 'DashboardUrl' => ['title' => '', 'description' => 'The URL of the dashboard on the log analysis page.', 'type' => 'string', 'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n" + .'/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true'], + 'DisplaySwitchOrNot' => ['title' => '', 'description' => 'Indicates whether to display the delivery switch. The default value is true. Valid values:'."\n" + ."\n" + .'- true: The delivery switch is displayed.'."\n" + ."\n" + .'- false: The delivery switch is hidden.', 'type' => 'boolean', 'example' => 'true'], + 'ProductList' => [ + 'title' => '', + 'description' => 'A list of products.', + 'type' => 'array', + 'items' => [ + 'description' => 'The products that are connected.', + 'type' => 'object', + 'properties' => [ + 'ProductCode' => ['title' => '', 'description' => 'The code of the cloud product. Valid values:'."\n" + ."\n" + .'- qcloud\\_waf'."\n" + ."\n" + .'- qcloud\\_cfw'."\n" + ."\n" + .'- hcloud\\_waf'."\n" + ."\n" + .'- hcloud\\_cfw'."\n" + ."\n" + .'- ddos'."\n" + ."\n" + .'- sas'."\n" + ."\n" + .'- cfw'."\n" + ."\n" + .'- config'."\n" + ."\n" + .'- csk'."\n" + ."\n" + .'- fc'."\n" + ."\n" + .'- rds'."\n" + ."\n" + .'- nas'."\n" + ."\n" + .'- apigateway'."\n" + ."\n" + .'- cdn'."\n" + ."\n" + .'- mongodb'."\n" + ."\n" + .'- eip'."\n" + ."\n" + .'- slb'."\n" + ."\n" + .'- vpc'."\n" + ."\n" + .'- actiontrail'."\n" + ."\n" + .'- waf'."\n" + ."\n" + .'- bastionhost'."\n" + ."\n" + .'- oss'."\n" + ."\n" + .'- polardb', 'type' => 'string', 'example' => 'sas'], + 'ProductName' => ['title' => '', 'description' => 'This parameter is deprecated. You can ignore it.', 'type' => 'string', 'example' => 'Security Center'], + 'LogMap' => [ + 'title' => '', + 'description' => 'A list of logs that are categorized. For example, Security Center logs are categorized into groups such as Host and Network. The group is the key, and the logs in the group are the value.', + 'type' => 'object', + 'additionalProperties' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'LogCode' => ['title' => '', 'type' => 'string', 'description' => 'The code of the log.'."\n", 'example' => 'cloud_siem_config_log'], + 'LogName' => ['title' => '', 'type' => 'string', 'description' => 'This parameter is deprecated.'."\n", 'example' => 'audit log'], + 'LogNameEn' => ['title' => '', 'type' => 'string', 'description' => 'This parameter is deprecated.'."\n", 'example' => 'audit log'], + 'LogNameKey' => ['title' => '', 'type' => 'string', 'description' => 'The language code of the log that is used to indicate the language in which the log is displayed.'."\n", 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}'], + 'Status' => ['title' => '', 'type' => 'boolean', 'description' => 'The status of the log delivery. Valid values:'."\n" + ."\n" + .'* true: The logs are being delivered.'."\n" + .'* false: The log delivery feature is disabled.'."\n", 'example' => 'true'], + 'CanOperateOrNot' => ['title' => '', 'type' => 'boolean', 'description' => 'Indicates whether the log delivery feature can be enabled or disabled. The feature can be enabled or disabled only by the administrator of the threat analysis feature. Valid values:'."\n" + ."\n" + .'* true'."\n" + .'* false'."\n", 'example' => 'true'], + 'Topic' => ['title' => '', 'type' => 'string', 'description' => 'The topic of the log in the Logstore. The value is an index field in the Logstore that can be used to distinguish different logs.'."\n", 'example' => 'sas_login_event'], + 'ExtraParameters' => [ + 'title' => '', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Key' => ['type' => 'string', 'description' => 'The ID of the extended parameter.'."\n", 'title' => '', 'example' => 'flag'], + 'Value' => ['type' => 'string', 'description' => 'The value of the extended parameter.'."\n", 'title' => '', 'example' => 'value'], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'description' => 'The extended parameter.'."\n", + 'example' => '', + ], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'description' => 'A list of logs in the group.', + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + 'LogList' => [ + 'title' => '', + 'description' => 'A list of logs for cloud products that do not have subcategories.', + 'type' => 'array', + 'items' => [ + 'description' => 'The details of the log.', + 'type' => 'object', + 'properties' => [ + 'LogCode' => ['title' => '', 'description' => 'The log code.', 'type' => 'string', 'example' => 'cloud_siem_config_log'], + 'LogName' => ['title' => '', 'description' => 'This parameter is deprecated. You can ignore it.', 'type' => 'string', 'example' => 'audit log'], + 'LogNameEn' => ['title' => '', 'description' => 'This parameter is deprecated. You can ignore it.', 'type' => 'string', 'example' => 'audit log'."\n"], + 'LogNameKey' => ['title' => '', 'description' => 'The language key of the log name. This key is used to display the log name in different languages.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}'], + 'Status' => ['title' => '', 'description' => 'The log delivery status. Valid values:'."\n" + ."\n" + .'- true: Delivery is in progress.'."\n" + ."\n" + .'- false: Delivery is disabled.', 'type' => 'boolean', 'example' => 'true'], + 'CanOperateOrNot' => ['title' => '', 'description' => 'Indicates whether the log delivery switch can be operated. Only the delegated administrator for threat analysis can operate the switch. Valid values:'."\n" + ."\n" + .'- true: The switch can be operated.'."\n" + ."\n" + .'- false: The switch cannot be operated.', 'type' => 'boolean', 'example' => 'true'], + 'Topic' => ['title' => '', 'description' => 'The topic of the log in the LogStore. This parameter is an index field in the LogStore and is used to differentiate logs.', 'type' => 'string', 'example' => 'sas_login_event'], + 'ExtraParameters' => [ + 'title' => '', + 'description' => 'Additional parameters.', + 'type' => 'array', + 'items' => [ + 'description' => 'The additional parameters for the log description.', + 'type' => 'object', + 'properties' => [ + 'Key' => ['description' => 'The key of the additional parameter.', 'type' => 'string', 'title' => '', 'example' => 'flag'], + 'Value' => ['description' => 'The value of the additional parameter.', 'type' => 'string', 'title' => '', 'example' => 'value'], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + ], + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-58D4-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ['errorCode' => 'SLS.Sls4Service.Error', 'errorMessage' => 'The Simple Log Service about embedding console pages is unavailable.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'ListDelivery', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostFinishCustomizeRuleTest', - ], - 'PostRuleStatusChange' => [ - 'summary' => 'Updates the status of a custom rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDelivery'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDelivery', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"ProjectName\\": \\"aliyun-cloudsiem-data-127608589417****-cn-shanghai\\",\\n \\"LogStoreName\\": \\"cloud-siem\\",\\n \\"SearchUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n \\"DashboardUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n \\"DisplaySwitchOrNot\\": true,\\n \\"ProductList\\": [\\n {\\n \\"ProductCode\\": \\"sas\\",\\n \\"ProductName\\": \\"Security Center\\",\\n \\"LogMap\\": {\\n \\"key\\": [\\n {\\n \\"LogCode\\": \\"cloud_siem_config_log\\",\\n \\"LogName\\": \\"audit log\\",\\n \\"LogNameEn\\": \\"audit log\\",\\n \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n \\"Status\\": true,\\n \\"CanOperateOrNot\\": true,\\n \\"Topic\\": \\"sas_login_event\\",\\n \\"ExtraParameters\\": [\\n {\\n \\"Key\\": \\"flag\\",\\n \\"Value\\": \\"value\\"\\n }\\n ]\\n }\\n ]\\n },\\n \\"LogList\\": [\\n {\\n \\"LogCode\\": \\"cloud_siem_config_log\\",\\n \\"LogName\\": \\"audit log\\",\\n \\"LogNameEn\\": \\"audit log\\\\n\\",\\n \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n \\"Status\\": true,\\n \\"CanOperateOrNot\\": true,\\n \\"Topic\\": \\"sas_login_event\\",\\n \\"ExtraParameters\\": [\\n {\\n \\"Key\\": \\"flag\\",\\n \\"Value\\": \\"value\\"\\n }\\n ]\\n }\\n ]\\n }\\n ]\\n },\\n \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListDisposeStrategy' => [ + 'summary' => 'Retrieve a list of system-recommended disposal strategies.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ - 'name' => 'Ids', + 'name' => 'SophonTaskId', 'in' => 'formData', - 'schema' => [ - 'title' => '规则id列表 json数组格式。', - 'description' => 'The rule IDs. The value is a JSON array.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[123,345]', - ], + 'schema' => ['description' => 'ID of the security orchestration and automated response disposal strategy.', 'type' => 'string', 'example' => 'a50a49b7-6044-4593-ab15-2b46567c****', 'title' => '', 'required' => false], ], [ - 'name' => 'RuleType', + 'name' => 'EntityIdentity', 'in' => 'formData', - 'schema' => [ - 'title' => '规则类型。 取值：'."\n" - .'- predefine：预定义'."\n" - .'- customize：自定义', - 'description' => 'The type of the rule. Valid values:'."\n" - ."\n" - .'* predefine'."\n" - .'* customize'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'customize', - ], + 'schema' => ['description' => 'Entity feature value. Use this to perform a fuzzy search on entities.', 'type' => 'string', 'example' => 'test22.php', 'title' => '', 'required' => false], ], [ - 'name' => 'InUse', + 'name' => 'EntityType', 'in' => 'formData', - 'schema' => [ - 'title' => '规则开启状态。 取值：'."\n" - .'- true：开启'."\n" - .'- false：关闭', - 'description' => 'Specifies whether to enable the rule. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], + 'schema' => ['description' => 'Entity type. Valid values:'."\n" + ."\n" + .'- ip'."\n" + ."\n" + .'- process'."\n" + ."\n" + .'- file', 'type' => 'string', 'example' => 'ip', 'title' => '', 'required' => false], + ], + [ + 'name' => 'PlaybookName', + 'in' => 'formData', + 'schema' => ['description' => 'Unique name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP', 'title' => '', 'required' => false], + ], + [ + 'name' => 'PlaybookUuid', + 'in' => 'formData', + 'schema' => ['description' => 'UUID of the playbook.', 'type' => 'string', 'example' => 'system_aliyun_clb_process_book', 'title' => '', 'required' => false], + ], + [ + 'name' => 'PlaybookTypes', + 'in' => 'formData', + 'schema' => ['description' => 'Playbook type. Valid values:'."\n" + ."\n" + .'- system: manual disposal'."\n" + ."\n" + .'- custom: event-triggered playbook'."\n" + ."\n" + .'- custom\\_alert: alert-triggered playbook'."\n" + ."\n" + .'- soar-manual: manually run playbook'."\n" + ."\n" + .'- soar-mdr: MDR-run playbook', 'type' => 'string', 'example' => 'system', 'title' => '', 'required' => false], + ], + [ + 'name' => 'EffectiveStatus', + 'in' => 'formData', + 'schema' => ['description' => 'Strategy status. Valid values:'."\n" + ."\n" + .'- 0: disabled'."\n" + ."\n" + .'- 1: enabled', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => '', 'required' => false], + ], + [ + 'name' => 'OrderField', + 'in' => 'formData', + 'schema' => ['description' => 'Sort field. Valid values:'."\n" + ."\n" + .'- GmtModified: sort by last modified time'."\n" + ."\n" + .'- GmtCreate: sort by creation time'."\n" + ."\n" + .'- FinishTime: sort by strategy end time', 'type' => 'string', 'example' => 'GmtModified', 'title' => '', 'required' => false], + ], + [ + 'name' => 'Order', + 'in' => 'formData', + 'schema' => ['description' => 'Sort order. Valid values:'."\n" + ."\n" + .'- desc: descending'."\n" + ."\n" + .'- asc: ascending', 'type' => 'string', 'example' => 'desc', 'title' => '', 'required' => false], + ], + [ + 'name' => 'StartTime', + 'in' => 'formData', + 'schema' => ['description' => 'Start time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000', 'title' => ''], + ], + [ + 'name' => 'EndTime', + 'in' => 'formData', + 'schema' => ['description' => 'End time of the query, in milliseconds.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '1577808000000', 'title' => ''], + ], + [ + 'name' => 'Status', + 'in' => 'formData', + 'schema' => ['description' => 'Disposal strategy status.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '200', 'title' => ''], + ], + [ + 'name' => 'CurrentPage', + 'in' => 'formData', + 'schema' => ['description' => 'Current page number. Must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['description' => 'Number of entries per page. Maximum value is 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'View type. Valid values:'."\n" + ."\n" + .'- 0: view for the current Alibaba Cloud account'."\n" + ."\n" + .'- 1: view for all accounts under the enterprise', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'Alibaba Cloud account ID when an administrator switches to another member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'Location of the Data Management center for Threat Analysis and Response. Select the location based on where your assets are deployed. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: assets in the Chinese mainland or Hong Kong (China)'."\n" + ."\n" + .'- ap-southeast-1: assets outside China', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], + ], + [ + 'name' => 'IncidentUuid', + 'in' => 'formData', + 'schema' => ['description' => 'Event ID.', 'type' => 'string', 'required' => false, 'example' => '49670d3bbf7aa9556a2fff3dbaa9****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => 'BaseResponse'."\n", + 'title' => 'PageResponse<List<DisposeStrategy>>', + 'description' => 'PageResponse\\<List\\<disposestrategy>>', 'type' => 'object', 'properties' => [ + 'Success' => ['description' => 'Indicates whether the request succeeded. Valid values:'."\n" + ."\n" + .'- true'."\n" + ."\n" + .'- false', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Code' => ['description' => 'HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''], + 'Message' => ['description' => 'Response message.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'RequestId' => ['description' => 'Request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'any', + 'title' => '', + 'description' => 'Response data.', + 'type' => 'object', + 'properties' => [ + 'PageInfo' => [ + 'title' => '', + 'description' => 'Paging information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['description' => 'Current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'Number of entries returned per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'Total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''], + ], + 'example' => '', + ], + 'ResponseData' => [ + 'title' => '', + 'description' => 'Detailed data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Id' => ['description' => 'Strategy ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123', 'title' => ''], + 'GmtCreate' => ['description' => 'Creation time.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'GmtModified' => ['description' => 'Last modified time.', 'type' => 'string', 'example' => '2021-01-06 16:37:29', 'title' => ''], + 'Aliuid' => ['description' => 'SIEM root account ID associated with the strategy.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****', 'title' => ''], + 'SubAliuid' => ['description' => 'The Alibaba Cloud account ID associated with the configuration policy.', 'type' => 'integer', 'format' => 'int64', 'example' => '176555323***', 'title' => ''], + 'IncidentName' => ['description' => 'Event name.', 'type' => 'string', 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', 'title' => ''], + 'Scope' => [ + 'title' => '', + 'description' => 'Disposal scope.', + 'type' => 'array', + 'items' => ['description' => 'Disposal scope.', 'type' => 'any', 'example' => '[{ aliUid: 176618589410**** }]', 'title' => ''], + 'example' => '[{ aliUid: 1766185894104675 }]', + ], + 'IncidentUuid' => ['description' => 'Global unique UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''], + 'AlertUuid' => ['description' => 'Alert UUID.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''], + 'SophonTaskId' => ['description' => 'ID of the security orchestration and automated response disposal strategy.', 'type' => 'string', 'example' => '577bbf90-a770-44a7-8154-586aa2d3****', 'title' => ''], + 'PlaybookName' => ['description' => 'Unique name of the playbook.', 'type' => 'string', 'example' => 'WafBlockIP', 'title' => ''], + 'PlaybookUuid' => ['description' => 'UUID of the playbook.', 'type' => 'string', 'example' => 'system_aliyun_clb_process_book', 'title' => ''], + 'PlaybookType' => ['description' => 'Playbook type. Valid values:'."\n" + ."\n" + .'- system: manual disposal'."\n" + ."\n" + .'- custom: event-triggered playbook'."\n" + ."\n" + .'- custom\\_alert: alert-triggered playbook'."\n" + ."\n" + .'- soar-manual: manually run playbook'."\n" + ."\n" + .'- soar-mdr: MDR-run playbook', 'type' => 'string', 'example' => 'system', 'title' => ''], + 'TaskUrl' => ['description' => 'Playbook URL.', 'type' => 'string', 'title' => '', 'example' => '{"playbookUuid":"system_aliyun_aegis_stop_container_book","requestUuid":"e8924356-448b-4301-aee9-*******"}'], + 'EntityId' => ['description' => 'Entity ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789', 'title' => ''], + 'Entity' => [ + 'title' => '', + 'description' => 'Entity details in JSON array format.', + 'type' => 'array', + 'items' => ['description' => 'Entity details in JSON array format.', 'type' => 'any', 'example' => '[{"ip":"1.1.XX.XX"}]', 'title' => ''], + 'example' => '[{"ip":"1.1.1.1"}]', + ], + 'EntityType' => ['description' => 'Entity type. Valid values:'."\n" + ."\n" + .'- ip'."\n" + ."\n" + .'- process'."\n" + ."\n" + .'- file', 'type' => 'string', 'example' => 'ip', 'title' => ''], + 'TaskParam' => ['description' => 'Parameters used to trigger the playbook, in JSON format.', 'type' => 'string', 'example' => '{'."\n" + .' "file": {'."\n" + .' "op_code": "2",'."\n" + .' "file_path": "/root/alert0913/a886.jsp",'."\n" + .' "entity_type": "file",'."\n" + .' "entity_name": "a886.jsp",'."\n" + .' "file_name": "a886.jsp",'."\n" + .' "file_owner": "USER:,GROUP:",'."\n" + .' "hash_value": "5def10c9a4287d0920d86b42420b20b0",'."\n" + .' "op_level": "2",'."\n" + .' "entity_id": "/root/alert0913/a886.jsp",'."\n" + .' "host_uuid": {'."\n" + .' "entity_type": "host",'."\n" + .' "entity_name": "N/A",'."\n" + .' "is_comprised": "1",'."\n" + .' "os_type": "linux",'."\n" + .' "entity_id": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n" + .' "host_uuid": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n" + .' "host_name": "N/A"'."\n" + .' },'."\n" + .' "malware_type": "${aliyun.siem.sas.alert_tag.webshell}"'."\n" + .' },'."\n" + .' "_sys_siem": {'."\n" + .' "cloudCode": "aliyun",'."\n" + .' "alertId": "89416745494****"'."\n" + .' },'."\n" + .' "scope": ['."\n" + .' {'."\n" + .' "aliUid": 1766185894104****'."\n" + .' }'."\n" + .' ]'."\n" + .'}', 'title' => ''], + 'ErrorMessage' => ['description' => 'Summary of task failure.', 'type' => 'string', 'example' => 'DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found', 'title' => ''], + 'FinishTime' => ['description' => 'Task completion time.', 'type' => 'string', 'example' => '2021-08-10 21:34:07', 'title' => ''], + 'EffectiveStatus' => ['description' => 'Strategy status. Valid values:'."\n" + ."\n" + .'- 0: disabled'."\n" + ."\n" + .'- 1: enabled', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''], + 'Status' => ['description' => 'Playbook invocation status. Valid values:'."\n" + ."\n" + .'- 200: succeeded'."\n" + ."\n" + .'- 10: deleted'."\n" + ."\n" + .'- 5: failed'."\n" + ."\n" + .'- 0: initial state', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'example' => '', + ], + ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"SubAliuid\\": 0,\\n \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"Scope\\": [\\n \\"[{ aliUid: 176618589410**** }]\\"\\n ],\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"SophonTaskId\\": \\"577bbf90-a770-44a7-8154-586aa2d3****\\",\\n \\"PlaybookName\\": \\"WafBlockIP\\",\\n \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\",\\n \\"PlaybookType\\": \\"system\\",\\n \\"TaskUrl\\": \\"{\\\\\\"playbookUuid\\\\\\":\\\\\\"system_aliyun_aegis_stop_container_book\\\\\\",\\\\\\"requestUuid\\\\\\":\\\\\\"e8924356-448b-4301-aee9-*******\\\\\\"}\\",\\n \\"EntityId\\": 123456789,\\n \\"Entity\\": [\\n \\"[{\\\\\\"ip\\\\\\":\\\\\\"1.1.XX.XX\\\\\\"}]\\"\\n ],\\n \\"EntityType\\": \\"ip\\",\\n \\"TaskParam\\": \\"{\\\\n \\\\\\"file\\\\\\": {\\\\n \\\\\\"op_code\\\\\\": \\\\\\"2\\\\\\",\\\\n \\\\\\"file_path\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n \\\\\\"entity_type\\\\\\": \\\\\\"file\\\\\\",\\\\n \\\\\\"entity_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n \\\\\\"file_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n \\\\\\"file_owner\\\\\\": \\\\\\"USER:,GROUP:\\\\\\",\\\\n \\\\\\"hash_value\\\\\\": \\\\\\"5def10c9a4287d0920d86b42420b20b0\\\\\\",\\\\n \\\\\\"op_level\\\\\\": \\\\\\"2\\\\\\",\\\\n \\\\\\"entity_id\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n \\\\\\"host_uuid\\\\\\": {\\\\n \\\\\\"entity_type\\\\\\": \\\\\\"host\\\\\\",\\\\n \\\\\\"entity_name\\\\\\": \\\\\\"N/A\\\\\\",\\\\n \\\\\\"is_comprised\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"os_type\\\\\\": \\\\\\"linux\\\\\\",\\\\n \\\\\\"entity_id\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n \\\\\\"host_uuid\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n \\\\\\"host_name\\\\\\": \\\\\\"N/A\\\\\\"\\\\n },\\\\n \\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\"\\\\n },\\\\n \\\\\\"_sys_siem\\\\\\": {\\\\n \\\\\\"cloudCode\\\\\\": \\\\\\"aliyun\\\\\\",\\\\n \\\\\\"alertId\\\\\\": \\\\\\"89416745494****\\\\\\"\\\\n },\\\\n \\\\\\"scope\\\\\\": [\\\\n {\\\\n \\\\\\"aliUid\\\\\\": 1766185894104****\\\\n }\\\\n ]\\\\n}\\",\\n \\"ErrorMessage\\": \\"DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found\\",\\n \\"FinishTime\\": \\"2021-08-10 21:34:07\\",\\n \\"EffectiveStatus\\": 0,\\n \\"Status\\": 10\\n }\\n ]\\n }\\n}","type":"json"}]', + 'title' => 'ListDisposeStrategy', + 'changeSet' => [ + ['createdAt' => '2024-12-23T09:00:54.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-09-26T11:11:01.000Z', 'description' => 'Request parameters changed, Response parameters changed'], + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostRuleStatusChange', - ], - 'DescribeScopeUsers' => [ - 'summary' => 'Queries the list of users in the playbook scope.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDisposeStrategy'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDisposeStrategy', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'ListEntities' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ + 'name' => 'IncidentUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The incident ID.', 'type' => 'string', 'required' => true, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + ], + [ + 'name' => 'EntityType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n" + .'- ip: IP address'."\n" + .'- domain: domain name'."\n" + .'- url: URL'."\n" + .'- process: process'."\n" + .'- file: file'."\n" + .'- host: host'."\n" + .'- cloud_account: cloud account'."\n" + .'- container: container'."\n" + .'- bucket: Object Storage Service (OSS) bucket.', 'type' => 'string', 'example' => 'ip', 'required' => false], + ], + [ + 'name' => 'EntityName', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The entity name.', 'type' => 'string', 'example' => 'host1****', 'required' => false], + ], + [ + 'name' => 'EntityUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****', 'required' => false], + ], + [ + 'name' => 'EntityUuids', + 'in' => 'formData', + 'schema' => ['description' => 'The list of entity UUIDs.', 'type' => 'string', 'required' => false, 'example' => '6c740667-80b2-476d-8924-2e706feb****,6c740667-80b2-476d-8924-2e706feb****', 'title' => ''], + ], + [ + 'name' => 'MalwareType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The malicious entity type.', 'type' => 'string', 'example' => 'aliyun.siem.sas.alert_tag.miner_software', 'required' => false], + ], + [ + 'name' => 'IsMalwareEntity', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'Specifies whether the entity is malicious. Valid values:'."\n" + .'- 0: No.'."\n" + .'- 1: Yes.', 'type' => 'string', 'example' => '1', 'required' => false], + ], + [ + 'name' => 'Tags', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The entity tags. The value is a JSON array string:'."\n" + ."\n" + .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`.', 'type' => 'string', 'required' => false, 'example' => '[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]'], + ], + [ + 'name' => 'CurrentPage', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The page number of the current page. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1'], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The number of entries per page. Maximum value: 100.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10'], + ], + [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region in which the data management center of the threat analysis feature resides. Select the region based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: the assets reside in the Chinese mainland or Hong Kong (China).'."\n" + .'- ap-southeast-1: the assets reside in regions outside China.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<SoarScope>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => '', + 'description' => 'PageResponse<List<EntityInfo>>', 'type' => 'object', 'properties' => [ + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + .'- true: successful.'."\n" + .'- false: failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The response message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'AliUid' => [ - 'title' => 'siem用户ID。', - 'description' => 'The ID of the security information and event management (SIEM) user.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789****', - ], - 'UserName' => [ - 'title' => '用户名。', - 'description' => 'The username.'."\n", - 'type' => 'string', - 'example' => 'test001', - ], - 'UserId' => [ - 'title' => '多云用户ID。', - 'description' => '多云用户ID。', - 'type' => 'string', - 'example' => '123456789****', - ], - 'CloudCode' => [ - 'title' => '云code。 取值：'."\n" - .'- qcloud：腾讯云'."\n" - .'- hcloud：华为云', - 'description' => '云code。 取值：'."\n" - .'- qcloud：腾讯云'."\n" - .'- hcloud：华为云', - 'type' => 'string', - 'example' => 'qcloud', - ], - 'InstanceId' => [ - 'title' => 'waf实例ID。', - 'description' => 'The ID of the Web Application Firewall (WAF) instance.'."\n", - 'type' => 'string', - 'example' => 'waf-cn-tl123ast****', + 'title' => '', + 'description' => 'The response data.', + 'type' => 'object', + 'properties' => [ + 'PageInfo' => [ + 'title' => '', + 'description' => 'The pagination information.', + 'type' => 'object', + 'properties' => [ + 'CurrentPage' => ['title' => '', 'description' => 'The page number of the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'PageSize' => ['title' => '', 'description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], + 'TotalCount' => ['title' => '', 'description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int64', 'example' => '100'], ], - 'Domains' => [ - 'title' => 'waf实例下的防护的域名列表。', - 'description' => 'An array consisting of the domain names that are protected by the WAF instance.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The domain name that is protected by the WAF instance.'."\n", - 'type' => 'string', - 'example' => '[123***.com, 456***.com]', + 'example' => '', + ], + 'ResponseData' => [ + 'title' => '', + 'description' => 'The detailed data.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'Id' => ['title' => '', 'description' => 'The entity ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789***'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the entity was collected.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the entity was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The Alibaba Cloud account ID.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789****'], + 'IncidentUuid' => ['title' => '', 'description' => 'The incident UUID. You can obtain this value from the incident list operation.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + 'AlertUuid' => ['title' => '', 'description' => 'The alert UUID.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****'], + 'AlertNum' => ['title' => '', 'description' => 'The number of alerts associated with the entity.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'EventNum' => ['title' => '', 'description' => 'The number of events associated with the entity.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'CloudCode' => ['title' => '', 'description' => 'The code of the cloud service provider from which the entity originates. Valid values:'."\n" + .'- aliyun: Alibaba Cloud'."\n" + .'- qcloud: Tencent Cloud'."\n" + .'- hcloud: Huawei Cloud.', 'type' => 'string', 'example' => 'aliyun'], + 'EntityType' => ['title' => '', 'description' => 'The entity type. Valid values:'."\n" + .'- ip: IP address'."\n" + .'- domain: domain name'."\n" + .'- url: URL'."\n" + .'- process: process'."\n" + .'- file: file'."\n" + .'- host: host'."\n" + .'- cloud_account: cloud account'."\n" + .'- container: container'."\n" + .'- bucket: Object Storage Service (OSS) bucket.', 'type' => 'string', 'example' => 'ip'], + 'EntityName' => ['title' => '', 'description' => 'The entity name.', 'type' => 'string', 'example' => '123.123.123.123'], + 'EntityInfo' => ['title' => '', 'description' => 'The display information of the entity in JSON format.', 'type' => 'string', 'example' => '{"file_path": "c:/www/leixi.jsp","file_hash": "aa0ca926ad948cd820e0a3d9a18c****","host_uuid": "efed2cf7-0b77-45d9-a97b-d2cf246b****","malware_type": "${aliyun.siem.sas.alert_tag.webshell}","host_name": "launch-advisor-2023****"}'], + 'SubUserId' => ['title' => '', 'description' => 'The linked account ID associated with the entity.', 'type' => 'integer', 'format' => 'int64', 'example' => '113091674488****'], + 'EntityId' => ['title' => '', 'description' => 'The logical ID of the entity.', 'type' => 'string', 'example' => '12345****'], + 'EntityUuid' => ['title' => '', 'description' => 'The entity UUID.', 'type' => 'string', 'example' => '8087b3e4aa6862852c100c8738cf****'], + 'MalwareType' => ['title' => '', 'description' => 'The malware type of the entity.', 'type' => 'string', 'example' => 'aliyun.siem.sas.alert_tag.webshell'], + 'IsAsset' => ['description' => 'Indicates whether the entity is an asset. Valid values:'."\n" + .'+ 0: No.'."\n" + .'+ 1: Yes.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'IsMalware' => ['description' => 'Indicates whether the entity is malicious. Valid values:'."\n" + .'+ 0: No.'."\n" + .'+ 1: Yes.', 'type' => 'string', 'example' => '0', 'title' => ''], + 'Tags' => ['description' => 'The entity tags. The value is a JSON array string:'."\n" + ."\n" + .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`.', 'type' => 'string', 'example' => '[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]', 'title' => ''], + 'AgentDisposalMethod' => ['description' => 'The disposal method recommended by the agent.', 'type' => 'string', 'example' => 'delete_file', 'title' => ''], + 'AgentDisposalPlaybookUuid' => ['description' => 'The UUID of the playbook recommended by the agent for disposal.', 'type' => 'string', 'example' => '12XAD-SFQ-WAF-2ca2', 'title' => ''], + 'AgentDisposalSuggestion' => ['description' => 'The disposal suggestion recommended by the agent.', 'type' => 'string', 'example' => '{}', 'title' => ''], + 'AgentConfidence' => ['description' => 'The confidence level of the entity as determined by the agent.', 'type' => 'string', 'example' => '85', 'title' => ''], + 'AgentAnalysisReason' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'AgentDisposes' => [ + 'description' => 'The list of disposal suggestions recommended by the agent.', + 'type' => 'array', + 'items' => [ + 'description' => 'The recommended disposal suggestion.', + 'type' => 'object', + 'properties' => [ + 'AgentDisposalPlaybookUuid' => ['description' => 'The UUID of the playbook recommended by the agent for disposal.', 'type' => 'string', 'example' => '12XAD-SFQ-WAF-2ca2', 'title' => ''], + 'AgentDisposalMethod' => ['description' => 'The disposal suggestion recommended by the agent.', 'type' => 'string', 'example' => '{}', 'title' => ''], + 'AgentDisposalReason' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'AgentDisposalReason' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], ], - 'example' => '[123.com, 456.com]', + 'description' => '', + 'title' => '', + 'example' => '', ], + 'example' => '', ], ], 'example' => '123456', ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Query entity list', + 'summary' => 'Queries a list of entities.', + 'changeSet' => [ + ['createdAt' => '2025-06-18T03:32:30.000Z', 'description' => 'Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AliUid\\": 0,\\n \\"UserName\\": \\"test001\\",\\n \\"UserId\\": \\"123456789****\\",\\n \\"CloudCode\\": \\"qcloud\\",\\n \\"InstanceId\\": \\"waf-cn-tl123ast****\\",\\n \\"Domains\\": [\\n \\"[123***.com, 456***.com]\\"\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeScopeUsers', - ], - 'DeleteAutomateResponseConfig' => [ - 'summary' => 'Deletes the automated response rule with a specified ID.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListEntities'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:ListEntities', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 0,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"AlertNum\\": 1,\\n \\"EventNum\\": 1,\\n \\"CloudCode\\": \\"aliyun\\",\\n \\"EntityType\\": \\"ip\\",\\n \\"EntityName\\": \\"123.123.123.123\\",\\n \\"EntityInfo\\": \\"{\\\\\\"file_path\\\\\\": \\\\\\"c:/www/leixi.jsp\\\\\\",\\\\\\"file_hash\\\\\\": \\\\\\"aa0ca926ad948cd820e0a3d9a18c****\\\\\\",\\\\\\"host_uuid\\\\\\": \\\\\\"efed2cf7-0b77-45d9-a97b-d2cf246b****\\\\\\",\\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\",\\\\\\"host_name\\\\\\": \\\\\\"launch-advisor-2023****\\\\\\"}\\",\\n \\"SubUserId\\": 0,\\n \\"EntityId\\": \\"12345****\\",\\n \\"EntityUuid\\": \\"8087b3e4aa6862852c100c8738cf****\\",\\n \\"MalwareType\\": \\"aliyun.siem.sas.alert_tag.webshell\\",\\n \\"IsAsset\\": \\"1\\",\\n \\"IsMalware\\": \\"0\\",\\n \\"Tags\\": \\"[{\\\\\\"tagKey1\\\\\\":\\\\\\"tagValue1\\\\\\"},{\\\\\\"tagKey2\\\\\\":\\\\\\"tagValue2\\\\\\"}]\\",\\n \\"AgentDisposalMethod\\": \\"delete_file\\",\\n \\"AgentDisposalPlaybookUuid\\": \\"12XAD-SFQ-WAF-2ca2\\",\\n \\"AgentDisposalSuggestion\\": \\"{}\\",\\n \\"AgentConfidence\\": \\"85\\",\\n \\"AgentAnalysisReason\\": \\"\\",\\n \\"AgentDisposes\\": [\\n {\\n \\"AgentDisposalPlaybookUuid\\": \\"12XAD-SFQ-WAF-2ca2\\",\\n \\"AgentDisposalMethod\\": \\"{}\\",\\n \\"AgentDisposalReason\\": \\"\\"\\n }\\n ],\\n \\"AgentDisposalReason\\": \\"\\"\\n }\\n ]\\n }\\n}","type":"json"}]', + ], + 'ListImportedLogsByProd' => [ + 'summary' => 'Queries the log ingestion details for a specific product.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '195548', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'Id', + 'name' => 'ProdCode', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => true, 'example' => 'qcloud_waf'], + ], + [ + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '自动化响应配置规则ID。', - 'description' => 'The ID of the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123', + 'title' => '', + 'description' => 'The multicloud code. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', + 'type' => 'string', + 'required' => true, + 'enumValueTitles' => [], + 'enum' => ['qcloud', 'hcloud', 'aliyun', 'idc'], + 'example' => 'hcloud', ], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID that the administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management hub of threat analysis is deployed. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<String>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListImportedLogsByProdResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'string', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'ProdCode' => ['title' => '', 'description' => 'The code of the product to which the log belongs.', 'type' => 'string', 'example' => 'qcloud_waf'], + 'LogCode' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'example' => 'cloud_siem_waf_xxxxx'], + 'LogMdsCode' => ['title' => '', 'description' => 'The display code of the log.', 'type' => 'string', 'example' => '${siem.prod. cloud_siem_waf_xxxxx}'], + 'ImportedUserCount' => ['title' => '', 'description' => 'The number of users who have ingested the log.', 'type' => 'integer', 'format' => 'int32', 'example' => '2'], + 'UnImportedUserCount' => ['title' => '', 'description' => 'The number of users who have not ingested the log.', 'type' => 'integer', 'format' => 'int32', 'example' => '3'], + 'TotalUserCount' => ['title' => '', 'description' => 'The total number of users for the log.', 'type' => 'integer', 'format' => 'int32', 'example' => '5'], + 'ModifyTime' => ['title' => '', 'description' => 'The time when the log was last ingested.', 'type' => 'string', 'example' => '2023-11-23 12:30:00'], + 'Imported' => ['title' => '', 'description' => 'Indicates whether the log is ingested. Valid values:'."\n" + ."\n" + .'- 1: The log is ingested.'."\n" + ."\n" + .'- 0: The log is not ingested.', 'type' => 'integer', 'format' => 'int32', 'example' => '2023-11-23 12:30:00'], + 'AutoImported' => ['title' => '', 'description' => 'Indicates whether logs are automatically ingested for new accounts. Valid values:'."\n" + ."\n" + .'- 1: Logs are automatically ingested.'."\n" + ."\n" + .'- 0: Logs are not automatically ingested.', 'type' => 'integer', 'format' => 'int32', 'example' => '2023-11-23 12:30:00'], + 'LogType' => ['title' => '日志类型。取值：'."\n" + .' - 1：中心侧接入。 '."\n" + .' - 2：预定义日志服务。 '."\n" + .' -3：自定义日志服务', 'description' => 'The log type. Valid values:'."\n" + ."\n" + .'- 1: Ingested on the threat analysis side.'."\n" + ."\n" + .'- 2: Predefined Simple Log Service log. -3: Custom Simple Log Service log.', 'type' => 'integer', 'format' => 'int32', 'example' => '2023-11-23 12:30:00'], + 'CloudCode' => [ + 'title' => '', + 'description' => 'The multicloud code. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', + 'type' => 'string', + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', + ], + ], + 'title' => '', + 'example' => '', + ], + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListImportedLogsByProd', + 'changeSet' => [ + ['createdAt' => '2024-08-13T11:50:56.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-04-17T12:47:28.000Z', 'description' => 'Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DeleteAutomateResponseConfig', - ], - 'DescribeAutomateResponseConfigCounter' => [ - 'summary' => 'Queries the number of automated response rules.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListImportedLogsByProd'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListImportedLogsByProd', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"ProdCode\\": \\"qcloud_waf\\",\\n \\"LogCode\\": \\"cloud_siem_waf_xxxxx\\",\\n \\"LogMdsCode\\": \\"${siem.prod. cloud_siem_waf_xxxxx}\\",\\n \\"ImportedUserCount\\": 2,\\n \\"UnImportedUserCount\\": 3,\\n \\"TotalUserCount\\": 5,\\n \\"ModifyTime\\": \\"2023-11-23 12:30:00\\",\\n \\"Imported\\": 0,\\n \\"AutoImported\\": 0,\\n \\"LogType\\": 0,\\n \\"CloudCode\\": \\"hcloud\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListProjectLogStores' => [ + 'summary' => 'Queries projects and Logstores based on the name patterns of the default SLS project and Logstore for an Alibaba Cloud service.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'RoleType', + 'name' => 'SourceProdCode', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The code of the product to query.', 'type' => 'string', 'required' => true, 'example' => 'sas'], ], [ - 'name' => 'RoleFor', + 'name' => 'SourceLogCode', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['title' => '', 'description' => 'The code of the log to query.', 'type' => 'string', 'required' => true, 'example' => 'cloud_siem_aegis_proc'], + ], + [ + 'name' => 'SubUserId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account to query.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123XXXXXXXX'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Specify the region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<AutomateResponseCounter>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListProjectLogStoreResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'All' => [ - 'title' => '总规则数。', - 'description' => 'The total number of rules.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '20', - ], - 'Online' => [ - 'title' => '启动规则数。', - 'description' => 'The number of enabled rules.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '10', - ], + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'Project' => ['title' => '', 'description' => 'The name of the SLS project.', 'type' => 'string', 'example' => 'cloud-siem-project'], + 'LogStore' => ['title' => '', 'description' => 'The name of the SLS Logstore.', 'type' => 'string', 'example' => 'cloud-siem-logstore'], + 'EndPoint' => ['title' => '', 'description' => 'The endpoint of the SLS project.', 'type' => 'string', 'example' => 'cn-hangzhou.log.aliyuncs.com'], + 'RegionId' => ['title' => '', 'description' => 'The region where the SLS project resides.', 'type' => 'string', 'example' => 'cn-hangzhou'], + 'LocalName' => ['title' => '', 'description' => 'The name of the region where the SLS project resides.', 'type' => 'string', 'example' => 'hangzhou'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the member account for which threat analysis is performed.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'], + 'SubUserName' => ['title' => '', 'description' => 'The name of the member account.', 'type' => 'string', 'example' => 'sas_account_xxxx'], + ], + 'title' => '', + 'example' => '', ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"All\\": 20,\\n \\"Online\\": 10\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAutomateResponseConfigCounter', - ], - 'DescribeAutomateResponseConfigFeature' => [ - 'summary' => 'Queries the configurable fields and operators of an automated response rule.', - 'methods' => [ - 'get', - 'post', + 'title' => 'ListProjectLogStores', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListProjectLogStores'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListProjectLogStores', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Project\\": \\"cloud-siem-project\\",\\n \\"LogStore\\": \\"cloud-siem-logstore\\",\\n \\"EndPoint\\": \\"cn-hangzhou.log.aliyuncs.com\\",\\n \\"RegionId\\": \\"cn-hangzhou\\",\\n \\"LocalName\\": \\"hangzhou\\",\\n \\"MainUserId\\": 0,\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxxx\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ListRdUsers' => [ + 'summary' => 'Lists the Alibaba Cloud accounts that are managed by the multi-account control feature of Threat Analysis. An account must be managed to use features such as log collection and event handling.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '154081', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'AutoResponseType', - 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应类型。 取值：'."\n" - .'- event：事件'."\n" - .'- alert：告警', - 'description' => 'The type of the automated response rule. Valid values:'."\n" - ."\n" - .'* event'."\n" - .'* alert'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'event', - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], - ], - [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select the region of the Management Center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<AutomateResponseConfigFeature>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<List<ListRdUsersResult>>', + 'description' => 'CloudSiemSuccessResponse\\<List>', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'array', 'items' => [ + 'description' => 'Data Overview.', 'type' => 'object', 'properties' => [ - 'Feature' => [ - 'title' => '自动化响应规则条件字段名称。', - 'description' => 'The name of the condition field in the automated response rule.'."\n", - 'type' => 'string', - 'example' => 'alert_desc', - ], - 'DataType' => [ - 'title' => '自动化响应规则条件字段数据类型。', - 'description' => 'The data type of the condition field in the automated response rule.'."\n", - 'type' => 'string', - 'example' => 'varchar', - ], - 'SupportOperators' => [ - 'title' => '该字段支持的操作符列表', - 'description' => 'The operators that are supported for the condition field.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'HasRightValue' => [ - 'title' => '是否需要右值 取值:'."\n" - .'- 需要：'."\n" - .'- false：不需要。', - 'description' => 'Indicates whether the right operand is required. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'false', - ], - 'Operator' => [ - 'title' => '操作符。', - 'description' => 'The operator.'."\n", - 'type' => 'string', - 'example' => '<=', - ], - 'OperatorName' => [ - 'title' => '操作符显示名称。', - 'description' => 'The name of the operator.'."\n", - 'type' => 'string', - 'example' => '<=', - ], - 'OperatorDescCn' => [ - 'title' => '操作符中文描述。', - 'description' => 'The description of the operator in Chinese.'."\n", - 'type' => 'string', - 'example' => 'larger than or equal to', - ], - 'OperatorDescEn' => [ - 'title' => '操作符英文描述。', - 'description' => 'The description of the operator in English.'."\n", - 'type' => 'string', - 'example' => 'larger than or equal to', - ], - 'SupportDataType' => [ - 'title' => '当前操作符可以支持的数据类型 以逗号分隔。', - 'description' => 'The data types that are supported by the operator. The data types are separated by commas (,).'."\n", - 'type' => 'string', - 'example' => 'varchar', - ], - 'SupportTag' => [ - 'title' => '操作符支持场景 多个场景以逗号分隔 如聚合（AGGREGATE）等 默认为空。', - 'description' => 'The scenarios that are supported by the operator. Multiple scenarios are separated by commas (,), such as aggregation scenarios. By default, this parameter is empty.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The supported scenario.'."\n", - 'type' => 'string', - 'example' => '[AGGREGATE]', - ], - 'example' => '[AGGREGATE]', - ], - 'Index' => [ - 'title' => '操作符所处操作符列表位置。', - 'description' => 'The position of the operator in the operator list.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - ], - ], - ], - 'RightValueEnums' => [ - 'title' => '该字段对应的右值枚举值', - 'description' => 'The enumerated values of the right operand for the field.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Value' => [ - 'title' => '右值枚举值。', - 'description' => 'The enumerated value of the right operand.'."\n", - 'type' => 'string', - 'example' => 'serious', - ], - 'ValueMds' => [ - 'title' => '右值枚举值美杜莎code。', - 'description' => 'The internal code of the enumerated value.'."\n", - 'type' => 'string', - 'example' => 'aliyun.siem.automate.feature.alert_level.serious', - ], - ], - ], - ], - ], + 'Joined' => ['title' => '', 'description' => 'Indicates whether the account is managed by the multi-account control feature of Threat Analysis. Valid values:'."\n" + ."\n" + .'- true: The account is managed.'."\n" + ."\n" + .'- false: The account is not managed.', 'type' => 'boolean', 'example' => 'true'], + 'JoinedTime' => ['description' => 'The time when the account was added.', 'type' => 'string', 'title' => '', 'example' => '2013-10-01 00:00:00'], + 'DelegatedOrNot' => ['title' => '', 'description' => 'Indicates whether the account is delegated to view its own resources.', 'type' => 'boolean', 'example' => 'true'], + 'MainUserId' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that purchased Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXXX'], + 'SubUserId' => ['title' => '', 'description' => 'The ID of the member Alibaba Cloud account.', 'type' => 'integer', 'format' => 'int64', 'example' => '123XXXXXXXX'], + 'SubUserName' => ['title' => '', 'description' => 'The name of the member Alibaba Cloud account.', 'type' => 'string', 'example' => 'sas_account_xxx'], + ], + 'title' => '', + 'example' => '', ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Feature\\": \\"alert_desc\\",\\n \\"DataType\\": \\"varchar\\",\\n \\"SupportOperators\\": [\\n {\\n \\"HasRightValue\\": false,\\n \\"Operator\\": \\"<=\\",\\n \\"OperatorName\\": \\"<=\\",\\n \\"OperatorDescCn\\": \\"larger than or equal to\\",\\n \\"OperatorDescEn\\": \\"larger than or equal to\\",\\n \\"SupportDataType\\": \\"varchar\\",\\n \\"SupportTag\\": [\\n \\"[AGGREGATE]\\"\\n ],\\n \\"Index\\": 3\\n }\\n ],\\n \\"RightValueEnums\\": [\\n {\\n \\"Value\\": \\"serious\\",\\n \\"ValueMds\\": \\"aliyun.siem.automate.feature.alert_level.serious\\"\\n }\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAutomateResponseConfigFeature', - ], - 'ListAutomateResponseConfigs' => [ - 'summary' => 'Queries automated response rules.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListRdUsers', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListRdUsers'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListRdUsers', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"Joined\\": true,\\n \\"JoinedTime\\": \\"2013-10-01 00:00:00\\",\\n \\"DelegatedOrNot\\": true,\\n \\"MainUserId\\": 0,\\n \\"SubUserId\\": 0,\\n \\"SubUserName\\": \\"sas_account_xxx\\"\\n }\\n ],\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ModifyBindAccount' => [ + 'summary' => 'Modifies a bound Alibaba Cloud account.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas104PTS', - ], + 'abilityTreeCode' => '194689', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'Id', - 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应配置规则ID。', - 'description' => 'The ID of the automated response rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123', - ], - ], - [ - 'name' => 'SubUserId', + 'name' => 'AccessId', 'in' => 'formData', - 'schema' => [ - 'title' => '规则创建用户ID。', - 'description' => 'The ID of the user who created the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '17108579417****', - ], + 'schema' => ['title' => '', 'description' => 'The AccessKey ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => 'ABCXXXXXXXXX'], ], [ - 'name' => 'PlaybookUuid', + 'name' => 'AccountName', 'in' => 'formData', - 'schema' => [ - 'title' => '剧本唯一标识。', - 'description' => 'The UUID of the playbook.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'system_aliyun_aegis_kill_quara_book', - ], + 'schema' => ['title' => '', 'description' => 'The name of the multicloud account.', 'type' => 'string', 'required' => false, 'example' => 'sas_account_xxx'], ], [ - 'name' => 'RuleName', + 'name' => 'BindId', 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应配置规则名称。', - 'description' => 'The name of the automated response rule.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cfw kill quara book', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the binding record. This is the BindId value returned by the ListBindAccount operation.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123'], ], [ - 'name' => 'AutoResponseType', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应类型。 取值：'."\n" - .'- event：事件'."\n" - .'- alert：告警', - 'description' => 'The type of the automated response rule. Valid values:'."\n" - ."\n" - .'* event'."\n" - .'* alert'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'event', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => true, 'example' => '123xxxxxxx'], ], [ - 'name' => 'ActionType', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '处置动作类型。 取值：'."\n" - .'- doPlaybook：执行剧本'."\n" - .'- changeEventStatus：更改事件状态'."\n" - .'- changeThreatLevel：更改事件威胁等级', - 'description' => 'The type of the handling action. Valid values:'."\n" - ."\n" - .'* doPlaybook: runs a playbook.'."\n" - .'* changeEventStatus: changes the status of an event.'."\n" - .'* changeThreatLevel: changes the risk level of an event.'."\n", + 'title' => '', + 'description' => 'The code of the multicloud service.', 'type' => 'string', - 'required' => false, - 'example' => 'doPlaybook', - ], - ], - [ - 'name' => 'Status', - 'in' => 'formData', - 'schema' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：未启用'."\n" - .'- 100：启用', - 'description' => 'The status of the rule. Valid values:'."\n" - ."\n" - .'* 0: disabled'."\n" - .'* 100: enabled'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], - ], - [ - 'name' => 'CurrentPage', - 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], - ], - [ - 'name' => 'PageSize', - 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', + 'enum' => ['qcloud', 'hcloud'], + 'example' => 'hcloud', ], ], [ - 'name' => 'RoleType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - [ - 'name' => 'ResponseRuleType', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<CloudSiemAutomateResponseConfig>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<ModifyBindAccountResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The return value of the request.', 'type' => 'object', 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Id' => [ - 'title' => '自动化响应配置规则ID。', - 'description' => 'The ID of the automated response rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123', - ], - 'GmtCreate' => [ - 'title' => '创建时间。', - 'description' => 'The creation time.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '修改时间。', - 'description' => 'The update time.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => '规则关联siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is associated with the rule in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'SubUserId' => [ - 'title' => '规则创建用户ID。', - 'description' => 'The ID of the user who created the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '17108579417****', - ], - 'RuleName' => [ - 'title' => '自动化响应配置规则名称。', - 'description' => 'The name of the automated response rule.'."\n", - 'type' => 'string', - 'example' => 'cfw kill quara book', - ], - 'AutoResponseType' => [ - 'title' => '自动化响应类型。 取值：'."\n" - .'- event：事件'."\n" - .'- alert：告警', - 'description' => 'The type of the automated response rule. Valid values:'."\n" - ."\n" - .'* **event**'."\n" - .'* **alert**'."\n", - 'type' => 'string', - 'example' => 'event', - ], - 'ExecutionCondition' => [ - 'title' => '自动化响应规则触发条件 json格式。', - 'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.'."\n", - 'type' => 'string', - 'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]', - ], - 'ActionType' => [ - 'title' => '处置动作类型 多个值以逗号分隔。 取值：'."\n" - .'- doPlaybook：执行剧本'."\n" - .'- changeEventStatus：更改事件状态'."\n" - .'- changeThreatLevel：更改事件威胁等级', - 'description' => 'The type of the handling action. Multiple types are separated by commas (,). Valid values:'."\n" - ."\n" - .'* **doPlaybook**: runs the playbook.'."\n" - .'* **changeEventStatus**: changes the event status.'."\n" - .'* **changeThreatLevel**: changes the risk level of the event.'."\n", - 'type' => 'string', - 'example' => 'doPlaybook,changeEventStatus', - ], - 'ActionConfig' => [ - 'title' => '自动化响应规则动作配置 json数组格式。', - 'description' => 'The configuration of the action that is performed after the automated response rule is hit. The value is in the JSON format.'."\n", - 'type' => 'string', - 'example' => '['."\n" - .' {'."\n" - .' "actionType": "doPlaybook",'."\n" - .' "playbookName": "WafBlockIP",'."\n" - .' "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n" - .' }'."\n" - .']', - ], - 'Status' => [ - 'title' => '规则状态。 取值：'."\n" - .'- 0：未启用'."\n" - .'- 100：启用', - 'description' => 'The status of the rule. Valid values:'."\n" - ."\n" - .'* **0**: disabled.'."\n" - .'* **100**: enabled.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'DataType' => [ - 'description' => 'The type of the view. Valid values:'."\n" - ."\n" - .'0: the current Alibaba Cloud account'."\n" - .'1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'ResponseRuleType' => [ - 'type' => 'string', - ], - ], - ], - ], + 'Count' => ['title' => '', 'description' => 'The number of account bindings that are modified. A value of 1 indicates that the operation is successful. A value of 0 or less indicates that the operation failed.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], ], - 'example' => '123456', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'ModifyBindAccount', + 'changeSet' => [ + ['createdAt' => '2024-07-18T01:29:01.000Z', 'description' => 'Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"SubUserId\\": 0,\\n \\"RuleName\\": \\"cfw kill quara book\\",\\n \\"AutoResponseType\\": \\"event\\",\\n \\"ExecutionCondition\\": \\"[{\\\\\\"left\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"alert_name\\\\\\"},\\\\\\"operator\\\\\\":\\\\\\"containsString\\\\\\",\\\\\\"right\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"webshell_online\\\\\\"}}]\\",\\n \\"ActionType\\": \\"doPlaybook,changeEventStatus\\",\\n \\"ActionConfig\\": \\"[\\\\n {\\\\n \\\\\\"actionType\\\\\\": \\\\\\"doPlaybook\\\\\\",\\\\n \\\\\\"playbookName\\\\\\": \\\\\\"WafBlockIP\\\\\\",\\\\n \\\\\\"playbookUuid\\\\\\": \\\\\\"bdad6220-6584-41b2-9704-fc6584568758\\\\\\"\\\\n }\\\\n]\\",\\n \\"Status\\": 0,\\n \\"DataType\\": 0,\\n \\"ResponseRuleType\\": \\"custom\\"\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'ListAutomateResponseConfigs', - ], - 'PostAutomateResponseConfig' => [ - 'summary' => 'Creates or updates an automatic response rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyBindAccount'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:ModifyBindAccount', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ModifyDataSource' => [ + 'summary' => 'Modifies the description of an existing data source.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Id', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应配置规则ID。', - 'description' => 'The rule ID.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '123', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => '123xxxxxx'], ], [ - 'name' => 'SubUserId', + 'name' => 'DataSourceType', 'in' => 'formData', - 'schema' => [ - 'title' => '规则创建用户ID。', - 'description' => 'The ID of the user who created the rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '17108579417****', - ], + 'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- ckafka: Tencent Cloud CKafka.'."\n" + ."\n" + .'- obs: Huawei Cloud Object Storage Service (OBS).'."\n" + ."\n" + .'- wafApi: the API used to download attack logs from Tencent Cloud Web Application Firewall (WAF).', 'type' => 'string', 'required' => true, 'example' => 'obs'], ], [ - 'name' => 'RuleName', + 'name' => 'DataSourceInstanceId', 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应配置规则名称。', - 'description' => 'The rule name.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cfw kill quara book', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the data source. The ID is an MD5 hash that is calculated based on the values of other parameters. You can call the [DescribeDataSourceInstance](https://api.aliyun-inc.com/#/publishment/document/cloud-siem/863fdf54478f4cc5877e27c2a5fe9e44?tenantUuid=f382fccd88b94c5c8c864def6815b854\\&activeTabKey=api%7CDescribeDataSourceInstance) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], ], [ - 'name' => 'AutoResponseType', + 'name' => 'DataSourceInstanceName', 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应类型。 取值：'."\n" - .'- event：事件'."\n" - .'- alert：告警', - 'description' => 'The type of the automated response rule. Valid values:'."\n" - ."\n" - .'* **event**'."\n" - .'* **alert**'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'event', - ], + 'schema' => ['title' => '', 'description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'beijing_waf_kafka'], ], [ - 'name' => 'ExecutionCondition', + 'name' => 'DataSourceInstanceRemark', 'in' => 'formData', - 'schema' => [ - 'title' => '自动化响应规则触发条件 json格式。', - 'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]', - ], + 'schema' => ['title' => '', 'description' => 'The description of the data source.', 'type' => 'string', 'required' => false, 'example' => 'waf_alert_log'], ], [ - 'name' => 'ActionType', + 'name' => 'DataSourceInstanceParams', 'in' => 'formData', - 'schema' => [ - 'title' => '处置动作类型 多个值以逗号分隔。 取值：'."\n" - .'- doPlaybook：执行剧本'."\n" - .'- changeEventStatus：更改事件状态'."\n" - .'- changeThreatLevel：更改事件威胁等级', - 'description' => 'The type of the handling action. Multiple types are separated by commas (,). Valid values:'."\n" - ."\n" - .'* **doPlaybook**: runs the playbook.'."\n" - .'* **changeEventStatus**: changes the event status.'."\n" - .'* **changeThreatLevel**: changes the threat level of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'doPlaybook,changeEventStatus', - ], + 'schema' => ['title' => '', 'description' => 'The parameters of the data source, in a JSON array format.', 'type' => 'string', 'required' => false, 'example' => '[{"paraCode":"region_code","paraValue":"ap-guangzhou"}]'], ], [ - 'name' => 'ActionConfig', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '自动化响应规则动作配置 json数组格式。', - 'description' => 'The action configuration of the automated response rule. The value is in the JSON format.'."\n", + 'title' => '', + 'description' => 'The code of the cloud service provider. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" + ."\n" + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', 'type' => 'string', - 'required' => false, - 'example' => '['."\n" - .' {'."\n" - .' "actionType": "doPlaybook",'."\n" - .' "playbookName": "WafBlockIP",'."\n" - .' "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n" - .' }'."\n" - .']', - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* **cn-hangzhou**: Your assets reside in regions in China.'."\n" - .'* **ap-southeast-1**: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of the threat analysis feature is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<String>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<ModifyDataSourceResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'string', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* **true**'."\n" - .'* **false**'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'Count' => ['title' => '', 'description' => 'The number of modified data sources. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'DataSourceInstanceId' => ['title' => '', 'description' => 'The ID of the data source. The ID is an MD5 hash that is calculated based on the values of other parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + ], + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostAutomateResponseConfig', - ], - 'UpdateAutomateResponseConfigStatus' => [ - 'summary' => 'Updates the status of an automatic response rule.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ModifyDataSource', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSource'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:ModifyDataSource', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"DataSourceInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'ModifyDataSourceLog' => [ + 'summary' => 'Modifies the description of a data source log.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'update', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Ids', + 'name' => 'LogCode', 'in' => 'formData', - 'schema' => [ - 'title' => '自动响应规则id列表，json数组。', - 'description' => 'The IDs of the automatic response rules. The value is a JSON array.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '[123,345]', - ], + 'schema' => ['title' => '', 'description' => 'The code of the log.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_waf_xxxxx'], ], [ - 'name' => 'InUse', + 'name' => 'AccountId', 'in' => 'formData', - 'schema' => [ - 'title' => '规则开启状态。 取值：'."\n" - .'- true：开启'."\n" - .'- false：关闭', - 'description' => 'Specifies whether the rule is enabled. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account.', 'type' => 'string', 'required' => false, 'example' => '123xxxxxxx'], ], [ - 'name' => 'RoleType', + 'name' => 'DataSourceType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- obs: Huawei Cloud Object Storage Service (OBS).'."\n" + ."\n" + .'- wafApi: Tencent Cloud Web Application Firewall (WAF) download API.'."\n" + ."\n" + .'- ckafka: Tencent Cloud CKafka.', 'type' => 'string', 'required' => false, 'example' => 'obs'], ], [ - 'name' => 'RoleFor', + 'name' => 'DataSourceInstanceId', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the data source. The threat analysis feature generates this ID by calculating an MD5 hash of the parameters.'."\n" + .'Call the [DescribeDataSourceInstance](~~2639736~~) operation to obtain the data source ID.', 'type' => 'string', 'required' => true, 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'], ], [ - 'name' => 'RegionId', + 'name' => 'DataSourceInstanceLogs', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The details of the data source parameters, in a JSON array format.', 'type' => 'string', 'required' => true, 'example' => '[{"LogCode":"cloud_siem_qcloud_waf_alert_log","LogParas":"[{\\"ParaCode\\":\\"api_name\\",\\"ParaValue\\":\\"GetAttackDownloadRecords\\"}]"}]'], + ], + [ + 'name' => 'LogInstanceId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The ID of the log. The threat analysis feature generates this ID by calculating an MD5 hash of the parameters. Call the [ListDataSourceLogs](~~2639707~~) operation to obtain the log ID.', 'type' => 'string', 'required' => true, 'example' => 'ef33097c9d1fdb0b9c7e8c7ca320pkl1'], + ], + [ + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" + 'title' => '', + 'description' => 'The code for the multicloud environment. Valid values:'."\n" + ."\n" + .'- qcloud: Tencent Cloud.'."\n" ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", + .'- aliyun: Alibaba Cloud.'."\n" + ."\n" + .'- hcloud: Huawei Cloud.', 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', + 'required' => true, + 'enum' => ['qcloud', 'hcloud', 'aliyun'], + 'example' => 'hcloud', ], ], + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management hub is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<String>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemSuccessResponse<ModifyDataSourceLogResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'string', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'title' => '', + 'description' => 'The data returned.', + 'type' => 'object', + 'properties' => [ + 'Count' => ['title' => '', 'description' => 'The number of modified logs. A value of 1 indicates success. A value of 0 or less indicates failure.', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'LogInstanceId' => ['title' => '', 'description' => 'The ID of the log. The threat analysis feature generates this ID by calculating an MD5 hash of the parameters.', 'type' => 'string', 'example' => '220ba97c9d1fdb0b9c7e8c7ca328d7ea'], + ], + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'UpdateAutomateResponseConfigStatus', - ], - 'ListDisposeStrategy' => [ - 'summary' => 'Queries handling policies.', - 'methods' => [ - 'get', - 'post', + 'title' => 'ModifyDataSourceLog', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSourceLog'], + ], ], - 'schemes' => [ - 'http', - 'https', + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:ModifyDataSourceLog', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 1,\\n \\"LogInstanceId\\": \\"220ba97c9d1fdb0b9c7e8c7ca328d7ea\\"\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'OpenDelivery' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'create', 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasAFG0OH', - ], + 'chargeType' => 'paid', + 'abilityTreeCode' => '154876', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ - 'name' => 'SophonTaskId', + 'name' => 'ProductCode', 'in' => 'formData', - 'schema' => [ - 'title' => '处置策略ID。', - 'description' => 'The ID of the SOAR handling policy.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'a50a49b7-6044-4593-ab15-2b46567caadd', - ], + 'schema' => ['title' => '', 'description' => 'The code of the cloud service. Valid values:'."\n" + ."\n" + .'- qcloud\\_waf'."\n" + ."\n" + .'- qcloud\\_cfw'."\n" + ."\n" + .'- hcloud\\_waf'."\n" + ."\n" + .'- hcloud\\_cfw'."\n" + ."\n" + .'- ddos'."\n" + ."\n" + .'- sas'."\n" + ."\n" + .'- cfw'."\n" + ."\n" + .'- config'."\n" + ."\n" + .'- csk'."\n" + ."\n" + .'- fc'."\n" + ."\n" + .'- rds'."\n" + ."\n" + .'- nas'."\n" + ."\n" + .'- apigateway'."\n" + ."\n" + .'- cdn'."\n" + ."\n" + .'- mongodb'."\n" + ."\n" + .'- eip'."\n" + ."\n" + .'- slb'."\n" + ."\n" + .'- vpc'."\n" + ."\n" + .'- actiontrail'."\n" + ."\n" + .'- waf'."\n" + ."\n" + .'- bastionhost'."\n" + ."\n" + .'- oss'."\n" + ."\n" + .'- polardb', 'type' => 'string', 'required' => true, 'example' => 'cfw'], ], [ - 'name' => 'EntityIdentity', + 'name' => 'LogCode', 'in' => 'formData', - 'schema' => [ - 'title' => '实体特征值，可以对处置实体进行模糊搜索。', - 'description' => 'The feature value of the entity. Fuzzy match is supported.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'test22.php', - ], + 'schema' => ['title' => '', 'description' => 'The code for a specific log of the cloud service, such as the process log of Security Center. This parameter is optional. If you do not specify this parameter, the operation applies to all logs of the service.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_cfw_flow'], ], [ - 'name' => 'EntityType', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '剧本支持的实体类型。取值：'."\n" - .'- ip:ip'."\n" - .'- process：进程'."\n" - .'- file：文件', - 'description' => 'The entity type of the playbook. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* process'."\n" - .'* file'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'ip', - ], + 'schema' => ['description' => 'The type of the view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ - 'name' => 'PlaybookName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '剧本唯一标识名称。', - 'description' => 'The name of the playbook, which is the unique identifier of the playbook.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'WafBlockIP', - ], + 'schema' => ['description' => 'The ID of the member account that the administrator wants to access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'PlaybookUuid', + 'name' => 'RegionId', 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Select this value if your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'title' => '剧本UUID。', - 'description' => 'The UUID of the playbook.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'system_aliyun_clb_process_book', + 'title' => 'CloudSiemResponse<Boolean>', + 'description' => 'CloudSiemResponse', + 'type' => 'object', + 'properties' => [ + 'Data' => ['title' => '', 'description' => 'Indicates whether log delivery is enabled. Valid values:'."\n" + ."\n" + .'- true: Enabled'."\n" + ."\n" + .'- false: Failed', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '15FD134E-D69B-51E8-B052-73F97BD8****'], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'Siem.Delivery.MissingProductCode', 'errorMessage' => 'ProductCode is mandatory for this action.', 'description' => ''], + ], + 500 => [ + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], + ['errorCode' => 'Siem.Delivery.ErrorMapping', 'errorMessage' => 'The Mapping between productCode and logCode is error.', 'description' => ''], + ['errorCode' => 'Siem.Delivery.ErrorProductCode', 'errorMessage' => 'ProductCode is error for this action.', 'description' => ''], + ['errorCode' => 'SLS.Ship.Error', 'errorMessage' => 'The Simple Log Service about data shipping is unavailable.', 'description' => ''], + ], + ], + 'title' => 'OpenDelivery', + 'summary' => 'Enables log delivery for integrated cloud services.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'OpenDelivery'], + ], + ], + 'ramActions' => [ [ - 'name' => 'PlaybookTypes', - 'in' => 'formData', - 'schema' => [ - 'title' => '剧本类型。 取值：'."\n" - .'- system:手动处置'."\n" - .'- custom：事件触发剧本'."\n" - .'- custom_alert：告警触发剧本'."\n" - .'- soar-manual：手动运行剧本'."\n" - .'- soar-mdr：MDR运行剧本', - 'description' => 'The type of the playbook. Valid values:'."\n" - ."\n" - .'* system: user-triggered playbook'."\n" - .'* custom: event-triggered playbook'."\n" - .'* custom_alert: alert-triggered playbook'."\n" - .'* soar-manual: user-run playbook'."\n" - .'* soar-mdr: MDR-run playbook'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'system', + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:OpenDelivery', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"15FD134E-D69B-51E8-B052-73F97BD8****\\"\\n}","type":"json"}]', + ], + 'PostAutomateResponseConfig' => [ + 'summary' => 'Adds or updates an automated response rule.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], + 'security' => [ [ - 'name' => 'EffectiveStatus', - 'in' => 'formData', - 'schema' => [ - 'title' => '策略状态。 取值：'."\n" - .'- 0：失效'."\n" - .'- 1：有效', - 'description' => 'The status of the policy. Valid values:'."\n" - ."\n" - .'* 0: invalid'."\n" - .'* 1: valid'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'AK' => [], ], + ], + 'deprecated' => false, + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], + 'parameters' => [ [ - 'name' => 'OrderField', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '排序字段。 取值：'."\n" - .'- GmtModified：按更新时间排序'."\n" - .'- GmtCreate：按创建时间排序'."\n" - .'- FinishTime：按策略结束时间排序', - 'description' => 'The sort field. Valid values:'."\n" - ."\n" - .'* GmtModified: sorts the policies by update time.'."\n" - .'* GmtCreate: sorts the policies by creation time.'."\n" - .'* FinishTime: sorts the policies by end time.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'GmtModified', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the automated response rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123'], ], [ - 'name' => 'Order', + 'name' => 'SubUserId', 'in' => 'formData', - 'schema' => [ - 'title' => '排序方向。 取值：'."\n" - .'- desc：降序排列'."\n" - .'- asc：升序排列', - 'description' => 'The sort order. Valid values:'."\n" - ."\n" - .'* desc: descending order.'."\n" - .'* asc: ascending order.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'desc', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the user who created the rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '17108579417****'], ], [ - 'name' => 'StartTime', + 'name' => 'RuleName', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The name of the automated response rule.', 'type' => 'string', 'required' => false, 'example' => 'cfw kill quara book'], ], [ - 'name' => 'EndTime', + 'name' => 'AutoResponseType', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The type of the automated response. Valid values:'."\n" + ."\n" + .'- **event**: event'."\n" + ."\n" + .'- **alert**: alert', 'type' => 'string', 'required' => false, 'example' => 'event'], ], [ - 'name' => 'Status', + 'name' => 'ExecutionCondition', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['title' => '', 'description' => 'The trigger condition of the automated response rule. The value is in the JSON format.', 'type' => 'string', 'required' => false, 'example' => '[{"left":{"value":"alert_name"},"operator":"containsString","right":{"value":"webshell_online"}}]'], ], [ - 'name' => 'CurrentPage', + 'name' => 'ActionType', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The type of the action. Separate multiple values with commas. Valid values:'."\n" + ."\n" + .'- **doPlaybook**: runs a playbook'."\n" + ."\n" + .'- **changeEventStatus**: changes the status of the event'."\n" + ."\n" + .'- **changeThreatLevel**: changes the threat level of the event', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook,changeEventStatus'], ], [ - 'name' => 'PageSize', + 'name' => 'ActionConfig', 'in' => 'formData', - 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Maximum value: 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['title' => '', 'description' => 'The configuration of the action that is specified in the automated response rule. The value is a JSON array.', 'type' => 'string', 'required' => false, 'example' => '['."\n" + .' {'."\n" + .' "actionType": "doPlaybook",'."\n" + .' "playbookName": "WafBlockIP",'."\n" + .' "playbookUuid": "bdad6220-6584-41b2-9704-fc6584568758"'."\n" + .' }'."\n" + .']'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - 'title' => '0，单账号登录；1，全局视图；2，切换视图；3，局部视图', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that are managed by the administrator.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the user that the administrator uses to switch the view. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- **cn-hangzhou**: your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- **ap-southeast-1**: your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<DisposeStrategy>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'BaseResponse<String>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'object', - 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Id' => [ - 'title' => '策略ID。', - 'description' => 'The ID of the policy.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123', - ], - 'GmtCreate' => [ - 'title' => '创建时间。', - 'description' => 'The creation time.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '修改时间。', - 'description' => 'The update time.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => '策略关联siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is associated with the policy in SIEM.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'SubAliuid' => [ - 'title' => '配置策略阿里账号ID。', - 'description' => 'The ID of the Alibaba account that is used to configure the policy.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '176555323***', - ], - 'IncidentName' => [ - 'title' => '事件名称。', - 'description' => 'The name of the event.'."\n", - 'type' => 'string', - 'example' => 'Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc', - ], - 'Scope' => [ - 'title' => '处置作用域。', - 'description' => 'The scope of the policy.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The scope of the policy.'."\n", - 'type' => 'any', - 'example' => '[{ aliUid: 1766185894104675 }]', - ], - 'example' => '[{ aliUid: 1766185894104675 }]', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '告警ID。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'SophonTaskId' => [ - 'title' => 'soar处置策略ID。', - 'description' => 'The ID of the SOAR handling policy.'."\n", - 'type' => 'string', - 'example' => '577bbf90-a770-44a7-8154-586aa2d318fa', - ], - 'PlaybookName' => [ - 'title' => '剧本唯一标识名称。', - 'description' => 'The name of the playbook, which is the unique identifier of the playbook.'."\n", - 'type' => 'string', - 'example' => 'WafBlockIP', - ], - 'PlaybookUuid' => [ - 'title' => '剧本UUID。', - 'description' => 'The UUID of the playbook.'."\n", - 'type' => 'string', - 'example' => 'system_aliyun_clb_process_book', - ], - 'PlaybookType' => [ - 'title' => '剧本类型。 取值：'."\n" - .'- system:手动处置'."\n" - .'- custom：事件触发剧本'."\n" - .'- custom_alert：告警触发剧本'."\n" - .'- soar-manual：手动运行剧本'."\n" - .'- soar-mdr：MDR运行剧本', - 'description' => 'The type of the playbook. Valid values:'."\n" - ."\n" - .'* system: user-triggered playbook'."\n" - .'* custom: event-triggered playbook'."\n" - .'* custom_alert: alert-triggered playbook'."\n" - .'* soar-manual: user-run playbook'."\n" - .'* soar-mdr: MDR-run playbook'."\n", - 'type' => 'string', - 'example' => 'system', - ], - 'TaskUrl' => [ - 'title' => '剧本url', - 'type' => 'string', - ], - 'EntityId' => [ - 'title' => '实体ID。', - 'description' => 'The ID of the entity.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'Entity' => [ - 'title' => '实体详情, json数组格式。', - 'description' => 'The details of the entity. The value is a JSON array.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The item. The value is a JSON string.'."\n", - 'type' => 'any', - 'example' => '[{"ip":"1.1.1.1"}]', - ], - 'example' => '[{"ip":"1.1.1.1"}]', - ], - 'EntityType' => [ - 'title' => '实体类型。取值：'."\n" - .'- ip:ip'."\n" - .'- process：进程'."\n" - .'- file：文件', - 'description' => 'The type of the entity. Valid values:'."\n" - ."\n" - .'* ip'."\n" - .'* process'."\n" - .'* file'."\n", - 'type' => 'string', - 'example' => 'ip', - ], - 'TaskParam' => [ - 'title' => '触发剧本参数， json格式。', - 'description' => 'The parameters that are used to trigger the playbook. The value is in the JSON format.'."\n", - 'type' => 'string', - 'example' => '{'."\n" - .' "file": {'."\n" - .' "op_code": "2",'."\n" - .' "file_path": "/root/alert0913/a886.jsp",'."\n" - .' "entity_type": "file",'."\n" - .' "entity_name": "a886.jsp",'."\n" - .' "file_name": "a886.jsp",'."\n" - .' "file_owner": "USER:,GROUP:",'."\n" - .' "hash_value": "5def10c9a4287d0920d86b42420b20b0",'."\n" - .' "op_level": "2",'."\n" - .' "entity_id": "/root/alert0913/a886.jsp",'."\n" - .' "host_uuid": {'."\n" - .' "entity_type": "host",'."\n" - .' "entity_name": "N/A",'."\n" - .' "is_comprised": "1",'."\n" - .' "os_type": "linux",'."\n" - .' "entity_id": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n" - .' "host_uuid": "5f58ef67-8803-4314-8d67-c87dc92b****",'."\n" - .' "host_name": "N/A"'."\n" - .' },'."\n" - .' "malware_type": "${aliyun.siem.sas.alert_tag.webshell}"'."\n" - .' },'."\n" - .' "_sys_siem": {'."\n" - .' "cloudCode": "aliyun",'."\n" - .' "alertId": "89416745494****"'."\n" - .' },'."\n" - .' "scope": ['."\n" - .' {'."\n" - .' "aliUid": 1766185894104****'."\n" - .' }'."\n" - .' ]'."\n" - .'}', - ], - 'ErrorMessage' => [ - 'title' => '任务的失败摘要信息。', - 'description' => 'The summary information about the failed task.'."\n", - 'type' => 'string', - 'example' => 'DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found', - ], - 'FinishTime' => [ - 'title' => '任务的结束时间。', - 'description' => 'The end time of the task.'."\n", - 'type' => 'string', - 'example' => '2021-08-10 21:34:07', - ], - 'EffectiveStatus' => [ - 'title' => '策略状态。 取值：'."\n" - .'- 0：失效'."\n" - .'- 1：有效', - 'description' => 'The status of the policy. Valid values:'."\n" - ."\n" - .'* 0: invalid'."\n" - .'* 1: valid'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'Status' => [ - 'title' => '剧本调用状态。 取值：'."\n" - .'- 200：成功'."\n" - .'- 10：删除'."\n" - .'- 5：失败'."\n" - .'- 0：初始状态', - 'description' => 'The running status of the playbook. Valid values:'."\n" - ."\n" - .'* 200: successful'."\n" - .'* 10: deleted'."\n" - .'* 5: failed'."\n" - .'* 0: initial'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - ], - ], - ], - ], - 'example' => '123456', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'string', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- **true**: The request was successful.'."\n" + ."\n" + .'- **false**: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'PostAutomateResponseConfig', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"SubAliuid\\": 0,\\n \\"IncidentName\\": \\"Multiple type of alerts, including Miner Network, Command line download and run malicious files, Backdoor Process, etc\\",\\n \\"Scope\\": [\\n \\"[{ aliUid: 176618589410**** }]\\"\\n ],\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"SophonTaskId\\": \\"577bbf90-a770-44a7-8154-586aa2d3****\\",\\n \\"PlaybookName\\": \\"WafBlockIP\\",\\n \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\",\\n \\"PlaybookType\\": \\"system\\",\\n \\"TaskUrl\\": \\"{\\\\\\"playbookUuid\\\\\\":\\\\\\"system_aliyun_aegis_stop_container_book\\\\\\",\\\\\\"requestUuid\\\\\\":\\\\\\"e8924356-448b-4301-aee9-*******\\\\\\"}\\",\\n \\"EntityId\\": 123456789,\\n \\"Entity\\": [\\n \\"[{\\\\\\"ip\\\\\\":\\\\\\"1.1.XX.XX\\\\\\"}]\\"\\n ],\\n \\"EntityType\\": \\"ip\\",\\n \\"TaskParam\\": \\"{\\\\n \\\\\\"file\\\\\\": {\\\\n \\\\\\"op_code\\\\\\": \\\\\\"2\\\\\\",\\\\n \\\\\\"file_path\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n \\\\\\"entity_type\\\\\\": \\\\\\"file\\\\\\",\\\\n \\\\\\"entity_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n \\\\\\"file_name\\\\\\": \\\\\\"a886.jsp\\\\\\",\\\\n \\\\\\"file_owner\\\\\\": \\\\\\"USER:,GROUP:\\\\\\",\\\\n \\\\\\"hash_value\\\\\\": \\\\\\"5def10c9a4287d0920d86b42420b20b0\\\\\\",\\\\n \\\\\\"op_level\\\\\\": \\\\\\"2\\\\\\",\\\\n \\\\\\"entity_id\\\\\\": \\\\\\"/root/alert0913/a886.jsp\\\\\\",\\\\n \\\\\\"host_uuid\\\\\\": {\\\\n \\\\\\"entity_type\\\\\\": \\\\\\"host\\\\\\",\\\\n \\\\\\"entity_name\\\\\\": \\\\\\"N/A\\\\\\",\\\\n \\\\\\"is_comprised\\\\\\": \\\\\\"1\\\\\\",\\\\n \\\\\\"os_type\\\\\\": \\\\\\"linux\\\\\\",\\\\n \\\\\\"entity_id\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n \\\\\\"host_uuid\\\\\\": \\\\\\"5f58ef67-8803-4314-8d67-c87dc92b****\\\\\\",\\\\n \\\\\\"host_name\\\\\\": \\\\\\"N/A\\\\\\"\\\\n },\\\\n \\\\\\"malware_type\\\\\\": \\\\\\"${aliyun.siem.sas.alert_tag.webshell}\\\\\\"\\\\n },\\\\n \\\\\\"_sys_siem\\\\\\": {\\\\n \\\\\\"cloudCode\\\\\\": \\\\\\"aliyun\\\\\\",\\\\n \\\\\\"alertId\\\\\\": \\\\\\"89416745494****\\\\\\"\\\\n },\\\\n \\\\\\"scope\\\\\\": [\\\\n {\\\\n \\\\\\"aliUid\\\\\\": 1766185894104****\\\\n }\\\\n ]\\\\n}\\",\\n \\"ErrorMessage\\": \\"DisposalEntity failed which description is Aegis Quarantine File , return_info failed which description is Check Aegis Process Result , [ERROR DETAIL] *******.php:file not found\\",\\n \\"FinishTime\\": \\"2021-08-10 21:34:07\\",\\n \\"EffectiveStatus\\": 0,\\n \\"Status\\": 10\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'ListDisposeStrategy', - ], - 'DescribeDisposeStrategyPlaybook' => [ - 'summary' => 'Queries the list of playbooks that are used by a handling policy.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostAutomateResponseConfig'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:PostAutomateResponseConfig', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'PostCustomizeRule' => [ + 'summary' => 'Adds or updates a custom rule.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'StartTime', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '查询开始时间, 单位毫秒。', - 'description' => 'The beginning of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ - 'name' => 'EndTime', + 'name' => 'RuleName', 'in' => 'formData', - 'schema' => [ - 'title' => '查询结束时间, 单位毫秒。', - 'description' => 'The end of the time range to query. Unit: milliseconds.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '1577808000000', - ], + 'schema' => ['title' => '', 'description' => 'The name of the rule.', 'type' => 'string', 'required' => false, 'example' => 'waf_scan'], ], [ - 'name' => 'RoleType', + 'name' => 'RuleDesc', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The description of the rule.', 'type' => 'string', 'required' => false, 'example' => 'this rule is for waf scan'], ], [ - 'name' => 'RoleFor', + 'name' => 'ThreatLevel', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'required' => false, 'example' => 'remind'], ], [ - 'name' => 'RegionId', + 'name' => 'AttCk', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions inside China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => 'att&ck。', 'description' => 'The ATT\\&CK technique.', 'type' => 'string', 'required' => false, 'example' => 'T1595.002 Vulnerability Scanning'."\n"], ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'BaseResponse<List<StrategyPlaybookList>>', - 'description' => 'BaseResponse\\<List>'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'PlaybookName' => [ - 'title' => '剧本唯一标识名称。', - 'description' => 'The playbook name, which is the unique identifier of the playbook.'."\n", - 'type' => 'string', - 'example' => 'WafBlockIP', - ], - 'PlaybookUuid' => [ - 'title' => '剧本UUID。', - 'description' => 'The UUID of the playbook.'."\n", - 'type' => 'string', - 'example' => 'system_aliyun_clb_process_book', - ], - ], - ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code that is returned.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - ], - ], + [ + 'name' => 'AlertType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'required' => false, 'example' => 'WEBSHELL'], ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + [ + 'name' => 'AlertTypeMds', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'required' => false, 'example' => '${siem_rule_type_process_abnormal_command}'], ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"PlaybookName\\": \\"WafBlockIP\\",\\n \\"PlaybookUuid\\": \\"system_aliyun_clb_process_book\\"\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeDisposeStrategyPlaybook', - ], - 'RestoreCapacity' => [ - 'summary' => 'Releases storage to reduce the storage usage. The release operation is irreversible and may cause data loss. Proceed with caution.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'LogType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The log type of the rule.', 'type' => 'string', 'required' => false, 'example' => 'ALERT_ACTIVITY'], ], - ], - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'update', - 'abilityTreeCode' => '173446', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', + [ + 'name' => 'LogTypeMds', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The Medusa code of the log type.', 'type' => 'string', 'required' => false, 'example' => '${security_event_config.event_name.webshellName_clientav}'], ], - ], - 'parameters' => [ [ - 'name' => 'RoleType', + 'name' => 'LogSource', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'required' => false, 'example' => 'cloud_siem_aegis_sas_alert'], ], [ - 'name' => 'RoleFor', + 'name' => 'LogSourceMds', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['title' => '', 'description' => 'The Medusa code of the log source.', 'type' => 'string', 'required' => false, 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}'], ], [ - 'name' => 'RegionId', + 'name' => 'RuleCondition', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The query condition of the rule. The value is a JSON string.', 'type' => 'string', 'required' => false, 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]'], ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemResponse'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the release command has been sent. Valid values:'."\n" - ."\n" - .'* true: The command has been sent and the storage space is being released.'."\n" - .'* false: The command failed to be sent.'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-58D4-55B2-87B9-74D413F7****', - ], - ], - ], + [ + 'name' => 'RuleGroup', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The fields that are used to group logs. The value is a JSON array.', 'type' => 'string', 'required' => false, 'example' => '["asset_id"]'], ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + [ + 'name' => 'RuleThreshold', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The threshold configuration of the rule. The value is a JSON string.', 'type' => 'string', 'required' => false, 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}'], ], - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'RestoreCapacity', - ], - 'GetCapacity' => [ - 'summary' => 'Queries the storage capacity usage of the threat analysis feature and the purchased storage capacity', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'QueryCycle', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The length of the rule window.', 'type' => 'string', 'required' => false, 'example' => '{"time":"1","unit":"HOUR"}'], ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '155452', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', + [ + 'name' => 'EventTransferSwitch', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'Specifies whether to convert alerts into events. Valid values:'."\n" + ."\n" + .'- 0: no'."\n" + ."\n" + .'- 1: yes', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], + ], + [ + 'name' => 'EventTransferType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n" + ."\n" + .'- default: the default method'."\n" + ."\n" + .'- singleToSingle: An event is generated for each alert.'."\n" + ."\n" + .'- allToSingle: An event is generated for all alerts in a period.', 'type' => 'string', 'required' => false, 'example' => 'allToSingle'], + ], + [ + 'name' => 'EventTransferExt', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value indicates the length and unit of the alert aggregation window.', 'type' => 'string', 'required' => false, 'example' => '{"time":"1","unit":"MINUTE"}'], ], - ], - 'parameters' => [ [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that are managed by the administrator.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID that is used to switch the administrator\'s perspective to a member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center of Threat Analysis is located. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: assets in the Chinese mainland and China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: assets outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<CloudSiemCapacityResponse>', - 'description' => 'CloudSiemResponse'."\n", + 'title' => 'BaseResponse<CloudSiemCustomizeRule>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The information about the storage capacity.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'UsedCapacity' => [ - 'title' => '威胁分析当前计费容量。', - 'description' => 'The billable storage capacity of the threat analysis feature. Unit: GB.'."\n", - 'type' => 'number', - 'format' => 'double', - 'example' => '10', - ], - 'PreservedCapacity' => [ - 'title' => '威胁分析用户购买容量。', - 'description' => 'The purchased storage capacity of the threat analysis feature. Unit: GB.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '9000', - ], - 'ExistLogStore' => [ - 'title' => '威胁分析用户侧LogStore是否存在，默认true。取值：'."\n" - .'- true：当前日志正常，日志分析可用'."\n" - .'- false：当前正在清理日志，日志分析不可用', - 'description' => 'Indicates whether the Logstores for the threat analysis feature exist on the user side. Valid values:'."\n" - ."\n" - .'* true: The logs are in the normal state. The log analysis feature is available.'."\n" - .'* false: The logs are being cleared. The log analysis feature is unavailable.'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'AgentManagedAssetQuota' => [ - 'title' => 'Agent调用实例量已购额度', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1', - ], - 'AgentManagedAssetUsed' => [ - 'title' => 'Agent调用实例量已用量', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1', - ], + 'Id' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'example' => '123456789'], + 'GmtCreate' => ['title' => '', 'description' => 'The time when the custom rule was created.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'GmtModified' => ['title' => '', 'description' => 'The time when the custom rule was last updated.', 'type' => 'string', 'example' => '2021-01-06 16:37:29'], + 'Aliuid' => ['title' => '', 'description' => 'The ID of the Alibaba Cloud account that is used to purchase Threat Analysis.', 'type' => 'integer', 'format' => 'int64', 'example' => '127608589417****'], + 'RuleName' => ['title' => '', 'description' => 'The name of the rule.', 'type' => 'string', 'example' => 'waf_scan'], + 'RuleDesc' => ['title' => '', 'description' => 'The description of the rule.', 'type' => 'string', 'example' => 'this rule is for waf scan'], + 'RuleType' => ['title' => '', 'description' => 'The rule type. Valid values:'."\n" + ."\n" + .'- predefine: predefined'."\n" + ."\n" + .'- customize: custom', 'type' => 'string', 'example' => 'customize'], + 'ThreatLevel' => ['title' => '', 'description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: high'."\n" + ."\n" + .'- suspicious: medium'."\n" + ."\n" + .'- remind: low', 'type' => 'string', 'example' => 'remind'], + 'AlertType' => ['title' => '', 'description' => 'The threat type.', 'type' => 'string', 'example' => 'WEBSHELL'], + 'AlertTypeMds' => ['title' => '', 'description' => 'The Medusa code of the threat type.', 'type' => 'string', 'example' => '${siem_rule_type_process_abnormal_command}'], + 'LogType' => ['title' => '', 'description' => 'The log type of the rule.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY'], + 'LogTypeMds' => ['title' => '', 'description' => 'The Medusa code of the log type.', 'type' => 'string', 'example' => '${security_event_config.event_name.webshellName_clientav}'], + 'LogSource' => ['title' => '', 'description' => 'The log source of the rule.', 'type' => 'string', 'example' => 'cloud_siem_aegis_sas_alert'], + 'LogSourceMds' => ['title' => '', 'description' => 'The Medusa code of the log source.', 'type' => 'string', 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}'], + 'RuleCondition' => ['title' => '', 'description' => 'The query condition of the rule in the JSON format. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]'], + 'RuleGroup' => ['title' => '', 'description' => 'The fields that are used to group logs. The value is a JSON array. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '["asset_id"]'], + 'RuleThreshold' => ['title' => '', 'description' => 'The threshold configuration of the rule in the JSON format. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}'], + 'QueryCycle' => ['title' => '', 'description' => 'The length of the rule window. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '{"time":"1","unit":"HOUR"}'], + 'AttCk' => ['title' => '告警附加字段attck', 'description' => 'The ATT\\&CK attack technique.', 'type' => 'string', 'example' => 'T1595.002 Vulnerability Scanning'], + 'EventTransferSwitch' => ['title' => '', 'description' => 'Indicates whether alerts are converted into events. Valid values:'."\n" + ."\n" + .'- 0: no'."\n" + ."\n" + .'- 1: yes', 'type' => 'integer', 'format' => 'int32', 'example' => '1'], + 'EventTransferType' => ['title' => '', 'description' => 'The event generation method. Valid values:'."\n" + ."\n" + .'- default: the default method'."\n" + ."\n" + .'- singleToSingle: An event is generated for each alert.'."\n" + ."\n" + .'- allToSingle: An event is generated for all alerts in a period.', 'type' => 'string', 'example' => 'allToSingle'], + 'EventTransferExt' => ['title' => '', 'description' => 'The extended information for event generation. This parameter is returned only when EventTransferType is set to allToSingle. The value indicates the length and unit of the alert aggregation window. You must unescape the HTML escape characters.', 'type' => 'string', 'example' => '{"time":"1","unit":"MINUTE"}'], + 'Status' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- 0: initial'."\n" + ."\n" + .'- 10: testing with simulated data'."\n" + ."\n" + .'- 15: testing with business data'."\n" + ."\n" + .'- 20: test with business data ends'."\n" + ."\n" + .'- 100: published', 'type' => 'integer', 'format' => 'int32', 'example' => '0'], + 'DataType' => ['description' => 'The data type of the condition field in the automated response rule.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => 'varchar'], ], + 'example' => '123456', ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '27D27DCB-D76B-5064-8B3B-0900DEF7****', - ], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ + 400 => [ + ['errorCode' => 'CloudSiemCustomizeRuleUpdateExcepiton', 'errorMessage' => 'this customize rule can only update in init status.', 'description' => ''], + ['errorCode' => 'CloudSiemCustomizeRuleConditionExceedExcepiton', 'errorMessage' => 'the number of rule conditions cannot exceed 100.', 'description' => ''], + ['errorCode' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', 'errorMessage' => 'the rule name is duplicated.', 'description' => ''], + ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - [ - 'errorCode' => 'Siem.Storage.Exception', - 'errorMessage' => 'The request timed out, try again.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"UsedCapacity\\": 10,\\n \\"PreservedCapacity\\": 9000,\\n \\"ExistLogStore\\": true,\\n \\"AgentManagedAssetQuota\\": 1,\\n \\"AgentManagedAssetUsed\\": 1\\n },\\n \\"RequestId\\": \\"27D27DCB-D76B-5064-8B3B-0900DEF7****\\"\\n}","type":"json"}]', - 'title' => 'GetCapacity', - ], - 'SetStorage' => [ - 'summary' => 'Configures the settings of log storage, such as the storage duration and storage region.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'PostCustomizeRule', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRule'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:PostCustomizeRule', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"RuleName\\": \\"waf_scan\\",\\n \\"RuleDesc\\": \\"this rule is for waf scan\\",\\n \\"RuleType\\": \\"customize\\",\\n \\"ThreatLevel\\": \\"remind\\",\\n \\"AlertType\\": \\"WEBSHELL\\",\\n \\"AlertTypeMds\\": \\"${siem_rule_type_process_abnormal_command}\\",\\n \\"LogType\\": \\"ALERT_ACTIVITY\\",\\n \\"LogTypeMds\\": \\"${security_event_config.event_name.webshellName_clientav}\\",\\n \\"LogSource\\": \\"cloud_siem_aegis_sas_alert\\",\\n \\"LogSourceMds\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_sas_alert}\\",\\n \\"RuleCondition\\": \\"[[{"not":false,"left":"alert_name","operator":"=","right":"WEBSHELL"}]]\\",\\n \\"RuleGroup\\": \\"["asset_id"]\\",\\n \\"RuleThreshold\\": \\"{"aggregateFunction":"count","aggregateFunctionName":"count","field":"activity_name","operator":"<=","value":1}\\",\\n \\"QueryCycle\\": \\"{"time":"1","unit":"HOUR"}\\",\\n \\"AttCk\\": \\"T1595.002 Vulnerability Scanning\\",\\n \\"EventTransferSwitch\\": 1,\\n \\"EventTransferType\\": \\"allToSingle\\",\\n \\"EventTransferExt\\": \\"{"time":"1","unit":"MINUTE"}\\",\\n \\"Status\\": 0,\\n \\"DataType\\": 0\\n },\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'PostCustomizeRuleTest' => [ + 'summary' => 'Submits a custom rule for testing.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'update', - 'abilityTreeCode' => '179221', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Ttl', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '日志存储天数，默认180天。该值最小设置为30天，最大不能超过3000天。', - 'description' => 'The storage duration of logs. Default value: 180. Minimum value: 30. Maximum value: 3000. Unit: days.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'example' => '180', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ - 'name' => 'Region', + 'name' => 'TestType', 'in' => 'formData', - 'schema' => [ - 'title' => '日志存储地域。', - 'description' => 'The storage region of logs.'."\n" - ."\n" - .'If the data management center is **cn-hangzhou**, the default value of **Region** is cn-shanghai, which specifies the China (Shanghai) region. If the data management center is **ap-southeast-1**, the default value of **Region** is ap-southeast-1, which specifies the Singapore region.'."\n" - ."\n" - .'The region for log storage cannot be changed. To change the region, contact the technical support of threat analysis.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-shanghai', - ], + 'schema' => ['title' => '', 'description' => 'The test type. Valid values:'."\n" + ."\n" + .'- simulate: tests the rule with simulated data'."\n" + ."\n" + .'- business: tests the rule with business data', 'type' => 'string', 'required' => false, 'example' => 'simulate'], + ], + [ + 'name' => 'SimulatedData', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The simulated data for the test. This parameter is required only when TestType is set to simulate.', 'type' => 'string', 'required' => false, 'example' => '[{"key1":"value1","key2":"value2","key3":"value3","key4":"value4","key5":"value5"}]'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member that the administrator wants to impersonate to view data.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select the region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemResponse'."\n", + 'title' => 'BaseResponse', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the settings are saved. Valid values:'."\n" - ."\n" - .'* true:'."\n" - .'* false:'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-58D4-55B2-87B9-74D413F7****', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'any', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'Siem.TTL.Limit', - 'errorMessage' => 'TTL should be set 30 days at least', - ], - ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'SetStorage', - ], - 'DescribeStorage' => [ - 'summary' => 'Queries the status of the Logstores for the threat analysis feature in Simple Log Service on the user side.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'PostCustomizeRuleTest', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRuleTest'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:PostCustomizeRuleTest', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'PostEventDisposeAndWhiteruleList' => [ + 'summary' => 'Submit incident response information to update the incident status and severity level.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', - 'abilityTreeCode' => '190429', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], + 'operationType' => 'create', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasAFG0OH'], ], 'parameters' => [ [ - 'name' => 'RoleType', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The globally unique UUID of the incident.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => '', 'required' => false], ], [ - 'name' => 'RoleFor', + 'name' => 'Status', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '137820528780****', - ], + 'schema' => ['description' => 'The incident status. Valid values:'."\n" + ."\n" + .'- 0: Not handled'."\n" + ."\n" + .'- 1: Handling'."\n" + ."\n" + .'- 5: Failed'."\n" + ."\n" + .'- 10: Handled', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => '', 'required' => false], ], [ - 'name' => 'RegionId', + 'name' => 'Remark', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'A note about the incident.', 'type' => 'string', 'example' => 'dealed', 'title' => '', 'required' => false], ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemResponse'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the projects and Logstores that are created for the threat analysis feature exist in Simple Log Service. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => 'CCEEE128-6607-503E-AAA6-C5E57D94****', - ], - ], - ], - ], - ], - 'errorCodes' => [ - 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - [ - 'errorCode' => 'SLS.Operation.Error', - 'errorMessage' => 'SLS service is unavailable!', - ], - ], - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"CCEEE128-6607-503E-AAA6-C5E57D94****\\"\\n}","type":"json"}]', - 'title' => 'DescribeStorage', - ], - 'GetStorage' => [ - 'summary' => 'Queries the storage configurations for the threat analysis feature on the user side.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'http', - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'EventDispose', + 'in' => 'formData', + 'schema' => ['description' => 'A JSON object that defines the incident response configuration.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "playbookName": "WafBlockIP",'."\n" + .' "entityId": "104466118",'."\n" + .' "scope": ['."\n" + .' "176618589410****"'."\n" + .' ],'."\n" + .' "startTime": 1604168946281,'."\n" + .' "endTime": 1614168946281'."\n" + .' },'."\n" + .' {'."\n" + .' "playbookName": "WafBlockIP",'."\n" + .' "entityId": "104466118",'."\n" + .' "scope": ['."\n" + .' {'."\n" + .' "instanceId": "waf-cn-n6w1oy1****",'."\n" + .' "domains": ['."\n" + .' "lmfip.wafqax.***"'."\n" + .' ]'."\n" + .' }'."\n" + .' ],'."\n" + .' "startTime": 1604168946281,'."\n" + .' "endTime": 1614168946281'."\n" + .' }'."\n" + .']', 'title' => '', 'required' => false], ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'abilityTreeCode' => '179222', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', + [ + 'name' => 'ReceiverInfo', + 'in' => 'formData', + 'schema' => ['description' => 'A JSON object that defines the alert recipient configuration.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '{'."\n" + .' "messageTitle": "test",'."\n" + .' "receiver": "xiaowang",'."\n" + .' "channel": "message"'."\n" + .'}'], ], - ], - 'parameters' => [ [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: Current Alibaba Cloud account view'."\n" + ."\n" + .'- 1: View for all accounts in your enterprise', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '127XXXX', - ], + 'schema' => ['description' => 'The UID of the member whose perspective an administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the Data Management service for threat analysis is deployed. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets in the Chinese mainland or Hong Kong (China)'."\n" + ."\n" + .'- ap-southeast-1: Assets outside China', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => '', 'required' => false], + ], + [ + 'name' => 'ThreatLevel', + 'in' => 'formData', + 'schema' => ['description' => 'The threat level. Valid values:'."\n" + ."\n" + .'- serious: Important'."\n" + ."\n" + .'- suspicious: Medium'."\n" + ."\n" + .'- remind: Low', 'type' => 'string', 'required' => false, 'example' => 'remind', 'title' => ''], + ], + [ + 'name' => 'Owner', + 'in' => 'formData', + 'schema' => ['description' => 'The UID of the incident owner.', 'type' => 'string', 'example' => '1234567890xxxxxx', 'title' => '', 'required' => false], + ], + [ + 'name' => 'ResponseSource', + 'in' => 'formData', + 'schema' => ['description' => 'The source of the response policy.', 'type' => 'string', 'required' => false, 'example' => 'system', 'title' => ''], + ], + [ + 'name' => 'DisposeStrategyIds', + 'in' => 'formData', + 'schema' => ['description' => 'A comma-separated list of response strategy IDs.', 'type' => 'string', 'required' => false, 'example' => '12,13,14', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<CloudSiemStorageResponse>', - 'description' => 'CloudSiemResponse'."\n", + 'title' => 'BaseResponse<String>', + 'description' => 'BaseResponse\\<string>', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The information about the storage.'."\n", - 'type' => 'object', - 'properties' => [ - 'Ttl' => [ - 'title' => '存储天数。', - 'description' => 'The storage period of logs. Unit: day. Default value: 180. Valid values: 30 to 3000.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '180', - ], - 'Region' => [ - 'title' => '存储地域（region）。', - 'description' => 'The region where the data is stored.'."\n" - ."\n" - .'If the data management center is **cn-hangzhou**, the default value of **Region** is cn-shanghai, which specifies the China (Shanghai) region. If the data management center is **ap-southeast-1**, the default value of **Region** is ap-southeast-1, which specifies the Singapore region.'."\n", - 'type' => 'string', - 'example' => 'cn-shanghai', - ], - 'DisplayRegion' => [ - 'title' => '是否拥有修改存储地域的权限，默认值false。取值：'."\n" - .'- true：拥有修改存储地域的权限'."\n" - .'- false：不拥有修改存储地域的权限', - 'description' => 'Indicates whether the storage region can be changed. Default value: false Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'false', - ], - 'CanOperate' => [ - 'title' => '当前是否可以操作存储地域（存储地域仅能操作一次），默认值false。取值：'."\n" - .'- true：可以修改存储地域'."\n" - .'- false：不可以修改存储地域', - 'description' => 'Indicates whether the storage region can be changed for once. Default value: false Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'false', - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '97A31C3A-3F9F-5866-8979-5159E3DC****', - ], + 'Data' => ['description' => 'The response value.', 'type' => 'string', 'example' => '123456', 'title' => ''], + 'Success' => ['description' => 'Indicates whether the request succeeded. Valid values:'."\n" + ."\n" + .'- true: succeeded'."\n" + ."\n" + .'- false: failed', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Code' => ['description' => 'The HTTP status code.', 'type' => 'integer', 'format' => 'int32', 'example' => '200', 'title' => ''], + 'Message' => ['description' => 'The response message.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Ttl\\": 180,\\n \\"Region\\": \\"cn-shanghai\\",\\n \\"DisplayRegion\\": false,\\n \\"CanOperate\\": false\\n },\\n \\"RequestId\\": \\"97A31C3A-3F9F-5866-8979-5159E3DC****\\"\\n}","type":"json"}]', - 'title' => 'GetStorage', - ], - 'ListDelivery' => [ - 'summary' => 'Queries the information about the cloud services that are integrated with the threat analysis feature, the logs of the cloud services, and the delivery of the logs.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'title' => 'PostEventDisposeAndWhiteruleList', + 'changeSet' => [ + ['createdAt' => '2024-12-23T09:00:54.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-04-17T12:43:24.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventDisposeAndWhiteruleList'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:PostEventDisposeAndWhiteruleList', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + ], + 'PostEventWhiteruleList' => [ + 'summary' => 'Submits alert whitelisting rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'abilityTreeCode' => '155305', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - ], + 'systemTags' => ['operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ + 'name' => 'IncidentUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The globally unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + ], + [ + 'name' => 'WhiteruleList', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The alert whitelisting rule, which is a JSON object.', 'type' => 'string', 'required' => true, 'example' => '['."\n" + .' {'."\n" + .' "alertName": "webshell",'."\n" + .' "alertNameId": "webshell",'."\n" + .' "alertType": "command",'."\n" + .' "alertTypeId": "command",'."\n" + .' "expression": {'."\n" + .' "status": 1,'."\n" + .' "conditions": ['."\n" + .' {'."\n" + .' "isNot": false,'."\n" + .' "left": {'."\n" + .' "value": "file_path"'."\n" + .' },'."\n" + .' "operator": "gt",'."\n" + .' "right": {'."\n" + .' "value": "cp"'."\n" + .' }'."\n" + .' }'."\n" + .' ]'."\n" + .' }'."\n" + .' }'."\n" + .']'], + ], + [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The account scope to which the rule applies. Valid values:'."\n" + ."\n" + .'- 0: The current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: All accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of a member account. An administrator can use this parameter to switch to the perspective of the member account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the threat analysis feature is deployed. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: For assets in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: For assets in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<CloudSiemAnalyzeResponse>', - 'description' => 'BaseResponse'."\n", + 'title' => 'BaseResponse<String>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The response parameters.'."\n", - 'type' => 'object', - 'properties' => [ - 'ProjectName' => [ - 'title' => '威胁分析用户侧日志服务Project名字，格式：aliyun-cloudsiem-data-${aliUid}-${region}。', - 'description' => 'The name of the project for the threat analysis feature in Simple Log service on the user side. The value is in the aliyun-cloudsiem-data-${aliUid}-${region} format.'."\n", - 'type' => 'string', - 'example' => 'aliyun-cloudsiem-data-127608589417****-cn-shanghai', - ], - 'LogStoreName' => [ - 'title' => '威胁分析用户侧LogStore的名字，格式：cloud_siem。', - 'description' => 'The name of the Logstore for the threat analysis feature on the user side. The value is in the cloud_siem format.'."\n", - 'type' => 'string', - 'example' => 'cloud-siem', - ], - 'SearchUrl' => [ - 'title' => '日志分析页面中查询分析的URL。', - 'description' => 'The URL that is used for log analysis.'."\n", - 'type' => 'string', - 'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n" - .'/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true', - ], - 'DashboardUrl' => [ - 'title' => '日志分析页面中报表展示的URL。', - 'description' => 'The URL that is displayed in charts.'."\n", - 'type' => 'string', - 'example' => 'https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai'."\n" - .'/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true', - ], - 'DisplaySwitchOrNot' => [ - 'title' => '是否展示投递开关，默认true，取值：'."\n" - .'- true：显示投递开关'."\n" - .'- false：隐藏投递开关', - 'description' => 'Indicates whether the log delivery switch is displayed. Default value: true. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'ProductList' => [ - 'title' => '接入的产品列表。', - 'description' => 'The cloud services.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'ProductCode' => [ - 'title' => '云产品编码。取值：'."\n" - .'- qcloud_waf'."\n" - .'- qlcoud_cfw'."\n" - .'- hcloud_waf'."\n" - .'- hcloud_cfw'."\n" - .'- ddos'."\n" - .'- sas'."\n" - .'- cfw'."\n" - .'- config'."\n" - .'- csk'."\n" - .'- fc'."\n" - .'- rds'."\n" - .'- nas'."\n" - .'- apigateway'."\n" - .'- cdn'."\n" - .'- mongodb'."\n" - .'- eip'."\n" - .'- slb'."\n" - .'- vpc'."\n" - .'- actiontrail'."\n" - .'- waf'."\n" - .'- bastionhost'."\n" - .'- oss'."\n" - .'- polardb', - 'description' => 'The code of the cloud service. Valid values:'."\n" - ."\n" - .'* qcloud_waf'."\n" - .'* qlcoud_cfw'."\n" - .'* hcloud_waf'."\n" - .'* hcloud_cfw'."\n" - .'* ddos'."\n" - .'* sas'."\n" - .'* cfw'."\n" - .'* config'."\n" - .'* csk'."\n" - .'* fc'."\n" - .'* rds'."\n" - .'* nas'."\n" - .'* apigateway'."\n" - .'* cdn'."\n" - .'* mongodb'."\n" - .'* eip'."\n" - .'* slb'."\n" - .'* vpc'."\n" - .'* actiontrail'."\n" - .'* waf'."\n" - .'* bastionhost'."\n" - .'* oss'."\n" - .'* polardb'."\n", - 'type' => 'string', - 'example' => 'sas', - ], - 'ProductName' => [ - 'title' => '所属厂商名称', - 'description' => 'This parameter is deprecated.'."\n", - 'type' => 'string', - 'example' => 'Security Center', - ], - 'LogMap' => [ - 'title' => '存在日志分类的日志列表', - 'description' => 'The log group. For example, in Security Center, the logs of hosts and networks are stored in different groups. Key indicates the group information, and value indicates the logs in the group.'."\n", - 'type' => 'object', - 'additionalProperties' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'LogCode' => [ - 'title' => '日志编码。', - 'type' => 'string', - 'example' => 'cloud_siem_config_log', - 'description' => 'The code of the log.'."\n", - ], - 'LogName' => [ - 'title' => '日志中文名字。', - 'type' => 'string', - 'description' => 'This parameter is deprecated.'."\n", - 'example' => 'audit log', - ], - 'LogNameEn' => [ - 'title' => '日志英文名字。', - 'type' => 'string', - 'example' => 'audit log', - 'description' => 'This parameter is deprecated.'."\n", - ], - 'LogNameKey' => [ - 'title' => '日志语言编码，用于进行多语言名字的展示。', - 'type' => 'string', - 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}', - 'description' => 'The language code of the log that is used to indicate the language in which the log is displayed.'."\n", - ], - 'Status' => [ - 'title' => '日志投递状态。', - 'type' => 'boolean', - 'description' => 'The status of the log delivery. Valid values:'."\n" - ."\n" - .'* true: The logs are being delivered.'."\n" - .'* false: The log delivery feature is disabled.'."\n", - 'example' => 'true', - ], - 'CanOperateOrNot' => [ - 'title' => '是否可以操作投递开关。', - 'type' => 'boolean', - 'example' => 'true', - 'description' => 'Indicates whether the log delivery feature can be enabled or disabled. The feature can be enabled or disabled only by the administrator of the threat analysis feature. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - ], - 'Topic' => [ - 'title' => '日志在用户侧存储的Topic。', - 'type' => 'string', - 'description' => 'The topic of the log in the Logstore. The value is an index field in the Logstore that can be used to distinguish different logs.'."\n", - 'example' => 'sas_login_event', - ], - 'ExtraParameters' => [ - 'title' => '扩展参数。', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Key' => [ - 'type' => 'string', - 'example' => 'flag', - 'description' => 'The ID of the extended parameter.'."\n", - ], - 'Value' => [ - 'type' => 'string', - 'example' => 'value', - 'description' => 'The value of the extended parameter.'."\n", - ], - ], - 'description' => '', - ], - 'description' => 'The extended parameter.'."\n", - ], - ], - 'description' => '', - ], - 'description' => 'The logs in a log group.'."\n", - ], - ], - 'LogList' => [ - 'title' => '不存在日志分类的日志列表', - 'description' => 'The logs of the cloud services.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'LogCode' => [ - 'title' => '日志编码。', - 'description' => 'The code of the log.'."\n", - 'type' => 'string', - 'example' => 'cloud_siem_config_log', - ], - 'LogName' => [ - 'title' => '日志中文名字。', - 'description' => 'This parameter is deprecated.'."\n", - 'type' => 'string', - 'example' => 'audit log', - ], - 'LogNameEn' => [ - 'title' => '日志英文名字。', - 'description' => 'This parameter is deprecated.'."\n", - 'type' => 'string', - 'example' => 'audit log'."\n", - ], - 'LogNameKey' => [ - 'title' => '日志语言编码，用于进行多语言名字的展示。', - 'description' => 'The language code of the log that is used to indicate the language in which the log is displayed.'."\n", - 'type' => 'string', - 'example' => '${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}', - ], - 'Status' => [ - 'title' => '日志投递状态。', - 'description' => 'The status of the log delivery. Valid values:'."\n" - ."\n" - .'* true: The logs are being delivered.'."\n" - .'* false: The log delivery feature is disabled.'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'CanOperateOrNot' => [ - 'title' => '是否可以操作投递开关。', - 'description' => 'Indicates whether the log delivery feature can be enabled or disabled. The feature can be enabled or disabled only by the administrator of the threat analysis feature. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Topic' => [ - 'title' => '日志在用户侧存储的Topic。', - 'description' => 'The topic of the log in the Logstore. The value is an index field in the Logstore that can be used to distinguish different logs.'."\n", - 'type' => 'string', - 'example' => 'sas_login_event', - ], - 'ExtraParameters' => [ - 'title' => '扩展参数。', - 'description' => 'The extended parameter.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'Key' => [ - 'description' => 'The ID of the extended parameter.'."\n", - 'type' => 'string', - 'example' => 'flag', - ], - 'Value' => [ - 'description' => 'The value of the extended parameter.'."\n", - 'type' => 'string', - 'example' => 'value', - ], - ], - ], - ], - ], - ], - ], - ], - ], - ], - ], - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '6276D891-58D4-55B2-87B9-74D413F7****', - ], + 'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'string', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The returned message.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - [ - 'errorCode' => 'SLS.Sls4Service.Error', - 'errorMessage' => 'The Simple Log Service about embedding console pages is unavailable.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"ProjectName\\": \\"aliyun-cloudsiem-data-127608589417****-cn-shanghai\\",\\n \\"LogStoreName\\": \\"cloud-siem\\",\\n \\"SearchUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/logsearch/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n \\"DashboardUrl\\": \\"https://sls4service.console.aliyun.com/lognext/project/aliyun-cloudsiem-data-127608589417****-cn-shanghai\\\\n/dashboard/cloud-siem?isShare=true&hideTopbar=true&hideSidebar=true&ignoreTabLocalStorage=true\\",\\n \\"DisplaySwitchOrNot\\": true,\\n \\"ProductList\\": [\\n {\\n \\"ProductCode\\": \\"sas\\",\\n \\"ProductName\\": \\"Security Center\\",\\n \\"LogMap\\": {\\n \\"key\\": [\\n {\\n \\"LogCode\\": \\"cloud_siem_config_log\\",\\n \\"LogName\\": \\"audit log\\",\\n \\"LogNameEn\\": \\"audit log\\",\\n \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n \\"Status\\": true,\\n \\"CanOperateOrNot\\": true,\\n \\"Topic\\": \\"sas_login_event\\",\\n \\"ExtraParameters\\": [\\n {\\n \\"Key\\": \\"flag\\",\\n \\"Value\\": \\"value\\"\\n }\\n ]\\n }\\n ]\\n },\\n \\"LogList\\": [\\n {\\n \\"LogCode\\": \\"cloud_siem_config_log\\",\\n \\"LogName\\": \\"audit log\\",\\n \\"LogNameEn\\": \\"audit log\\\\n\\",\\n \\"LogNameKey\\": \\"${sas.cloudsiem.prod.cloud_siem_aegis_crack_from_beaver}\\",\\n \\"Status\\": true,\\n \\"CanOperateOrNot\\": true,\\n \\"Topic\\": \\"sas_login_event\\",\\n \\"ExtraParameters\\": [\\n {\\n \\"Key\\": \\"flag\\",\\n \\"Value\\": \\"value\\"\\n }\\n ]\\n }\\n ]\\n }\\n ]\\n },\\n \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - 'title' => 'ListDelivery', - ], - 'OpenDelivery' => [ - 'summary' => 'Enables the log delivery feature for a cloud service that is integrated with Simple Log Service.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'PostEventWhiteruleList', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventWhiteruleList'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:PostEventWhiteruleList', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'PostFinishCustomizeRuleTest' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'paid', - 'abilityTreeCode' => '154876', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - ], + 'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'ProductCode', - 'in' => 'formData', - 'schema' => [ - 'title' => '云产品的编码。取值：'."\n" - .'- qcloud_waf'."\n" - .'- qlcoud_cfw'."\n" - .'- hcloud_waf'."\n" - .'- hcloud_cfw'."\n" - .'- ddos'."\n" - .'- sas'."\n" - .'- cfw'."\n" - .'- config'."\n" - .'- csk'."\n" - .'- fc'."\n" - .'- rds'."\n" - .'- nas'."\n" - .'- apigateway'."\n" - .'- cdn'."\n" - .'- mongodb'."\n" - .'- eip'."\n" - .'- slb'."\n" - .'- vpc'."\n" - .'- actiontrail'."\n" - .'- waf'."\n" - .'- bastionhost'."\n" - .'- oss'."\n" - .'- polardb', - 'description' => 'The code of the cloud service. Valid values:'."\n" - ."\n" - .'* qcloud_waf'."\n" - .'* qlcoud_cfw'."\n" - .'* hcloud_waf'."\n" - .'* hcloud_cfw'."\n" - .'* ddos'."\n" - .'* sas'."\n" - .'* cfw'."\n" - .'* config'."\n" - .'* csk'."\n" - .'* fc'."\n" - .'* rds'."\n" - .'* nas'."\n" - .'* apigateway'."\n" - .'* cdn'."\n" - .'* mongodb'."\n" - .'* eip'."\n" - .'* slb'."\n" - .'* vpc'."\n" - .'* actiontrail'."\n" - .'* waf'."\n" - .'* bastionhost'."\n" - .'* oss'."\n" - .'* polardb'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'cfw', - ], - ], - [ - 'name' => 'LogCode', + 'name' => 'Id', 'in' => 'formData', - 'schema' => [ - 'title' => '云产品下的日志code，比如云安全中心的进程日志，取值参考ListDelivery的返回值。', - 'description' => 'The log code of the cloud service, such as the code of the process log for Security Center. This parameter is optional. If you leave this parameter empty, operations are performed on all logs of the cloud service.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_cfw_flow', - ], + 'schema' => ['title' => '', 'description' => 'The ID of the custom rule.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '123456789'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts within the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to a member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select the region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: The assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemResponse'."\n", + 'title' => 'BaseResponse', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the log delivery feature is enabled. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '15FD134E-D69B-51E8-B052-73F97BD8****', - ], + 'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'any', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request is successful. Valid values:'."\n" + ."\n" + .'- true: The request is successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'Siem.Delivery.MissingProductCode', - 'errorMessage' => 'ProductCode is mandatory for this action.', - ], - ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - [ - 'errorCode' => 'Siem.Delivery.ErrorMapping', - 'errorMessage' => 'The Mapping between productCode and logCode is error.', - ], - [ - 'errorCode' => 'Siem.Delivery.ErrorProductCode', - 'errorMessage' => 'ProductCode is error for this action.', - ], - [ - 'errorCode' => 'SLS.Ship.Error', - 'errorMessage' => 'The Simple Log Service about data shipping is unavailable.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"15FD134E-D69B-51E8-B052-73F97BD8****\\"\\n}","type":"json"}]', - 'title' => 'OpenDelivery', - ], - 'CloseDelivery' => [ - 'summary' => 'Disables the log delivery feature for a cloud service.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'PostFinishCustomizeRuleTest', + 'summary' => 'Finishes the test for a custom rule.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'http', - 'https', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostFinishCustomizeRuleTest'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:PostFinishCustomizeRuleTest', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'PostRuleStatusChange' => [ + 'summary' => 'Updates the statuses of custom rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'update', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeCode' => '154877', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - ], + 'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'ProductCode', + 'name' => 'Ids', 'in' => 'formData', - 'schema' => [ - 'title' => '云产品的编码。取值：'."\n" - .'- qcloud_waf'."\n" - .'- qlcoud_cfw'."\n" - .'- hcloud_waf'."\n" - .'- hcloud_cfw'."\n" - .'- ddos'."\n" - .'- sas'."\n" - .'- cfw'."\n" - .'- config'."\n" - .'- csk'."\n" - .'- fc'."\n" - .'- rds'."\n" - .'- nas'."\n" - .'- apigateway'."\n" - .'- cdn'."\n" - .'- mongodb'."\n" - .'- eip'."\n" - .'- slb'."\n" - .'- vpc'."\n" - .'- actiontrail'."\n" - .'- waf'."\n" - .'- bastionhost'."\n" - .'- oss'."\n" - .'- polardb', - 'description' => 'The code of the cloud service. Valid values:'."\n" - ."\n" - .'* qcloud_waf'."\n" - .'* qlcoud_cfw'."\n" - .'* hcloud_waf'."\n" - .'* hcloud_cfw'."\n" - .'* ddos'."\n" - .'* sas'."\n" - .'* cfw'."\n" - .'* config'."\n" - .'* csk'."\n" - .'* fc'."\n" - .'* rds'."\n" - .'* nas'."\n" - .'* apigateway'."\n" - .'* cdn'."\n" - .'* mongodb'."\n" - .'* eip'."\n" - .'* slb'."\n" - .'* vpc'."\n" - .'* actiontrail'."\n" - .'* waf'."\n" - .'* bastionhost'."\n" - .'* oss'."\n" - .'* polardb'."\n", - 'type' => 'string', - 'required' => true, - 'example' => 'sas', - ], + 'schema' => ['title' => '', 'description' => 'A JSON array of rule IDs.', 'type' => 'string', 'required' => false, 'example' => '[123,345]'], ], [ - 'name' => 'LogCode', + 'name' => 'RuleType', 'in' => 'formData', - 'schema' => [ - 'title' => '云产品下的日志code，比如云安全中心的进程日志，取值参考ListDelivery的返回值。', - 'description' => 'The log code of the cloud service, such as the code of the process log for Security Center. You can obtain the log code from the response of the ListDelivery operation.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_siem_aegis_proc', - ], + 'schema' => ['title' => '', 'description' => 'The type of the rule. Valid values:'."\n" + ."\n" + .'- predefine: predefined rule'."\n" + ."\n" + .'- customize: custom rule', 'type' => 'string', 'required' => false, 'example' => 'customize'], + ], + [ + 'name' => 'InUse', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- true: enabled'."\n" + ."\n" + .'- false: disabled', 'type' => 'boolean', 'required' => false, 'example' => 'true'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: the view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'CloudSiemSuccessResponse<Boolean>', - 'description' => 'CloudSiemResponse'."\n", + 'title' => 'BaseResponse', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'Indicates whether the threat analysis feature was disabled. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'RequestId' => [ - 'title' => '请求消息ID。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => 'F375A043-4F5B-55F2-A564-CC47FFC6****', - ], + 'Data' => ['title' => '', 'description' => 'The data returned.', 'type' => 'any', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request is successful. Valid values:'."\n" + ."\n" + .'- true: The request is successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'Siem.Delivery.MissingProductCode', - 'errorMessage' => 'ProductCode is mandatory for this action.', - ], - ], 500 => [ - [ - 'errorCode' => 'InternalError', - 'errorMessage' => 'The request processing has failed due to some unknown error.', - ], - [ - 'errorCode' => 'Siem.Delivery.ErrorMapping', - 'errorMessage' => 'The Mapping between productCode and logCode is error.', - ], - [ - 'errorCode' => 'Siem.Delivery.ErrorProductCode', - 'errorMessage' => 'ProductCode is error for this action.', - ], - [ - 'errorCode' => 'SLS.Ship.Error', - 'errorMessage' => 'The Simple Log Service about data shipping is unavailable.', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"F375A043-4F5B-55F2-A564-CC47FFC6****\\"\\n}","type":"json"}]', - 'title' => 'CloseDelivery', - ], - 'UpdateWhiteRuleList' => [ - 'summary' => 'Creates or updates an alert whitelist rule.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'PostRuleStatusChange', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'schemes' => [ - 'https', - 'http', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostRuleStatusChange'], + ], ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:PostRuleStatusChange', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'RestoreCapacity' => [ + 'summary' => 'Releases storage space. This operation is irreversible and causes data loss. Use with caution.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -18311,170 +12174,86 @@ 'deprecated' => false, 'systemTags' => [ 'operationType' => 'update', - 'riskType' => 'none', - 'chargeType' => 'free', + 'abilityTreeCode' => '173446', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ - 'name' => 'WhiteRuleId', - 'in' => 'formData', - 'schema' => [ - 'title' => '加白规则唯一ID。', - 'description' => 'The unique ID of the whitelist rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '123456789', - ], - ], - [ - 'name' => 'IncidentUuid', - 'in' => 'formData', - 'schema' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - ], - [ - 'name' => 'Expression', - 'in' => 'formData', - 'schema' => [ - 'title' => '告警加白规则 json对象。', - 'description' => 'The alert whitelist rule. The value is a JSON object.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '['."\n" - .' {'."\n" - .' "alertName": "webshell",'."\n" - .' "alertNameId": "webshell",'."\n" - .' "alertType": "command",'."\n" - .' "alertTypeId": "command",'."\n" - .' "expression": {'."\n" - .' "status": 1,'."\n" - .' "conditions": ['."\n" - .' {'."\n" - .' "isNot": false,'."\n" - .' "left": {'."\n" - .' "value": "file_path"'."\n" - .' },'."\n" - .' "operator": "gt",'."\n" - .' "right": {'."\n" - .' "value": "cp"'."\n" - .' }'."\n" - .' }'."\n" - .' ]'."\n" - .' }'."\n" - .' }'."\n" - .']', - ], - ], - [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: The view for the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view for all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemResponse<Boolean>', + 'description' => 'CloudSiemResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'any', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Data' => ['title' => '', 'description' => 'Indicates whether the delete command was sent. Valid values:'."\n" + ."\n" + .'- true: The delete command was sent and the cleanup is in progress.'."\n" + ."\n" + .'- false: The command failed to send.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-58D4-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'RestoreCapacity', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:02.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:23.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'UpdateWhiteRuleList', - ], - 'PostEventWhiteruleList' => [ - 'summary' => 'Submits an alert whitelist rule.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'RestoreCapacity'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:RestoreCapacity', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'SetStorage' => [ + 'summary' => 'Sets user settings, such as the storage duration and storage region.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], @@ -18482,1156 +12261,777 @@ ], 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', - 'riskType' => 'none', - 'chargeType' => 'free', + 'operationType' => 'update', + 'abilityTreeCode' => '179221', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], ], 'parameters' => [ [ - 'name' => 'IncidentUuid', + 'name' => 'Ttl', 'in' => 'formData', - 'schema' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The log storage duration in days. The default value is 180. The minimum value is 30 and the maximum value is 3000.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'example' => '180'], ], [ - 'name' => 'WhiteruleList', + 'name' => 'Region', 'in' => 'formData', - 'schema' => [ - 'title' => '告警加白规则 json对象。', - 'description' => 'The alert whitelist rule. The value is a JSON object.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '['."\n" - .' {'."\n" - .' "alertName": "webshell",'."\n" - .' "alertNameId": "webshell",'."\n" - .' "alertType": "command",'."\n" - .' "alertTypeId": "command",'."\n" - .' "expression": {'."\n" - .' "status": 1,'."\n" - .' "conditions": ['."\n" - .' {'."\n" - .' "isNot": false,'."\n" - .' "left": {'."\n" - .' "value": "file_path"'."\n" - .' },'."\n" - .' "operator": "gt",'."\n" - .' "right": {'."\n" - .' "value": "cp"'."\n" - .' }'."\n" - .' }'."\n" - .' ]'."\n" - .' }'."\n" - .' }'."\n" - .']', - ], + 'schema' => ['title' => '', 'description' => 'The log storage region.'."\n" + ."\n" + .'If the Data Management center is in cn-hangzhou, the default value of Region is **cn-shanghai**. If the Data Management center is in **ap-southeast-1**, the default value of **Region** is **ap-southeast-1**.'."\n" + ."\n" + .'The log storage region cannot be changed. To change the region, contact the Threat Analysis operations team.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The type of the view.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts in your enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the view of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for Threat Analysis. Select the region for the Data Management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Select this value if your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Select this value if your assets are in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<String>', - 'description' => 'BaseResponse'."\n", + 'title' => 'CloudSiemResponse<Boolean>', + 'description' => 'CloudSiemResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'string', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Data' => ['title' => '', 'description' => 'Indicates whether the settings were saved. Valid values:'."\n" + ."\n" + .'- true: The settings were saved.'."\n" + ."\n" + .'- false: The settings failed to be saved.', 'type' => 'boolean', 'example' => 'true'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-58D4-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ + 400 => [ + ['errorCode' => 'Siem.TTL.Limit', 'errorMessage' => 'TTL should be set 30 days at least', 'description' => ''], + ], 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'title' => 'SetStorage', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:44:01.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2023-12-13T09:49:24.000Z', 'description' => 'Error codes changed, Request parameters changed, Response parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'PostEventWhiteruleList', - ], - 'DescribeWhiteRuleList' => [ - 'summary' => 'Queries a list of whitelist rules for alerts.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SetStorage'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:SetStorage', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": true,\\n \\"RequestId\\": \\"6276D891-58D4-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'SubmitImportLogTasks' => [ + 'summary' => 'Submits a batch of log ingestion tasks.', + 'methods' => ['get', 'post'], + 'schemes' => ['http', 'https'], 'security' => [ [ 'AK' => [], ], ], + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', + 'abilityTreeCode' => '195545', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'AlertType', + 'name' => 'ProdCode', 'in' => 'formData', - 'schema' => [ - 'title' => '告警类型。', - 'description' => 'The type of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'scan', - ], + 'schema' => ['title' => '', 'description' => 'The code of the product.', 'type' => 'string', 'required' => true, 'example' => 'qcloud_waf'], ], [ - 'name' => 'AlertName', + 'name' => 'LogCodes', 'in' => 'formData', - 'schema' => [ - 'title' => '告警名称。', - 'description' => 'The name of the alert.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'Try SNMP weak password', - ], + 'schema' => ['title' => '', 'description' => 'The list of logs to be ingested. The value must be a JSON array.', 'type' => 'string', 'required' => false, 'example' => '["cloud_siem_qcloud_cfw_alert_log"]'], ], [ - 'name' => 'IncidentUuid', + 'name' => 'Accounts', 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'The list of accounts for log ingestion. The value must be a JSON array. Valid values:'."\n" + ."\n" + .'- AccountId: The ID of the account.'."\n" + ."\n" + .'- Imported: Specifies whether to enable or disable log ingestion for the account. Valid values:'."\n" + ."\n" + .' - 0: Disable ingestion.'."\n" + ."\n" + .' - 1: Enable ingestion.', 'type' => 'string', 'required' => false, 'example' => '[{"AccountId":"123123","Imported":1}]'], ], [ - 'name' => 'CurrentPage', + 'name' => 'AutoImported', 'in' => 'formData', - 'schema' => [ - 'title' => '列表当前页号， 大于等于1。', - 'description' => 'The page number. Pages start from page 1.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'Specifies whether to automatically enable log ingestion for accounts that are configured with the specified log. Valid values:'."\n" + ."\n" + .'- 1: Yes.'."\n" + ."\n" + .'- 0: No.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], ], [ - 'name' => 'PageSize', + 'name' => 'CloudCode', 'in' => 'formData', 'schema' => [ - 'title' => '列表每页条数， 最大不超过100。', - 'description' => 'The number of entries per page. Valid values: 1 to 100.'."\n", - 'type' => 'integer', - 'format' => 'int32', + 'title' => '', + 'description' => 'The code of the cloud service provider.', + 'type' => 'string', 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', + 'enum' => ['qcloud', 'hcloud', 'aliyun', 'idc'], + 'example' => 'hcloud', ], ], [ - 'name' => 'RoleType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['title' => '', 'description' => 'The region where the data management center for Threat Analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['type' => 'integer', 'format' => 'int64', 'required' => false, 'description' => 'The user ID of the member that the administrator wants to access.', 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'RegionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['type' => 'integer', 'format' => 'int32', 'required' => false, 'description' => 'The type of view. Valid values:'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts within the enterprise.', 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'PageResponse<List<WhitelistRule>>', - 'description' => 'PageResponse\\<List>'."\n", + 'title' => 'CloudSiemSuccessResponse<SubmitImportLogTasksResult>', + 'description' => 'CloudSiemSuccessResponse', 'type' => 'object', 'properties' => [ - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true:成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The response code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", + 'title' => '', + 'description' => 'The data returned.', 'type' => 'object', 'properties' => [ - 'PageInfo' => [ - 'title' => '分页记录。', - 'description' => 'The pagination information.'."\n", - 'type' => 'object', - 'properties' => [ - 'CurrentPage' => [ - 'title' => '列表当前页号。', - 'description' => 'The current page number.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'title' => '每页返回记录数。', - 'description' => 'The number of entries per page.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'title' => '记录总数。', - 'description' => 'The total number of entries returned.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - ], - ], - 'ResponseData' => [ - 'title' => '详细数据。', - 'description' => 'The detailed data.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Id' => [ - 'title' => '加白规则唯一ID。', - 'description' => 'The ID of the whitelist rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '123456789', - ], - 'GmtCreate' => [ - 'title' => '创建时间。', - 'description' => 'The time when the whitelist rule was created.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'GmtModified' => [ - 'title' => '修改时间。', - 'description' => 'The time when the whitelist rule was modified.'."\n", - 'type' => 'string', - 'example' => '2021-01-06 16:37:29', - ], - 'Aliuid' => [ - 'title' => '规则关联siem主账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to purchase the threat analysis feature.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '127608589417****', - ], - 'SubAliuid' => [ - 'title' => '规则创建阿里账号ID。', - 'description' => 'The ID of the Alibaba Cloud account that is used to create the whitelist rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'example' => '176555323***', - ], - 'AlertType' => [ - 'title' => '告警类型。', - 'description' => 'The alert type.'."\n", - 'type' => 'string', - 'example' => 'scan', - ], - 'AlertTypeId' => [ - 'title' => '告警类型标识。', - 'description' => 'The ID of the alert type.'."\n", - 'type' => 'string', - 'example' => 'scan', - ], - 'AlertName' => [ - 'title' => '告警名称。', - 'description' => 'The alert name.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'AlertNameId' => [ - 'title' => '告警名称标识。', - 'description' => 'The ID of the alert name.'."\n", - 'type' => 'string', - 'example' => 'Try SNMP weak password', - ], - 'Status' => [ - 'title' => '规则启用状态。 取值：'."\n" - .'- 1：开启'."\n" - .'- 0：关闭', - 'description' => 'The status of the whitelist rule. Valid values:'."\n" - ."\n" - .'* 1: enabled.'."\n" - .'* 0: disabled.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'IncidentUuid' => [ - 'title' => '事件全局唯一ID。', - 'description' => 'The UUID of the event.'."\n", - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'AlertUuid' => [ - 'title' => '告警ID。', - 'description' => 'The UUID of the alert.'."\n", - 'type' => 'string', - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], - 'Expression' => [ - 'title' => '规则集 json数组格式。', - 'description' => 'The conditions in the rule. The value is a JSON array.'."\n", - 'type' => 'object', - 'properties' => [ - 'Logic' => [ - 'description' => 'The logical relationships among the rule conditions.'."\n", - 'type' => 'string', - 'example' => '(1&2)|(3&4)', - ], - 'Conditions' => [ - 'description' => 'The rule conditions.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'ItemId' => [ - 'description' => 'The ID of the rule condition.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'Operator' => [ - 'description' => 'The logical operator of the rule condition. Valid values:'."\n" - ."\n" - .'* `=`: equals to.'."\n" - .'* `<>`: does not equal to.'."\n" - .'* `in`: contains.'."\n" - .'* `not in`: does not contain.'."\n" - .'* `REGEXP`: matches a regular expression.'."\n" - .'* `NOT REGEXP`: does not match a regular expression.'."\n", - 'type' => 'string', - 'example' => 'REGEXP', - ], - 'IsNot' => [ - 'description' => 'Indicates whether the result is inverted. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'false', - ], - 'Left' => [ - 'description' => 'The left operand of the rule condition.'."\n", - 'type' => 'object', - 'properties' => [ - 'Value' => [ - 'description' => 'The variable of the left operand.'."\n", - 'type' => 'string', - 'example' => 'ip', - ], - 'IsVar' => [ - 'description' => 'Indicates whether the left operand is a variable. Valid values:'."\n" - ."\n" - .'* true: variable.'."\n" - .'* false: constant.'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Type' => [ - 'description' => 'Indicates whether the left operand is a constant. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'string', - 'example' => 'false', - ], - 'Modifier' => [ - 'description' => 'The remarks on the right operand.'."\n", - 'type' => 'string', - 'example' => 'length', - ], - 'ModifierParam' => [ - 'description' => 'The key-value pair information of the remarks.'."\n", - 'type' => 'object', - 'additionalProperties' => [ - 'type' => 'any', - 'example' => '{"tage":"description"}', - 'description' => 'The key-value pair.'."\n", - ], - ], - ], - ], - 'Right' => [ - 'description' => 'The right operand of the rule condition.'."\n", - 'type' => 'object', - 'properties' => [ - 'Value' => [ - 'description' => 'The right operand.'."\n", - 'type' => 'string', - 'example' => '12345', - ], - 'IsVar' => [ - 'description' => 'Indicates whether the right operand is a constant or a runtime variable that is obtained from the runtime context. Valid values:'."\n" - ."\n" - .'* true: runtime variable.'."\n" - .'* false: constant.'."\n", - 'type' => 'boolean', - 'example' => 'false', - ], - 'Type' => [ - 'description' => 'The data type of the right operand.'."\n", - 'type' => 'string', - 'example' => 'String', - ], - 'Modifier' => [ - 'description' => 'The remarks on the right operand.'."\n", - 'type' => 'string', - 'example' => 'length', - ], - 'ModifierParam' => [ - 'description' => 'The key-value pair information of the remarks.'."\n", - 'type' => 'object', - 'additionalProperties' => [ - 'type' => 'any', - 'example' => '{"tage":"description"}', - 'description' => 'The key-value pair.'."\n", - ], - ], - ], - ], - ], - ], - ], - ], - 'example' => '[{"conditions":[{"isNot":false,"itemId":0,"left":{"value":"host_uuid.host_name"},"operator":"containsString","right":{"value":"Cloud-MCH"}}]}]', - ], - ], - ], - ], + 'Count' => ['title' => '', 'description' => 'The number of log ingestion tasks that are successfully submitted.', 'type' => 'integer', 'format' => 'int32', 'example' => '10'], ], - 'example' => '123456', + 'example' => '', ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorCode' => 'InternalError', 'errorMessage' => 'The request processing has failed due to some unknown error.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Data\\": {\\n \\"PageInfo\\": {\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 100\\n },\\n \\"ResponseData\\": [\\n {\\n \\"Id\\": 123456789,\\n \\"GmtCreate\\": \\"2021-01-06 16:37:29\\",\\n \\"GmtModified\\": \\"2021-01-06 16:37:29\\",\\n \\"Aliuid\\": 0,\\n \\"SubAliuid\\": 0,\\n \\"AlertType\\": \\"scan\\",\\n \\"AlertTypeId\\": \\"scan\\",\\n \\"AlertName\\": \\"Try SNMP weak password\\",\\n \\"AlertNameId\\": \\"Try SNMP weak password\\",\\n \\"Status\\": 1,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"AlertUuid\\": \\"sas_71e24437d2797ce8fc59692905a4****\\",\\n \\"Expression\\": {\\n \\"Logic\\": \\"(1&2)|(3&4)\\",\\n \\"Conditions\\": [\\n {\\n \\"ItemId\\": 1,\\n \\"Operator\\": \\"REGEXP\\",\\n \\"IsNot\\": false,\\n \\"Left\\": {\\n \\"Value\\": \\"ip\\",\\n \\"IsVar\\": true,\\n \\"Type\\": \\"false\\",\\n \\"Modifier\\": \\"length\\",\\n \\"ModifierParam\\": {\\n \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n }\\n },\\n \\"Right\\": {\\n \\"Value\\": \\"12345\\",\\n \\"IsVar\\": false,\\n \\"Type\\": \\"String\\",\\n \\"Modifier\\": \\"length\\",\\n \\"ModifierParam\\": {\\n \\"key\\": \\"{\\\\\\"tage\\\\\\":\\\\\\"description\\\\\\"}\\"\\n }\\n }\\n }\\n ]\\n }\\n }\\n ]\\n }\\n}","type":"json"}]', - 'title' => 'DescribeWhiteRuleList', - ], - 'DescribeAlertScene' => [ - 'summary' => 'Queries the scenarios in which an alert needs to be added to the whitelist.', - 'methods' => [ - 'get', - 'post', + 'staticInfo' => ['returnType' => 'synchronous'], + 'eventInfo' => [ + 'enable' => false, + 'eventNames' => [], ], - 'schemes' => [ - 'https', - 'http', + 'title' => 'SubmitImportLogTasks', + 'changeSet' => [ + ['createdAt' => '2024-09-27T08:27:57.000Z', 'description' => 'Request parameters changed'], + ['createdAt' => '2024-07-18T01:29:00.000Z', 'description' => 'Request parameters changed'], ], - 'security' => [ - [ - 'AK' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SubmitImportLogTasks'], ], ], - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], - 'parameters' => [ + 'ramActions' => [ [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], - ], - [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], - ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'BaseResponse<List<SceneAndTarget>>', - 'description' => 'BaseResponse\\<List>'."\n", - 'type' => 'object', - 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'AlertType' => [ - 'title' => '告警类型展示值，随中英文环境变化。', - 'description' => 'The type of the alert. The value varies based on the display language (Chinese or English) of the Security Center console.'."\n", - 'type' => 'string', - 'example' => 'unusual login', - ], - 'AlertTypeId' => [ - 'title' => '告警类型标识。', - 'description' => 'The ID of the alert type.'."\n", - 'type' => 'string', - 'example' => 'unusual login', - ], - 'AlertName' => [ - 'title' => '告警名称展示值，随中英文环境变化。', - 'description' => 'The name of the alert. The value varies based on the display language (Chinese or English) of the Security Center console.'."\n", - 'type' => 'string', - 'example' => 'login_common_ip', - ], - 'AlertNameId' => [ - 'title' => '告警名称标识。', - 'description' => 'The ID of the alert name.'."\n", - 'type' => 'string', - 'example' => 'login_common_ip', - ], - 'AlertTile' => [ - 'title' => '告警title展示值，随中英文环境变化。', - 'description' => 'The title of the alert notification. The value varies based on the display language (Chinese or English) of the Security Center console.'."\n", - 'type' => 'string', - 'example' => 'unusual login-login_common_ip', - ], - 'AlertTileId' => [ - 'title' => '告警title 标识。', - 'description' => 'The ID of the alert title.'."\n", - 'type' => 'string', - 'example' => 'unusual login-login_common_ip', - ], - 'Targets' => [ - 'title' => '加白对象。', - 'description' => 'The information about the entities for which you need to add the alert to the whitelist.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Type' => [ - 'title' => '可以加白的实体属性字段。', - 'description' => 'The attribute of the entity.'."\n", - 'type' => 'string', - 'example' => 'host_uuid', - ], - 'Name' => [ - 'title' => '可以加白的实体属性字段展示名。', - 'description' => 'The display name of the attribute for the entity.'."\n", - 'type' => 'string', - 'example' => 'HOST UUID', - ], - 'Value' => [ - 'title' => '加白规则默认展示的右值。', - 'description' => 'The right operand that is displayed by default in the whitelist rule.'."\n", - 'type' => 'string', - 'example' => '441862da-a539-4cc0-a00d-47395582****', - ], - 'Values' => [ - 'title' => '加白规则可选的右值。', - 'description' => 'The right operands supported by the whitelist rule.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The right operand.'."\n", - 'type' => 'string', - 'example' => '[441862da-a539-4cc0-a00d-47395582****]', - ], - 'example' => '["441862da-a539-4cc0-a00d-473955826881"]', - ], - ], - ], - 'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]', - ], - ], - ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The response code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:SubmitImportLogTasks', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], ], ], ], ], - 'errorCodes' => [ - 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], - ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AlertType\\": \\"unusual login\\",\\n \\"AlertTypeId\\": \\"unusual login\\",\\n \\"AlertName\\": \\"login_common_ip\\",\\n \\"AlertNameId\\": \\"login_common_ip\\",\\n \\"AlertTile\\": \\"unusual login-login_common_ip\\",\\n \\"AlertTileId\\": \\"unusual login-login_common_ip\\",\\n \\"Targets\\": [\\n {\\n \\"Type\\": \\"host_uuid\\",\\n \\"Name\\": \\"HOST UUID\\",\\n \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n \\"Values\\": [\\n \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n ]\\n }\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAlertScene', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"Count\\": 10\\n },\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'DescribeAlertSceneByEvent' => [ - 'summary' => 'Queries the scenarios and objects that can be added to an alert whitelist rule.', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - 'http', - ], + 'UpdateAutomateResponseConfigStatus' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'IncidentUuid', + 'name' => 'Ids', 'in' => 'formData', - 'schema' => [ - 'title' => '事件ID。', - 'description' => 'The ID of the event.'."\n", - 'type' => 'string', - 'required' => true, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['title' => '', 'description' => 'A JSON array of automated response rule IDs.', 'type' => 'string', 'required' => false, 'example' => '[123,345]'], + ], + [ + 'name' => 'InUse', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The enabling status of the rule. Valid values:'."\n" + ."\n" + .'- true: enabled'."\n" + ."\n" + .'- false: disabled', 'type' => 'boolean', 'required' => false, 'example' => 'true'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member account that the administrator wants to access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region where the Data Management center for threat analysis is deployed. You must select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse<List<SceneAndTarget>>', - 'description' => 'BaseResponse\\<List>'."\n", + 'title' => 'BaseResponse<String>', + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'AlertType' => [ - 'title' => '告警类型展示值，随中英文环境变化。', - 'description' => 'The alert type. The display name of the alert type varies based on the language of the system, such as Chinese and English.'."\n", - 'type' => 'string', - 'example' => 'Unusual Logon', - ], - 'AlertTypeId' => [ - 'title' => '告警类型标识。', - 'description' => 'The ID of the alert type.'."\n", - 'type' => 'string', - 'example' => 'Unusual Logon', - ], - 'AlertName' => [ - 'title' => '告警名称展示值，随中英文环境变化。', - 'description' => 'The alert name. The display name of the alert name varies based on the language of the system, such as Chinese and English.'."\n", - 'type' => 'string', - 'example' => 'login_common_ip', - ], - 'AlertNameId' => [ - 'title' => '告警名称标识。', - 'description' => 'The ID of the alert name.'."\n", - 'type' => 'string', - 'example' => 'login_common_ip', - ], - 'AlertTile' => [ - 'title' => '告警title展示值，随中英文环境变化。', - 'description' => 'The alert title. The display name of the alert title varies based on the language of the system, such as Chinese and English.'."\n", - 'type' => 'string', - 'example' => 'Unusual Logon-login_common_ip', - ], - 'AlertTileId' => [ - 'title' => '告警title 标识。', - 'description' => 'The ID of the alert title.'."\n", - 'type' => 'string', - 'example' => 'Unusual Logon-login_common_ip', - ], - 'Targets' => [ - 'title' => '加白对象。', - 'description' => 'The objects that can be added to the whitelist.'."\n", - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'Type' => [ - 'title' => '可以加白的实体属性字段。', - 'description' => 'The entity attribute field that can be added to the whitelist.'."\n", - 'type' => 'string', - 'example' => 'host_uuid', - ], - 'Name' => [ - 'title' => '可以加白的实体属性字段展示名。', - 'description' => 'The display name of the entity attribute field that can be added to the whitelist.'."\n", - 'type' => 'string', - 'example' => 'host uuid', - ], - 'Value' => [ - 'title' => '加白规则默认展示的右值。', - 'description' => 'The right operand that is displayed by default in the whitelist rule.'."\n", - 'type' => 'string', - 'example' => '441862da-a539-4cc0-a00d-47395582****', - ], - 'Values' => [ - 'title' => '加白规则可选的右值。', - 'description' => 'The supported right operands of the whitelist rule.'."\n", - 'type' => 'array', - 'items' => [ - 'description' => 'The right operand.'."\n", - 'type' => 'string', - 'example' => '[441862da-a539-4cc0-a00d-47395582****]', - ], - 'example' => '["441862da-a539-4cc0-a00d-473955826881"]', - ], - ], - ], - 'example' => '[{"Type": "host_uuid","Value": "441862da-a539-4cc0-a00d-473955826881","Values": ["441862da-a539-4cc0-a00d-473955826881"],"Name": "${aliyun.siem.entity.host_uuid}"}]', - ], - ], - ], - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'string', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'UpdateAutomateResponseConfigStatus', + 'summary' => 'Updates the status of an automated response rule.', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:23.000Z', 'description' => 'Error codes changed, Request parameters changed'], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": [\\n {\\n \\"AlertType\\": \\"Unusual Logon\\",\\n \\"AlertTypeId\\": \\"Unusual Logon\\",\\n \\"AlertName\\": \\"login_common_ip\\",\\n \\"AlertNameId\\": \\"login_common_ip\\",\\n \\"AlertTile\\": \\"Unusual Logon-login_common_ip\\",\\n \\"AlertTileId\\": \\"Unusual Logon-login_common_ip\\",\\n \\"Targets\\": [\\n {\\n \\"Type\\": \\"host_uuid\\",\\n \\"Name\\": \\"host uuid\\",\\n \\"Value\\": \\"441862da-a539-4cc0-a00d-47395582****\\",\\n \\"Values\\": [\\n \\"[441862da-a539-4cc0-a00d-47395582****]\\"\\n ]\\n }\\n ]\\n }\\n ],\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DescribeAlertSceneByEvent', - ], - 'DeleteWhiteRuleList' => [ - 'summary' => 'Deletes an alert whitelist rule with a specified ID.', - 'methods' => [ - 'get', - 'post', + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateAutomateResponseConfigStatus'], + ], ], - 'schemes' => [ - 'https', - 'http', + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateAutomateResponseConfigStatus', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'UpdateWhiteRuleList' => [ + 'summary' => 'Adds or updates alert whitelist rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https', 'http'], 'security' => [ [ 'AK' => [], ], ], 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'delete', - 'riskType' => 'none', - 'chargeType' => 'free', - ], + 'systemTags' => ['operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free'], 'parameters' => [ [ - 'name' => 'Id', + 'name' => 'WhiteRuleId', 'in' => 'formData', - 'schema' => [ - 'title' => '加白规则唯一ID。', - 'description' => 'The unique ID of the whitelist rule.'."\n", - 'type' => 'integer', - 'format' => 'int64', - 'required' => true, - 'example' => '123456789', - ], + 'schema' => ['title' => '', 'description' => 'The unique ID of the whitelist rule.', 'type' => 'integer', 'format' => 'int64', 'required' => true, 'example' => '123456789'], + ], + [ + 'name' => 'IncidentUuid', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The global unique ID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****'], + ], + [ + 'name' => 'Expression', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The alert whitelist rule. This is a JSON object.', 'type' => 'string', 'required' => true, 'example' => '['."\n" + .' {'."\n" + .' "alertName": "webshell",'."\n" + .' "alertNameId": "webshell",'."\n" + .' "alertType": "command",'."\n" + .' "alertTypeId": "command",'."\n" + .' "expression": {'."\n" + .' "status": 1,'."\n" + .' "conditions": ['."\n" + .' {'."\n" + .' "isNot": false,'."\n" + .' "left": {'."\n" + .' "value": "file_path"'."\n" + .' },'."\n" + .' "operator": "gt",'."\n" + .' "right": {'."\n" + .' "value": "cp"'."\n" + .' }'."\n" + .' }'."\n" + .' ]'."\n" + .' }'."\n" + .' }'."\n" + .']'], ], [ 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => 'The type of the view. Valid values:'."\n" - .'- 0: the current Alibaba Cloud account'."\n" - .'- 1: the global account', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: The view of the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: The view of all accounts that belong to the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => 'The ID of the account that you switch from the management account.', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '威胁分析的数据管理中心所在地。您需要根据资产所在地域，选择管理中心所在地。取值：'."\n" - .'- cn-hangzhou：资产属于中国内地与中国香港'."\n" - .'- ap-southeast-1：资产属于海外地域', - 'description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the regions in which your assets reside. Valid values:'."\n" - ."\n" - .'* cn-hangzhou: Your assets reside in regions in China.'."\n" - .'* ap-southeast-1: Your assets reside in regions outside China.'."\n", - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['title' => '', 'description' => 'The region of the Data Management center for threat analysis. Select a region for the Data Management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'BaseResponse', - 'description' => 'BaseResponse'."\n", + 'description' => 'BaseResponse', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'title' => '请求返回值。', - 'description' => 'The data returned.'."\n", - 'type' => 'any', - 'example' => '123456', - ], - 'Success' => [ - 'title' => '请求是否成功。取值：'."\n" - .'- true：成功'."\n" - .'- false：失败', - 'description' => 'Indicates whether the request was successful. Valid values:'."\n" - ."\n" - .'* true'."\n" - .'* false'."\n", - 'type' => 'boolean', - 'example' => 'true', - ], - 'Code' => [ - 'title' => '请求状态码。', - 'description' => 'The HTTP status code.'."\n", - 'type' => 'integer', - 'format' => 'int32', - 'example' => '200', - ], - 'Message' => [ - 'title' => '请求返回消息。', - 'description' => 'The returned message.'."\n", - 'type' => 'string', - 'example' => 'success', - ], - 'RequestId' => [ - 'title' => '请求id。', - 'description' => 'The request ID.'."\n", - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'Data' => ['title' => '', 'description' => 'The return value of the request.', 'type' => 'any', 'example' => '123456'], + 'Success' => ['title' => '', 'description' => 'Indicates whether the request was successful. Valid values:'."\n" + ."\n" + .'- true: The request was successful.'."\n" + ."\n" + .'- false: The request failed.', 'type' => 'boolean', 'example' => 'true'], + 'Code' => ['title' => '', 'description' => 'The status code of the request.', 'type' => 'integer', 'format' => 'int32', 'example' => '200'], + 'Message' => ['title' => '', 'description' => 'The message returned for the request.', 'type' => 'string', 'example' => 'success'], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 500 => [ - [ - 'errorMessage' => 'The request processing has failed due to some unknown error.', - 'errorCode' => 'InternalError', - ], + ['errorMessage' => 'The request processing has failed due to some unknown error.', 'errorCode' => 'InternalError', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'UpdateWhiteRuleList', + 'changeSet' => [ + ['createdAt' => '2024-04-17T12:43:22.000Z', 'description' => 'Error codes changed, Request parameters changed'], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateWhiteRuleList'], + ], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateWhiteRuleList', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": \\"123456\\",\\n \\"Success\\": true,\\n \\"Code\\": 200,\\n \\"Message\\": \\"success\\",\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', - 'title' => 'DeleteWhiteRuleList', ], ], 'endpoints' => [ + ['regionId' => 'cn-shanghai', 'regionName' => 'China (Shanghai)', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.cn-shanghai.aliyuncs.com'], + ['regionId' => 'ap-southeast-1', 'regionName' => 'Singapore', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.ap-southeast-1.aliyuncs.com'], + ], + 'errorCodes' => [ + ['code' => 'AccessKey.NotFound', 'message' => 'Access Key not found, please add access key for siem.', 'http_code' => 400, 'description' => ''], + ['code' => 'AssumeRoleError', 'message' => 'Specified role "AliyunServiceRoleForSasCloudSiem" is not exists.', 'http_code' => 400, 'description' => 'AliyunServiceRoleForSasCloudSiem associated role is missing.'], + ['code' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', 'message' => 'The rule name is duplicated.', 'http_code' => 400, 'description' => 'Custom rule naming conflict.'], + ['code' => 'Datasets with associated references cannot be deleted', 'message' => 'Delete the dataset-related references before attempting to delete the current dataset.', 'http_code' => 400, 'description' => 'Delete the dataset-related references before attempting to delete the current dataset.'], + ['code' => 'Expired.Log', 'message' => 'CloudFireWall Alert Log is expired, please select CloudFireWall Real-Time Alert Log.', 'http_code' => 400, 'description' => ''], + ['code' => 'Forbidden.UserDenied.RdAccount', 'message' => 'Forbidden User.', 'http_code' => 403, 'description' => 'The current user is a resource directory user, please contact the administrator to add as a delegated administrator for threat analysis.'], + ['code' => 'ForbiddenAction', 'message' => 'Unknown error.', 'http_code' => 400, 'description' => 'Illegal operation.'], + ['code' => 'ForbiddenOperation', 'message' => 'Please stop log import task.', 'http_code' => 400, 'description' => ''], + ['code' => 'IllegalParameter', 'message' => 'The specified parameter %s is not valid, only support %s.', 'http_code' => 400, 'description' => 'Parameters'], + ['code' => 'InternalError', 'message' => 'The request processing has failed due to some unknown error.', 'http_code' => 500, 'description' => ''], + ['code' => 'InvalidOperation', 'message' => 'Accesskey %s already bound.', 'http_code' => 400, 'description' => 'AccessKey has been bound.'], + ['code' => 'InvalidOperation', 'message' => 'Access key %s already bound.', 'http_code' => 400, 'description' => 'AK has been bound to account%.'], + ['code' => 'InvalidParameter', 'message' => 'The specified parameter %s is not valid.', 'http_code' => 400, 'description' => 'Parameter is not valid, try again.'], + ['code' => 'InvalidUpdateRecord.Conflict', 'message' => 'Only one of selectedEntityList or unSelectedEntityList can be specified.', 'http_code' => 400, 'description' => 'User fails in performing automatic disposal'], + ['code' => 'Need.CfwFlowLog', 'message' => 'Cloud FireWall Real-Time Alert Log is dependency Cloud FireWall Flow Log. Please open Cloud FireWall Flow Log for account %s first.', 'http_code' => 400, 'description' => 'Real-time alert logs of Cloud Firewall depend on the flow logs of Cloud Firewall. You must first add the Cloud Firewall flow logs of account %s.'], + ['code' => 'NeedCfwFlowLog', 'message' => 'Cloud Firewall Traffic Log must be integrated first.', 'http_code' => 400, 'description' => 'Cloud Firewall Traffic Log must be integrated first.'], + ['code' => 'OrderExpired', 'message' => 'Siem Order Not Found.', 'http_code' => 403, 'description' => 'No valid threat analysis order.'], + ['code' => 'RamAssumeException', 'message' => 'The request processing has failed due to ram service error.', 'http_code' => 500, 'description' => 'The request processing has failed due to ram service error.'], + ['code' => 'Siem.Analysis.IllegalParameter', 'message' => 'Start time should less than or equal to end time.', 'http_code' => 400, 'description' => ''], + ['code' => 'Siem.Analysis.SQLError', 'message' => 'Analysis SQL is error.', 'http_code' => 400, 'description' => ''], + ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 500, 'description' => ''], + ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 500, 'description' => ''], + ['code' => 'Siem.Delivery.MissingProductCode', 'message' => 'ProductCode is mandatory for this action.', 'http_code' => 400, 'description' => ''], + ['code' => 'SIEM.Region.Duplicate', 'message' => 'The region can be set only once.', 'http_code' => 400, 'description' => 'Region can only be set once.'], + ['code' => 'Siem.Storage.Exception', 'message' => 'The request timed out, try again.', 'http_code' => 500, 'description' => ''], + ['code' => 'Siem.TTL.Limit', 'message' => 'TTL should be set 30 days at least.', 'http_code' => 400, 'description' => ''], + ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => 'SLS service is unavailable.'], + ['code' => 'SLS.Index.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service takes several minutes to create an index. Please try again later.'], + ['code' => 'SLS.Operation.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => ''], + ['code' => 'SLS.Project.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service initialization takes several minutes. Please try again later.'], + ['code' => 'SLS.Ship.Error', 'message' => 'The Simple Log Service about data shipping is unavailable.', 'http_code' => 500, 'description' => ''], + ['code' => 'SLS.Sls4Service.Error', 'message' => 'The Simple Log Service about embedding console pages is unavailable.', 'http_code' => 500, 'description' => ''], + ['code' => 'UserDeliveryFailed', 'message' => 'failed in opening log delivery.', 'http_code' => 500, 'description' => 'Failed to open delivery.'], + ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 400, 'description' => ''], + ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 400, 'description' => 'SLS service is unavailable.'], + ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 400, 'description' => ''], + ], + 'changeSet' => [ + [ + 'apis' => [ + ['description' => 'Request parameters changed', 'api' => 'DescribeImportedLogCount'], + ], + 'createdAt' => '2024-12-16T08:47:16.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlertsWithEntity'], + ['description' => 'Request parameters changed', 'api' => 'DescribeAlertsWithEvent'], + ['description' => 'Request parameters changed', 'api' => 'DescribeCloudSiemAssets'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeCloudSiemEvents'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeDisposeAndPlaybook'], + ], + 'createdAt' => '2024-11-04T11:27:25.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed', 'api' => 'SubmitImportLogTasks'], + ], + 'createdAt' => '2024-09-27T08:28:28.000Z', + 'description' => '', + ], [ - 'regionId' => 'cn-shanghai', - 'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com', + 'apis' => [ + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlerts'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlertsCount'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeAlertsWithEvent'], + ['description' => 'Response parameters changed', 'api' => 'DescribeCloudSiemEventDetail'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListDisposeStrategy'], + ], + 'createdAt' => '2024-09-26T11:11:26.000Z', + 'description' => '', ], [ - 'regionId' => 'ap-southeast-1', - 'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com', + 'apis' => [ + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeCloudSiemEventDetail'], + ], + 'createdAt' => '2024-09-13T03:05:13.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeProdCount'], + ['description' => 'Request parameters changed', 'api' => 'ListAccountsByLog'], + ['description' => 'Request parameters changed', 'api' => 'ListImportedLogsByProd'], + ], + 'createdAt' => '2024-08-13T11:51:19.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed', 'api' => 'BindAccount'], + ['description' => 'Request parameters changed', 'api' => 'DeleteBindAccount'], + ['description' => 'Request parameters changed', 'api' => 'DescribeProdCount'], + ['description' => 'Request parameters changed', 'api' => 'ListAccountAccessId'], + ['description' => 'Request parameters changed', 'api' => 'ListBindAccount'], + ['description' => 'Request parameters changed', 'api' => 'ModifyBindAccount'], + ['description' => 'Request parameters changed', 'api' => 'SubmitImportLogTasks'], + ], + 'createdAt' => '2024-07-18T01:29:20.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed', 'api' => 'DescribeImportedLogCount'], + ], + 'createdAt' => '2024-07-08T11:46:20.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListUserProdLogs'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListUsersByProd'], + ], + 'createdAt' => '2024-04-26T09:44:29.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'DescribeUserBuyStatus'], + ['description' => 'Request parameters changed', 'api' => 'EnableAccessForCloudSiem'], + ['description' => 'Request parameters changed', 'api' => 'ListAccountsByLog'], + ['description' => 'Request parameters changed', 'api' => 'ListAllProds'], + ['description' => 'Request parameters changed, Response parameters changed', 'api' => 'ListImportedLogsByProd'], + ], + 'createdAt' => '2024-04-17T12:56:17.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Request parameters changed', 'api' => 'CloseDelivery'], + ['description' => 'Request parameters changed', 'api' => 'DescribeStorage'], + ['description' => 'Request parameters changed', 'api' => 'GetCapacity'], + ['description' => 'Request parameters changed', 'api' => 'GetStorage'], + ['description' => 'Request parameters changed', 'api' => 'ListDelivery'], + ['description' => 'Request parameters changed', 'api' => 'OpenDelivery'], + ['description' => 'Request parameters changed', 'api' => 'RestoreCapacity'], + ['description' => 'Request parameters changed', 'api' => 'SetStorage'], + ], + 'createdAt' => '2024-04-17T12:44:21.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DeleteAutomateResponseConfig'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DeleteCustomizeRule'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DeleteWhiteRuleList'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAggregateFunction'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlerts'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertScene'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertSceneByEvent'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertsCount'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertSource'], + ['description' => 'Error codes changed, Request parameters changed', 'api' => 'DescribeAlertSourceWithEvent'], + ], + 'createdAt' => '2024-04-17T12:43:46.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Response parameters changed', 'api' => 'BatchJobCheck'], + ], + 'createdAt' => '2024-03-27T06:33:53.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Error codes changed, Response parameters changed', 'api' => 'DescribeCloudSiemEventDetail'], + ], + 'createdAt' => '2024-02-22T06:05:09.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Error codes changed, Response parameters changed', 'api' => 'DescribeDisposeAndPlaybook'], + ], + 'createdAt' => '2024-01-18T11:56:49.000Z', + 'description' => '', + ], + [ + 'apis' => [ + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'CloseDelivery'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DeleteQuickQuery'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DescribeLogStore'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DescribeStorage'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DoQuickField'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'DoSelfDelegate'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetCapacity'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetHistograms'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetLogs'], + ['description' => 'Error codes changed, Request parameters changed, Response parameters changed', 'api' => 'GetQuickQuery'], + ], + 'createdAt' => '2023-12-13T09:49:43.000Z', + 'description' => '', + ], + ], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeServiceStatus'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteCustomizeRule'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEntity'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListEntities'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateWhiteRuleList'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEventDetail'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountsByLog'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'UpdateAutomateResponseConfigStatus'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertType'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeProdCount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsWithEvent'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableServiceForCloudSiem'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventDisposeAndWhiteruleList'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogSource'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSceneByEvent'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceParameters'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'RestoreCapacity'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SetStorage'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListProjectLogStores'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeStrategyPlaybook'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeScopeUsers'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceLogs'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostAutomateResponseConfig'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSource'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDisposeStrategy'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDisposeAndPlaybook'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssetsCounter'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetCapacity'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDelivery'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetStorage'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertScene'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCustomizeRuleTestResult'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSourceLog'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSource'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'EnableAccessForCloudSiem'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSourceLog'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEntityInfo'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindDataSources'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRule'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventDispose'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'CloseDelivery'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemCustomizeRules'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigCounter'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemAssets'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAutomateResponseConfigs'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListRdUsers'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostFinishCustomizeRuleTest'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogFields'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAccountAccessId'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddUserSourceLogConfig'], + ['threshold' => '15', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAuth'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'OpenDelivery'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeEventCountByThreatLevel'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeStorage'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteAutomateResponseConfig'], + ['threshold' => '-1', 'countWindow' => 1, 'regionId' => '*'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTestHistogram'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteBindAccount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeUserBuyStatus'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlerts'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWafScope'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyBindAccount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostCustomizeRuleTest'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAggregateFunction'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeLogType'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ModifyDataSourceLog'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeWhiteRuleList'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertSourceWithEvent'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListDataSourceTypes'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleCount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCustomizeRuleTest'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeCloudSiemEvents'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteDataSource'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListBindAccount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'SubmitImportLogTasks'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostRuleStatusChange'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigPlayBooks'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListImportedLogsByProd'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DeleteWhiteRuleList'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'BindAccount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeOperators'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'AddDataSource'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeImportedLogCount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'PostEventWhiteruleList'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeDataSourceInstance'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAlertsCount'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListAllProds'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListCloudSiemPredefinedRules'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'DescribeAutomateResponseConfigFeature'], + ], + ], + 'ram' => [ + 'productCode' => 'ThreatDetection', + 'productName' => 'Security Center', + 'ramCodes' => ['threatdetection', 'yundun-aegis', 'yundun-sas'], + 'ramLevel' => 'SERVICE', + 'ramConditions' => [ + [ + 'name' => 'acs:ResourceGroupId', + 'schema' => ['type' => 'String', 'description' => '资源组ID'], + ], ], + 'ramActions' => [], + 'resourceTypes' => [], ], ]; |