diff options
| author | Zhineng Li <im@zhineng.li> | 2026-07-12 17:11:17 +0800 |
|---|---|---|
| committer | Zhineng Li <im@zhineng.li> | 2026-07-12 17:11:17 +0800 |
| commit | 1c7f908ce09f98fdcbf79ed2a8ae21be60eaa634 (patch) | |
| tree | 5f0857666365b7e40cdaa3733ebe1f3ba9e13c67 /data/en_us/cloud-siem/2024-12-12/api-docs.php | |
| parent | 7347bac4ab7e136157fc94777e6cf87ef9e08599 (diff) | |
| download | afterglow-metadata-full-1c7f908ce09f98fdcbf79ed2a8ae21be60eaa634.tar.gz afterglow-metadata-full-1c7f908ce09f98fdcbf79ed2a8ae21be60eaa634.zip | |
update APIs 20260712
Diffstat (limited to 'data/en_us/cloud-siem/2024-12-12/api-docs.php')
| -rw-r--r-- | data/en_us/cloud-siem/2024-12-12/api-docs.php | 18506 |
1 files changed, 8640 insertions, 9866 deletions
diff --git a/data/en_us/cloud-siem/2024-12-12/api-docs.php b/data/en_us/cloud-siem/2024-12-12/api-docs.php index 6fc871a..b0f2d99 100644 --- a/data/en_us/cloud-siem/2024-12-12/api-docs.php +++ b/data/en_us/cloud-siem/2024-12-12/api-docs.php @@ -1,178 +1,75 @@ <?php return [ 'version' => '1.0', - 'info' => [ - 'style' => 'RPC', - 'product' => 'cloud-siem', - 'version' => '2024-12-12', - ], + 'info' => ['style' => 'RPC', 'product' => 'cloud-siem', 'version' => '2024-12-12'], 'directories' => [ [ - 'id' => 332850, - 'title' => null, + 'children' => ['GetUserConfig'], 'type' => 'directory', - 'children' => [ - 'GetUserConfig', - ], + 'title' => 'Account management', ], [ - 'id' => 332852, - 'title' => null, + 'children' => ['CheckUpgradeItem', 'ExecuteUpgrade', 'ListUpgradeItems'], 'type' => 'directory', - 'children' => [ - 'CheckUpgradeItem', - 'ExecuteUpgrade', - 'ListUpgradeItems', - ], + 'title' => 'Version upgrade', ], [ - 'id' => 332856, - 'title' => null, + 'children' => ['UpdateDataStorage', 'UpdateDataStorageTtl', 'UpdateDataStorageDelivery', 'ResetDataStorage', 'GetDataStorage'], 'type' => 'directory', - 'children' => [ - 'UpdateDataStorage', - 'UpdateDataStorageTtl', - 'UpdateDataStorageDelivery', - 'ResetDataStorage', - 'GetDataStorage', - ], + 'title' => 'Log management', ], [ - 'id' => 332862, - 'title' => null, + 'children' => ['RefreshDataSource', 'UpdateDataSourceTemplate', 'ListDataSourceTemplates', 'ValidateLogStore', 'ListLogRegions', 'ListLogProjects', 'GetLogTicket'], 'type' => 'directory', - 'children' => [ - 'CreateDataSource', - 'UpdateDataSource', - 'RefreshDataSource', - 'DeleteDataSource', - 'ListDataSources', - 'UpdateDataSourceTemplate', - 'ListDataSourceTemplates', - 'CreateLogStore', - 'DeleteLogStore', - 'ValidateLogStore', - 'ListLogRegions', - 'ListLogProjects', - 'ListLogStores', - 'GetLogTicket', - ], + 'title' => 'Data source', ], [ - 'id' => 332881, - 'title' => null, + 'children' => ['CreateVendor', 'UpdateVendor', 'DeleteVendor', 'ListVendors', 'CreateDataIngestion', 'EnableDataIngestion', 'DisableDataIngestion', 'UpdateDataIngestion', 'DeleteDataIngestion', 'GetDataBatchIngestion', 'UpdateDataBatchIngestion', 'ListDataIngestions', 'UpdateDataIngestionTemplate', 'ListDataIngestionTemplates', 'ListTrafficStatistics', 'ExecuteLogQuery'], 'type' => 'directory', - 'children' => [ - 'CreateProduct', - 'UpdateProduct', - 'DeleteProduct', - 'ListProducts', - 'CreateVendor', - 'UpdateVendor', - 'DeleteVendor', - 'ListVendors', - 'CreateDataIngestion', - 'EnableDataIngestion', - 'DisableDataIngestion', - 'UpdateDataIngestion', - 'DeleteDataIngestion', - 'GetDataBatchIngestion', - 'UpdateDataBatchIngestion', - 'ListDataIngestions', - 'UpdateDataIngestionTemplate', - 'ListDataIngestionTemplates', - 'ListTrafficStatistics', - 'ExecuteLogQuery', - ], + 'title' => 'Data ingestion', ], [ - 'id' => 332906, - 'title' => null, + 'children' => ['CreateNormalizationRule', 'UpdateNormalizationRule', 'DeleteNormalizationRule', 'ValidateNormalizationRule', 'GetNormalizationRule', 'GetNormalizationSchema', 'GetNormalizationRuleVersion', 'DeleteNormalizationRuleVersion', 'SetDefaultNormalizationRuleVersion', 'ListNormalizationRuleVersions', 'ListNormalizationRules', 'ListNormalizationFields', 'ListNormalizationCategories', 'ListNormalizationRuleCapacities', 'ListNormalizationSchemas'], 'type' => 'directory', - 'children' => [ - 'CreateNormalizationRule', - 'UpdateNormalizationRule', - 'DeleteNormalizationRule', - 'ValidateNormalizationRule', - 'GetNormalizationRule', - 'GetNormalizationSchema', - 'GetNormalizationRuleVersion', - 'DeleteNormalizationRuleVersion', - 'SetDefaultNormalizationRuleVersion', - 'ListNormalizationRuleVersions', - 'ListNormalizationRules', - 'ListNormalizationFields', - 'ListNormalizationCategories', - 'ListNormalizationRuleCapacities', - 'ListNormalizationSchemas', - ], + 'title' => 'Data normalization', ], [ - 'id' => 332922, - 'title' => null, + 'children' => ['UpdateDataSetRecord', 'DeleteDataSetRecord', 'ListDataSetRecords'], 'type' => 'directory', - 'children' => [ - 'CreateDataSet', - 'UpdateDataSet', - 'DeleteDataSet', - 'ListDataSets', - 'UpdateDataSetRecord', - 'DeleteDataSetRecord', - 'ListDataSetRecords', - ], + 'title' => 'Dataset', ], [ - 'id' => 332930, - 'title' => null, + 'children' => ['CreateDetectionRule', 'UpdateDetectionRule', 'DeleteDetectionRule', 'ListDetectionRules', 'GetDetectionStatistic'], 'type' => 'directory', - 'children' => [ - 'CreateDetectionRule', - 'UpdateDetectionRule', - 'DeleteDetectionRule', - 'ListDetectionRules', - 'GetDetectionStatistic', - ], + 'title' => 'Detection rule', ], [ - 'id' => 332936, - 'title' => null, + 'children' => ['ListIncidents', 'GetIncident'], 'type' => 'directory', - 'children' => [ - 'GetIncident', - 'ListIncidents', - ], + 'title' => 'Security event', ], [ - 'id' => 332939, - 'title' => null, + 'children' => ['CreateExportTask', 'GetExportTask'], 'type' => 'directory', - 'children' => [ - 'CreateExportTask', - 'GetExportTask', - ], + 'title' => 'Export task', ], [ - 'id' => 0, - 'title' => '其它', - 'type' => 'directory', 'children' => [ - 'UpdateNormalizationSchema', - 'CreateNormalizationSchema', + 'CreateAutoDisposeConfig', 'CreateDataSet', 'CreateDataSource', 'CreateLogStore', 'CreateNormalizationSchema', 'CreateProduct', 'CreateResponseRule', 'DeleteDataSet', 'DeleteDataSource', 'DeleteLogStore', 'DeleteProduct', 'DeleteResponseRule', 'ExecuteAutoDisposeRecords', 'GetAutoDisposeConfig', 'ListAutoDisposeEntities', 'ListDataSets', 'ListDataSources', 'ListLogStores', 'ListProducts', 'ListResponseRules', + 'UpdateAutoDisposeConfig', 'UpdateAutoDisposeRecord', 'UpdateDataSet', 'UpdateDataSource', 'UpdateNormalizationSchema', 'UpdateProduct', 'UpdateResponseRule', 'GetAlert', 'GetResponseRuleStatistic', 'ListAlerts', 'ListDataConnectors', 'ListNormalizationSecurityDomains', 'ListQueryViews', 'ListResponseRuleFields', 'ListTags', 'UpdateAlert', ], + 'type' => 'directory', + 'title' => 'Others', ], ], 'components' => [ 'schemas' => [], ], 'apis' => [ - 'GetUserConfig' => [ - 'summary' => '获取用户配置信息', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'CheckUpgradeItem' => [ + 'summary' => 'Checks for available version upgrades.', + 'path' => '', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -181,429 +78,309 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'none', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ + 'name' => 'UpgradeItemId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the upgrade item.', 'type' => 'string', 'required' => false, 'example' => 'dispose_task_upgrade', 'title' => ''], + ], + [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The assets are in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'en', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '173326*******', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s perspective.', 'type' => 'string', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - 'User' => [ - 'description' => '', + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'UpgradeItem' => [ + 'description' => 'The upgrade item.', 'type' => 'object', 'properties' => [ - 'CtdrVersion' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'v2', - ], - 'DataStorageVersion' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'pending', - ], - 'UpgradeStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'v2', - ], - 'UpgradeCtdrVersion' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'v2', - ], + 'UpgradeItemId' => ['description' => 'The ID of the upgrade item.', 'type' => 'string', 'example' => 'incident_upgrade', 'title' => ''], + 'CheckStatus' => ['description' => 'The check status.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'CheckResult' => ['description' => 'The name of the module.', 'type' => 'string', 'example' => 'OK', 'title' => ''], ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"UpgradeItem\\": {\\n \\"UpgradeItemId\\": \\"incident_upgrade\\",\\n \\"CheckStatus\\": \\"success\\",\\n \\"CheckResult\\": \\"OK\\"\\n }\\n}","type":"json"}]', + 'title' => 'CheckUpgradeItem', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class that includes configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'none', + 'ramAction' => [ + 'action' => 'yundun-sas:CheckUpgradeItem', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"User\\": {\\n \\"CtdrVersion\\": \\"v2\\",\\n \\"DataStorageVersion\\": \\"pending\\",\\n \\"UpgradeStatus\\": \\"v2\\",\\n \\"UpgradeCtdrVersion\\": \\"v2\\"\\n }\\n}","type":"json"}]', ], - 'CheckUpgradeItem' => [ - 'summary' => '检查升级项', + 'CreateAutoDisposeConfig' => [ + 'summary' => 'Creates an auto-dispose configuration.', 'path' => '', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'none', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ - 'name' => 'UpgradeItemId', + 'name' => 'AutoDecisionStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'dispose_task_upgrade', - ], + 'schema' => ['description' => 'Specifies whether to enable automated analysis. Valid values:'."\n" + ."\n" + .'- enabled: Enables automated analysis.'."\n" + ."\n" + .'- disabled: Disables automated analysis.', 'type' => 'string', 'required' => true, 'example' => 'enabled', 'title' => ''], ], [ - 'name' => 'RegionId', + 'name' => 'ProductCode', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-shanghai', - ], + 'schema' => ['description' => 'The code of the cloud product.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - 'UpgradeItem' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'UpgradeItemId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'incident_upgrade', - ], - 'CheckStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'success', - ], - 'CheckResult' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'OK', - ], - ], - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6D7B26AD-2EDD-5A96-B9D2-CDEABFC55690'], ], + 'title' => '', + 'description' => 'The response body.', + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'CreateAutoDisposeConfig', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. Refer to the helper class in the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java) for configuration examples.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"UpgradeItem\\": {\\n \\"UpgradeItemId\\": \\"incident_upgrade\\",\\n \\"CheckStatus\\": \\"success\\",\\n \\"CheckResult\\": \\"OK\\"\\n }\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6D7B26AD-2EDD-5A96-B9D2-CDEABFC55690\\"\\n}","type":"json"}]', ], - 'ExecuteUpgrade' => [ - 'summary' => '执行升级', - 'path' => '', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'CreateDataIngestion' => [ + 'summary' => 'Creates a data ingestion policy.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management hub for threat analysis is located. Select a region for the management hub based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to assume the permissions of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - ], - ], + [ + 'name' => 'DataIngestionMode', + 'in' => 'formData', + 'schema' => ['description' => 'The data ingestion mode. Valid values:'."\n" + ."\n" + .'- realtime'."\n" + ."\n" + .'- scan', 'type' => 'string', 'required' => false, 'example' => 'realtime', 'title' => ''], ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'ListUpgradeItems' => [ - 'summary' => '获取升级项列表', - 'path' => '', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'DataSourceId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-3g6lyf4eonngyohaq7tr', 'title' => ''], ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'list', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', + [ + 'name' => 'NormalizationRuleId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-hdmady54piigkjfv17yp', 'title' => ''], ], - ], - 'parameters' => [ [ - 'name' => 'MaxResults', + 'name' => 'DataSourceEditable', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50', - ], + 'schema' => ['description' => 'Specifies whether the data source can be edited.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'DataIngestionStateCode', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'schema' => ['description' => 'The error code for the data ingestion status.', 'type' => 'string', 'required' => false, 'example' => 'UserUnauthorized', 'title' => ''], ], [ - 'name' => 'RegionId', + 'name' => 'CapacityCount', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The number of associated security capabilities.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''], ], [ - 'name' => 'Lang', + 'name' => 'StreamJobId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The ID of the stream job.', 'type' => 'string', 'required' => false, 'example' => '802c0129b6cfd50861d4b25deea29afb', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'DataIngestionType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The data ingestion type. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], + ], + [ + 'name' => 'ScanDataSourceId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the data source for the scan mode.', 'type' => 'string', 'required' => false, 'example' => 'ds-014frtpy28m5ct2eoyo1', 'title' => ''], + ], + [ + 'name' => 'UpdateTime', + 'in' => 'formData', + 'schema' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleEditable', + 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether the normalization rule can be edited.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], + ], + [ + 'name' => 'ProductId', + 'in' => 'formData', + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - 'UpgradeItems' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'UpgradeItemId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'data_storage_2_upgrade', - ], - ], - ], - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'DataIngestionId' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'example' => 'di-yxtm3l2rwa7fr5uvxtc7', 'title' => ''], ], + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"UpgradeItems\\": [\\n {\\n \\"UpgradeItemId\\": \\"data_storage_2_upgrade\\"\\n }\\n ],\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"MaxResults\\": 50,\\n \\"TotalCount\\": 57\\n}","type":"json"}]', - ], - 'UpdateDataStorage' => [ - 'summary' => '获取日志管理页面里用户数据存储的详情。', - 'methods' => [ - 'post', - 'get', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'schemes' => [ - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataIngestionId\\": \\"di-yxtm3l2rwa7fr5uvxtc7\\"\\n}","type":"json"}]', + 'title' => 'CreateDataIngestion', + 'description' => 'The frequency and timing of notifications are limited. Each user receives a maximum of two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateDataIngestion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/*'], + ], + ], + ], ], + ], + 'CreateDataSet' => [ + 'summary' => 'Creates a dataset.', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -612,99 +389,176 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - 'tenantRelevance' => 'publicInformation', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataStorageRegionId', + 'name' => 'DataSetName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'cn-shanghai', - ], + 'schema' => ['description' => 'The name of the dataset.', 'type' => 'string', 'required' => true, 'maxLength' => 100, 'example' => 'lmftest', 'title' => ''], ], [ - 'name' => 'DeliveryStatus', + 'name' => 'DataSetDescription', + 'in' => 'formData', + 'schema' => ['description' => 'The description of the dataset.', 'type' => 'string', 'maxLength' => 1000, 'required' => false, 'example' => 'lmftest contains ip list', 'title' => ''], + ], + [ + 'name' => 'DataSetFieldKeyName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the unique key for the dataset.', 'type' => 'string', 'required' => true, 'example' => 'ip', 'title' => ''], + ], + [ + 'name' => 'DataSetFileName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the uploaded dataset file.', 'type' => 'string', 'required' => true, 'example' => 'cloudsiem-dataset/1358117679873357_17433*****.csv', 'title' => ''], + ], + [ + 'name' => 'IpWhitelistRecognizers', 'in' => 'formData', + 'style' => 'flat', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of recognizers.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'IpWhitelistRecognizerType' => ['description' => 'The type of IP address that the recognizer detects. Valid values:'."\n" + ."\n" + .'- sas\\_vulnerability\\_scanner\\_ip: The IP address of the Security Center web vulnerability scanner.'."\n" + ."\n" + .'- waf\\_back\\_source\\_ip: The back-to-origin IP address of Web Application Firewall (WAF).'."\n" + ."\n" + .'- ddos\\_back\\_source\\_ip: The back-to-origin IP address of Anti-DDoS.'."\n" + ."\n" + .'- esa\\_back\\_source\\_ip: The back-to-origin IP address of an Edge Security Acceleration (ESA) node.'."\n" + ."\n" + .'- ecs\\_public\\_ip: The public IP address of an Elastic Compute Service (ECS) instance.'."\n" + ."\n" + .'- slb\\_public\\_ip: The public IP address of a Server Load Balancer (SLB) instance.'."\n" + ."\n" + .'- vpc\\_eip: An Elastic IP Address (EIP).'."\n" + ."\n" + .'- cdn\\_back\\_source\\_ip: The back-to-origin IP address of a content delivery network (CDN).'."\n" + ."\n" + .'- ga\\_back\\_source\\_ip: The back-to-origin IP address of Global Accelerator (GA).', 'type' => 'string', 'required' => false, 'example' => 'waf_back_source_ip', 'title' => ''], + 'AutoRecognizeStatus' => ['description' => 'The automatic detection status. Valid values:'."\n" + ."\n" + .'- enabled: enabled.'."\n" + ."\n" + .'- disabled: disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''], + 'RecognizeScope' => ['description' => 'The detection scope. Valid values:'."\n" + ."\n" + .'- current\\_account: the current account only.'."\n" + ."\n" + .'- rd\\_accounts: all accounts in your resource directory.', 'type' => 'string', 'required' => false, 'example' => 'current_account', 'title' => ''], + ], + 'required' => false, + 'description' => 'A recognizer.', + 'title' => '', + 'example' => '', + ], 'required' => false, - 'example' => 'enable', - 'maxLength' => 1000, + 'title' => '', + 'example' => '', ], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member whose permissions are used to perform the operation. This parameter is used when an administrator acts on behalf of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'DataSetStatus', + 'in' => 'formData', + 'schema' => ['description' => 'The status of the dataset. Valid values:'."\n" + ."\n" + .'- 0: deleted.'."\n" + ."\n" + .'- 1: enabled.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'DataSetType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the dataset. Valid values:'."\n" + ."\n" + .'- custom: custom.'."\n" + ."\n" + .'- preset: predefined.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => '', + 'title' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'EA7FC160-8D86-5ABE-A08A-7962FDC1****', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'DataSetRecordStatistic' => [ + 'description' => 'The result returned after the dataset is created.', + 'type' => 'object', + 'properties' => [ + 'NewDataSetRecordCount' => ['description' => 'The number of new records in the dataset.', 'type' => 'integer', 'format' => 'int32', 'example' => '6', 'title' => ''], + 'DataSetId' => ['description' => 'The dataset ID.', 'type' => 'string', 'example' => 'dataset-qt0n8246gs9nackg****', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"EA7FC160-8D86-5ABE-A08A-7962FDC1****\\"\\n}","type":"json"}]', - ], - 'UpdateDataStorageTtl' => [ - 'summary' => '更新数据存储中日志的数据保存天数。', - 'methods' => [ - 'post', - 'get', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'schemes' => [ - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"DataSetRecordStatistic\\": {\\n \\"NewDataSetRecordCount\\": 6,\\n \\"DataSetId\\": \\"dataset-qt0n8246gs9nackg****\\"\\n }\\n}","type":"json"}]', + 'title' => 'CreateDataSet', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateDataSet', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/*'], + ], + ], + ], ], + ], + 'CreateDataSource' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -713,120 +567,210 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - 'autoTest' => true, - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Management Hub. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator assumes.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'DataSourceName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'AD_LOG', 'title' => ''], + ], + [ + 'name' => 'DataSourceType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + ], + [ + 'name' => 'DataSourceFrom', + 'in' => 'formData', + 'schema' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'center', 'title' => ''], + ], + [ + 'name' => 'LogUserId', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID for data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'LogRegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'LogProjectName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], ], [ 'name' => 'LogStoreName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'network-activity', - 'maxLength' => 1000, - ], + 'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'mde_raw', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'DataSourceStores', 'in' => 'formData', + 'style' => 'flat', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'description' => 'The list of Simple Log Service projects.', + 'type' => 'array', + 'items' => [ + 'description' => 'A Simple Log Service project.', + 'type' => 'object', + 'properties' => [ + 'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + 'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], + 'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'actiontrail_management-events', 'title' => ''], + 'DataSourceStoreStatus' => ['description' => 'The status of the log storage. Valid values:'."\n" + ."\n" + .'- normal'."\n" + ."\n" + .'- abnormal', 'type' => 'string', 'required' => false, 'example' => 'normal', 'title' => ''], + 'DataSourceStoreId' => ['description' => 'The ID of the log storage.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], + 'DataSourceStoreFrom' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'center', 'title' => ''], + ], + 'required' => false, + 'title' => '', + 'example' => '', + ], 'required' => false, - 'example' => '113091674488****', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'LogStoreTtl', + 'name' => 'DataSourceTemplateId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '180', - ], + 'schema' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'dst_alibaba_cloud_nas_audit_log_1358117679873357', 'title' => ''], ], [ - 'name' => 'LogStoreHotTtl', + 'name' => 'DataSourceIds', 'in' => 'formData', + 'style' => 'json', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'type' => 'array', + 'items' => ['description' => 'A data source ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_flow_log_1766185894104675', 'title' => ''], + 'description' => 'A list of data source IDs.', + 'title' => '', + 'example' => '', 'required' => false, - 'example' => '180', ], ], [ - 'name' => 'LogStoreColdTtl', + 'name' => 'DataSourceRecognizer', + 'in' => 'formData', + 'schema' => ['description' => 'The data source recognizer.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_flow_log_1766185894104675', 'title' => ''], + ], + [ + 'name' => 'DataSourceRecognizeEnabled', + 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether to automatically discover new data sources.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], + ], + [ + 'name' => 'DataSourceReferences', 'in' => 'formData', + 'style' => 'json', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'type' => 'array', + 'items' => ['description' => 'The ID of an associated data access instance.', 'type' => 'string', 'required' => false, 'example' => 'ds-014frtpy28m5ct2eoyo1', 'title' => ''], + 'description' => 'The IDs of associated data access instances.', + 'title' => '', + 'example' => '', 'required' => false, - 'example' => '0', ], ], + [ + 'name' => 'Order', + 'in' => 'formData', + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- desc: descending.'."\n" + ."\n" + .'- asc: ascending.', 'type' => 'string', 'required' => false, 'example' => 'desc', 'title' => ''], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => '', + 'title' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'D92E4FCF-4584-5E50-9C02-26B79A9C****', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'ds-jl67vixpe1scwysgyu3x', 'title' => ''], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'CreateDataSource', + 'summary' => 'Creates a data source.', + 'description' => 'The JsonConfig input parameter is a complex JSON object. For a configuration example, see the supporting tool class in the [demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateDataSource', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"D92E4FCF-4584-5E50-9C02-26B79A9C****\\"\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataSourceId\\": \\"ds-jl67vixpe1scwysgyu3x\\"\\n}","type":"json"}]', ], - 'UpdateDataStorageDelivery' => [ - 'summary' => '操作日志投递.', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'CreateDetectionRule' => [ + 'summary' => 'Creates a detection rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -835,445 +779,540 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - 'autoTest' => true, - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the Data Management center of Threat Analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'required' => true, 'maxLength' => 128, 'example' => 'dr-ha1i09ob3zmqrs85****', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleDescription', + 'in' => 'formData', + 'schema' => ['description' => 'The description of the detection rule.', 'type' => 'string', 'maxLength' => 2000, 'required' => false, 'example' => 'dr-123', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleType', + 'in' => 'formData', 'schema' => [ - 'description' => '', + 'description' => 'The type of the detection rule. Valid values:'."\n" + ."\n" + .'- preset: predefined detection rule.'."\n" + ."\n" + .'- custom: custom detection rule.'."\n" + ."\n" + .'- custom\\_template: rule template.', 'type' => 'string', - 'required' => false, - 'example' => 'zh', + 'required' => true, + 'enum' => ['custom'], + 'example' => 'custom', + 'title' => '', ], ], [ - 'name' => 'LogCode', + 'name' => 'DetectionRuleStatus', + 'in' => 'formData', + 'schema' => ['description' => 'The status of the detection rule.', 'type' => 'string', 'required' => false, 'example' => '0', 'title' => ''], + ], + [ + 'name' => 'AlertType', + 'in' => 'formData', + 'schema' => ['description' => 'The alert type.', 'type' => 'string', 'required' => true, 'example' => 'WebShell', 'title' => ''], + ], + [ + 'name' => 'AlertLevel', 'in' => 'formData', 'schema' => [ - 'description' => '', + 'description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- 5: critical.'."\n" + ."\n" + .'- 4: important.'."\n" + ."\n" + .'- 3: medium.'."\n" + ."\n" + .'- 2: low.'."\n" + ."\n" + .'- 1: informational.', 'type' => 'string', 'required' => true, - 'example' => 'aegis-log-login', + 'enum' => ['1', '2', '3', '4', '5'], + 'example' => '1', + 'title' => '', ], ], [ - 'name' => 'LogDeliveryStatus', + 'name' => 'AlertTacticId', + 'in' => 'formData', + 'schema' => ['description' => 'The tactic phase of the alert.', 'type' => 'string', 'required' => false, 'example' => 'TA0042', 'title' => ''], + ], + [ + 'name' => 'AlertAttCk', + 'in' => 'formData', + 'schema' => ['description' => 'The ATT\\&CK stage of the alert.', 'type' => 'string', 'required' => false, 'example' => 'Discovery', 'title' => ''], + ], + [ + 'name' => 'DetectionExpressionType', 'in' => 'formData', 'schema' => [ - 'description' => '', + 'description' => 'The type of the detection rule expression. Valid values:'."\n" + ."\n" + .'- sql: SQL.'."\n" + ."\n" + .'- playbook: playbook.', + 'enumValueTitles' => ['sql' => 'sql', 'playbook' => 'playbook'], 'type' => 'string', 'required' => false, - 'example' => 'enable', - 'maxLength' => 1000, + 'enum' => ['sql', 'graphical', 'playbook'], + 'example' => 'sql', + 'title' => '', ], ], [ - 'name' => 'RoleFor', + 'name' => 'DetectionExpressionContent', + 'in' => 'formData', + 'schema' => ['description' => 'The content of the detection rule expression.', 'type' => 'string', 'required' => false, 'example' => '*|set session mode=scan;SELECT * FROM log'."\n" + .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n" + .'AND ('."\n" + .' proc_path LIKE \'%/groups\''."\n" + .' OR ('."\n" + .' ('."\n" + .' proc_path LIKE \'%/cat\''."\n" + .' OR proc_path LIKE \'%/head\''."\n" + .' OR proc_path LIKE \'%/tail\''."\n" + .' OR proc_path LIKE \'%/more\''."\n" + .' )'."\n" + .' AND cmdline LIKE \'%/etc/group%\''."\n" + .' )'."\n" + .')'."\n", 'title' => ''], + ], + [ + 'name' => 'LogCategoryId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''], + ], + [ + 'name' => 'LogSchemaId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'required' => true, 'example' => 'API_RISK_ACTIVITY', 'title' => ''], + ], + [ + 'name' => 'AlertSchemaId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the alert template for the detection rule. Valid values:'."\n" + ."\n" + .'- ALERT\\_ACTIVITY: other alerts.'."\n" + ."\n" + .'- EDR\\_ALERT\\_ACTIVITY: Endpoint Detection and Response (EDR) alerts.'."\n" + ."\n" + .'- FIREWALL\\_ALERT\\_ACTIVITY: firewall alerts.'."\n" + ."\n" + .'- WAF\\_ALERT\\_ACTIVITY: Web Application Firewall (WAF) alerts.', 'type' => 'string', 'required' => true, 'example' => 'ALERT_ACTIVITY', 'title' => ''], + ], + [ + 'name' => 'ScheduleType', 'in' => 'formData', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'description' => 'The scheduling type. Valid values:'."\n" + ."\n" + .'- fixed\\_rate: fixed interval.'."\n" + ."\n" + .'- cron: cron expression.', + 'type' => 'string', + 'enum' => ['fixed_rate', 'cron'], 'required' => false, - 'example' => '113091674488****', + 'example' => 'fixed_rate', + 'title' => '', ], ], + [ + 'name' => 'ScheduleExpression', + 'in' => 'formData', + 'schema' => ['description' => 'The cron expression for scheduling. This parameter is required if you set ScheduleType to cron.', 'type' => 'string', 'required' => false, 'example' => '0/5 * * * *', 'title' => ''], + ], + [ + 'name' => 'ScheduleMaxRetries', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of retries after a timeout. Valid values: 1 to 100.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'ScheduleBeginTime', + 'in' => 'formData', + 'schema' => ['description' => 'The start time for scheduling. This is a 13-digit UNIX timestamp.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''], + ], + [ + 'name' => 'ScheduleWindow', + 'in' => 'formData', + 'schema' => ['description' => 'The length of the scheduling window.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''], + ], + [ + 'name' => 'ScheduleMaxTimeout', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum timeout period in seconds. Valid values: 60 to 1800.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '60', 'title' => ''], + ], + [ + 'name' => 'AlertThresholdPeriod', + 'in' => 'formData', + 'schema' => ['description' => 'The length of the alert threshold period.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''], + ], + [ + 'name' => 'AlertThresholdCount', + 'in' => 'formData', + 'schema' => ['description' => 'The count for the alert threshold.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''], + ], + [ + 'name' => 'AlertThresholdGroup', + 'in' => 'formData', + 'schema' => ['description' => 'The list of fields for the alert threshold. Separate multiple fields with commas.', 'type' => 'string', 'required' => false, 'example' => 'alert_type,ip', 'title' => ''], + ], + [ + 'name' => 'IncidentAggregationType', + 'in' => 'formData', + 'schema' => ['description' => 'The event aggregation type. Valid values:'."\n" + ."\n" + .'- none: Events are not generated.'."\n" + ."\n" + .'- graph\\_compute: graph computing (supported by predefined rules).'."\n" + ."\n" + .'- expert: expert rules.'."\n" + ."\n" + .'- passthrough: Alerts are passed through (one-to-one).'."\n" + ."\n" + .'- window: Similar alerts are aggregated (window).', 'type' => 'string', 'required' => false, 'example' => 'window', 'title' => ''], + ], + [ + 'name' => 'IncidentAggregationExpression', + 'in' => 'formData', + 'schema' => ['description' => 'The configuration of the event aggregation period.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''], + ], + [ + 'name' => 'PlaybookUuid', + 'in' => 'formData', + 'schema' => ['description' => 'The UUID of the playbook.', 'type' => 'string', 'required' => false, 'example' => 'system_aliyun_clb_process_book', 'title' => ''], + ], + [ + 'name' => 'PlaybookParameters', + 'in' => 'formData', + 'schema' => ['description' => 'The custom parameters for the playbook.', 'type' => 'string', 'required' => false, 'example' => '{'."\n" + .' "ip": {'."\n" + .' "ip": "124.23.*.*"'."\n" + .' }'."\n" + .'}', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID that an administrator uses to switch to the perspective of another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'EntityMappings', + 'in' => 'formData', + 'schema' => ['description' => 'The entity mapping configuration.', 'type' => 'string', 'required' => false, 'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleTemplateId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the detection rule template.', 'type' => 'string', 'example' => 'cfw-out-ip_aegis-netstat', 'title' => '', 'required' => false], + ], + [ + 'name' => 'DetectionRuleTemplateVersion', + 'in' => 'formData', + 'schema' => ['description' => 'The version of the detection rule template.', 'type' => 'string', 'example' => 'v1.0.0', 'title' => '', 'required' => false], + ], + [ + 'name' => 'AlertName', + 'in' => 'formData', + 'schema' => ['description' => 'The alert name. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Detected high-frequency multi-type network attacks from $src_ip$'], + ], + [ + 'name' => 'AlertDescription', + 'in' => 'formData', + 'schema' => ['description' => 'The alert description. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$'], + ], + [ + 'name' => 'AlertTypeMapping', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'title' => '', 'description' => '', 'example' => ''], + ], + [ + 'name' => 'AlertLevelMapping', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'title' => '', 'description' => '', 'example' => ''], + ], + [ + 'name' => 'AlertAttCkMapping', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'title' => '', 'description' => '', 'example' => ''], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => '', + 'title' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6D7FBF4A-5B95-5760-8B5A-BF8983D4****', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '5CC09D0C-1CD7-54BD-A853-DCB2D945****', 'title' => ''], + 'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-ha1i09ob3zmqrs85****', 'title' => ''], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6D7FBF4A-5B95-5760-8B5A-BF8983D4****\\"\\n}","type":"json"}]', - ], - 'ResetDataStorage' => [ - 'summary' => '数据存储的清空操作，该动作会删除已有的数据，重新初始化物理存储。', - 'methods' => [ - 'post', - 'get', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'CreateDetectionRule', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'schemes' => [ - 'https', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateDetectionRule', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"5CC09D0C-1CD7-54BD-A853-DCB2D945****\\",\\n \\"DetectionRuleId\\": \\"dr-ha1i09ob3zmqrs85****\\"\\n}","type":"json"}]', + ], + 'CreateExportTask' => [ + 'summary' => 'Creates an export task.', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - 'autoTest' => true, - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'ExportTaskParameter', + 'in' => 'formData', + 'schema' => ['description' => 'The parameters for the export task. The value is a JSON string that is generated based on the query conditions.', 'type' => 'string', 'required' => false, 'example' => '{'."\n" + .' "IncidentName": "name",'."\n" + .' "IncidentStatus": "1",'."\n" + .' "ThreatLevel":["1","2"],'."\n" + .' "IncidentUuids":"315EE627-39DC-560A-8DFD-CBF66AD9****"'."\n" + .'}', 'title' => ''], + ], + [ + 'name' => 'ExportTaskType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of data to export. Valid values:'."\n" + ."\n" + .'- incident\\_list: event list.', 'type' => 'string', 'required' => false, 'example' => 'incident_list', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'BaseResponse', - 'description' => '', + 'title' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'FileName' => ['description' => 'The name of the exported file.', 'type' => 'string', 'example' => 'event_1193842352994186_17344888****.xlsx', 'title' => ''], + 'Id' => ['description' => 'The ID of the export task.', 'type' => 'integer', 'format' => 'int64', 'example' => '400151', 'title' => ''], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'GetDataStorage' => [ - 'summary' => '获取日志管理页面里用户数据存储的详情。', - 'methods' => [ - 'post', - 'get', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'schemes' => [ - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n \\"Id\\": 400151\\n}","type":"json"}]', + 'title' => 'CreateExportTask', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateExportTask', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'CreateLogStore' => [ + 'summary' => 'Configure client-side storage restrictions.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasRXJ9SY', - ], - 'autoTest' => true, - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management Center for threat analysis. Select a region for the Management Center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'LogUserId', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'LogRegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'LogProjectName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-channel-173326*******-cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'LogStoreName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'logstoreqykug', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'DataResponse<DataStorageBean>', - 'description' => '', + 'title' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'Data' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'DataStorageRegionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cn-shanghai', - ], - 'DataStorageTotalCapacity' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '100', - ], - 'DataStorageUsedCapacity' => [ - 'description' => '', - 'type' => 'number', - 'format' => 'double', - 'example' => '100.0', - ], - 'LogProject' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun-cloudsiem-data-171835723111****-cn-shanghai', - ], - 'SasLogStores' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'LogName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Process Snapshot', - ], - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'sas-security-log', - ], - 'LogDeliveryStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enable', - ], - 'LogStoreTtl' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '180', - ], - 'LogDeliveryUpdateTime' => [ - 'description' => '', - 'type' => 'string', - 'example' => '2025-07-16T15:10:29', - ], - 'LogDeliveryPermission' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'deny', - ], - 'LogDeliveryGroup' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'host', - ], - 'LogSearchConditions' => [ - 'title' => 'JSON Array ["key":"product_code", "value":"ctdr"]', - 'description' => '', - 'type' => 'string', - 'example' => '[{\\"__topic__\\":\\"sas-net-block\\"}]', - ], - 'LogCode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'sas-net-block', - ], - 'LogStoreExisted' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true', - ], - ], - ], - ], - 'NormalizationLogStores' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'vulnerability-activity', - ], - 'LogStoreTtl' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '180', - ], - ], - ], - ], - 'NormalizationLogViews' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CategoryName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Security Category', - ], - 'ActivityName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'API security risk log', - ], - 'LogViewName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'risk_activity', - ], - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'risk-activity', - ], - 'DetectionRuleReferenceCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'DetectionRuleReferenceProductIds' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'azure_active_directory', - ], - ], - 'LogSearchConditions' => [ - 'title' => 'JSON Array ["key":"product_code", "value":"ctdr"]', - 'description' => '', - 'type' => 'string', - 'example' => '[{\\"SCHEMA\\":\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\"}]', - ], - 'LogViewExisted' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true', - ], - ], - ], - ], - 'ColdStorageUsedCapacity' => [ - 'description' => '', - 'type' => 'number', - 'format' => 'double', - 'example' => '100.0', - ], - 'DataStorageUsedCapacityDetail' => [ - 'description' => '', - 'type' => 'string', - 'example' => '{\\"purchasedHotStorageCapacity\\":1000,\\"usedHotStorageCapacity\\":4.2,\\"usedHotStorageCapacityDetail\\":{\\"ap-southeast-1\\":4.2,\\"cn-shenzhen\\":0.0,\\"cn-shanghai\\":0.0}}', - ], - 'DataStorageRegionPermission' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'deny', - ], - ], - ], - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '81FB0DEA-52C1-55A0-8631-8E1B9A9D****', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"DataStorageRegionId\\": \\"cn-shanghai\\",\\n \\"DataStorageTotalCapacity\\": 100,\\n \\"DataStorageUsedCapacity\\": 100,\\n \\"LogProject\\": \\"aliyun-cloudsiem-data-171835723111****-cn-shanghai\\",\\n \\"SasLogStores\\": [\\n {\\n \\"LogName\\": \\"Process Snapshot\\",\\n \\"LogStoreName\\": \\"sas-security-log\\",\\n \\"LogDeliveryStatus\\": \\"enable\\",\\n \\"LogStoreTtl\\": 180,\\n \\"LogDeliveryUpdateTime\\": \\"2025-07-16T15:10:29\\",\\n \\"LogDeliveryPermission\\": \\"deny\\",\\n \\"LogDeliveryGroup\\": \\"host\\",\\n \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"__topic__\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"sas-net-block\\\\\\\\\\\\\\"}]\\",\\n \\"LogCode\\": \\"sas-net-block\\",\\n \\"LogStoreExisted\\": true\\n }\\n ],\\n \\"NormalizationLogStores\\": [\\n {\\n \\"LogStoreName\\": \\"vulnerability-activity\\",\\n \\"LogStoreTtl\\": 180\\n }\\n ],\\n \\"NormalizationLogViews\\": [\\n {\\n \\"CategoryName\\": \\"Security Category\\",\\n \\"ActivityName\\": \\"API security risk log\\",\\n \\"LogViewName\\": \\"risk_activity\\",\\n \\"LogStoreName\\": \\"risk-activity\\",\\n \\"DetectionRuleReferenceCount\\": 3,\\n \\"DetectionRuleReferenceProductIds\\": [\\n \\"azure_active_directory\\"\\n ],\\n \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"SCHEMA\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\\\\\\\\\\\\\"}]\\",\\n \\"LogViewExisted\\": true\\n }\\n ],\\n \\"ColdStorageUsedCapacity\\": 100,\\n \\"DataStorageUsedCapacityDetail\\": \\"{\\\\\\\\\\\\\\"purchasedHotStorageCapacity\\\\\\\\\\\\\\":1000,\\\\\\\\\\\\\\"usedHotStorageCapacity\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"usedHotStorageCapacityDetail\\\\\\\\\\\\\\":{\\\\\\\\\\\\\\"ap-southeast-1\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"cn-shenzhen\\\\\\\\\\\\\\":0.0,\\\\\\\\\\\\\\"cn-shanghai\\\\\\\\\\\\\\":0.0}}\\",\\n \\"DataStorageRegionPermission\\": \\"deny\\"\\n },\\n \\"RequestId\\": \\"81FB0DEA-52C1-55A0-8631-8E1B9A9D****\\"\\n}","type":"json"}]', - ], - 'CreateDataSource' => [ - 'summary' => '创建数据源', - 'methods' => [ - 'post', - 'get', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'schemes' => [ - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'CreateLogStore', + 'description' => 'The JsonConfig input parameter uses a complex JSON structure. A supporting tool class is provided to simplify this configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateLogStore', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'CreateNormalizationRule' => [ + 'summary' => 'Creates a normalization rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -1285,252 +1324,171 @@ 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The ID of the member accounts in the resource directory.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DataSourceName', + 'name' => 'NormalizationRuleName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AD_LOG。', - ], + 'schema' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''], ], [ - 'name' => 'DataSourceType', + 'name' => 'NormalizationRuleDescription', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset。', - ], + 'schema' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''], ], [ - 'name' => 'DataSourceFrom', + 'name' => 'NormalizationRuleFormat', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'center。', - ], + 'schema' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'SPL', 'title' => ''], ], [ - 'name' => 'LogUserId', + 'name' => 'NormalizationRuleExpression', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''], ], [ - 'name' => 'LogRegionId', + 'name' => 'NormalizationCategoryId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''], ], [ - 'name' => 'LogProjectName', + 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], + 'schema' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''], ], [ - 'name' => 'LogStoreName', + 'name' => 'VendorId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'mde_raw。', - ], + 'schema' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud', 'title' => ''], ], [ - 'name' => 'DataSourceStores', + 'name' => 'ProductId', 'in' => 'formData', - 'style' => 'flat', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'LogRegionId' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - 'LogProjectName' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'actiontrail_management-events。', - ], - 'DataSourceStoreStatus' => [ - 'type' => 'string', - ], - 'DataSourceStoreId' => [ - 'type' => 'string', - ], - 'DataSourceStoreFrom' => [ - 'type' => 'string', - ], - ], - 'required' => false, - ], - 'required' => false, - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ - 'name' => 'DataSourceTemplateId', + 'name' => 'NormalizationRuleMode', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The mode of the normalization rule. Valid values:'."\n" + .'- both'."\n" + .'- scan'."\n" + .'- realtime.', 'type' => 'string', 'required' => false, 'example' => 'both', 'title' => ''], ], [ - 'name' => 'DataSourceIds', + 'name' => 'ExtendContentPacked', 'in' => 'formData', - 'style' => 'json', - 'schema' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'string', - ], - ], + 'schema' => ['title' => '', 'description' => 'Specifies whether to pack non-standard fields into the extension field extend_content. Valid values:'."\n" + .'- enabled: Enabled.'."\n" + .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled'], ], [ - 'name' => 'DataSourceRecognizer', + 'name' => 'NormalizationRuleType', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The type of the normalization rule. Valid values:'."\n" + .'- predefined: predefined normalization rule.'."\n" + .'- custom: custom normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], ], [ - 'name' => 'DataSourceRecognizeEnabled', + 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'type' => 'boolean', - ], + 'schema' => ['description' => 'The field used to sort the rule list. Valid values:'."\n" + .'- GmtModified: sorted by modification time.'."\n" + .'- Id: sorted by rule ID (default).', 'type' => 'string', 'required' => false, 'example' => 'Id', 'title' => ''], ], [ - 'name' => 'DataSourceReferences', + 'name' => 'NormalizationRuleVersion', + 'in' => 'formData', + 'schema' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleIds', 'in' => 'formData', 'style' => 'json', 'schema' => [ + 'description' => 'The list of normalization rule IDs.', 'type' => 'array', - 'items' => [ - 'type' => 'string', - ], + 'items' => ['description' => 'The list of normalization rule IDs.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_cfw_alert_extract_rule,alibaba_cloud_cfw_flow_rule,alibaba_cloud_ndr_http_rule,alibaba_cloud_ndr_dns_rule,alibaba_cloud_ndr_attack_alert_rule', 'title' => ''], + 'required' => false, + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'Order', + 'name' => 'ExtendFieldStoreMode', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The storage mode for extension fields. Valid values: flat, pack, and reject.', 'type' => 'string', 'example' => 'flat', 'required' => false], + ], + [ + 'name' => 'NormalizationSecurityDomainId', + 'in' => 'formData', + 'schema' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'DataSourceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ds-jl67vixpe1scwysgyu3x。', - ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataSourceId\\": \\"ds-jl67vixpe1scwysgyu3x\\"\\n}","type":"json"}]', - ], - 'UpdateDataSource' => [ - 'summary' => '更新数据源', - 'methods' => [ - 'post', - 'get', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Create a normalization rule', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'schemes' => [ - 'https', + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateNormalizationRule', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n}","type":"json"}]', + ], + 'CreateNormalizationSchema' => [ + 'summary' => 'Creates a data source.', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -1539,209 +1497,259 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: for assets in the Chinese mainland and China (Hong Kong)'."\n" + ."\n" + .'- ap-southeast-1: for assets in regions outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese'."\n" + ."\n" + .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'DataSourceId', + 'name' => 'NormalizationSchemaType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ds-014frtpy28m5ct2eoyo1。', - ], + 'schema' => ['description' => 'The type of the normalization structure. Valid values:'."\n" + ."\n" + .'- log: a log'."\n" + ."\n" + .'- entity: an entity', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'log'], ], [ - 'name' => 'DataSourceName', + 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ActiontrailLog。', - ], + 'schema' => ['description' => 'The ID of the normalization structure.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'PROCESS_QUERY_DNS_ACTIVITY'], ], [ - 'name' => 'LogUserId', + 'name' => 'NormalizationSchemaName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The name of the normalization structure.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'ProcessQuery'], ], [ - 'name' => 'DataSourceStores', + 'name' => 'NormalizationSchemaDescription', 'in' => 'formData', - 'style' => 'flat', + 'schema' => ['description' => 'The description of the normalization structure.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'ProcessQuery'], + ], + [ + 'name' => 'NormalizationCategoryId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the normalization classification.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'NETWORK_CATEGORY'], + ], + [ + 'name' => 'TargetLogStore', + 'in' => 'formData', + 'schema' => ['description' => 'The Simple Log Service Logstore.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'xxx-activity'], + ], + [ + 'name' => 'NormalizationFields', + 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'description' => '', 'type' => 'array', 'items' => [ + 'title' => '', 'type' => 'object', 'properties' => [ - 'LogRegionId' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - 'LogProjectName' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', + 'NormalizationFieldName' => ['description' => 'The name of the normalization field.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'cloud_user'], + 'NormalizationFieldType' => ['description' => 'The type of the normalization field. Supported types: text, long, double, and json.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'varchar'], + 'NormalizationFieldRequired' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'required' => false, 'title' => '', 'example' => 'true'], + 'NormalizationFieldDescription' => ['description' => 'The description of the normalization field.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'cloud_user'], + 'NormalizationFieldFrom' => ['description' => 'The source of the key for a normalization field of the json type.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + 'NormalizationFieldExample' => ['description' => 'An example of the normalization field.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '173326*******'], + 'NormalizationFieldTokenize' => ['description' => 'Indicates whether to tokenize the normalization field.', 'type' => 'boolean', 'required' => false, 'title' => '', 'example' => 'true'], + 'NormalizationFieldJsonIndexAll' => ['description' => 'Indicates whether to create an index for all keys of a json type normalization field.', 'type' => 'boolean', 'title' => '', 'required' => false, 'example' => 'true'], + 'NormalizationFieldJsonKeys' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['description' => 'The name of the key for a normalization field of the json type.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'alert_level'], + 'NormalizationFieldType' => ['description' => 'The type of the key for a normalization field of the json type. Supported types: text, long, double, and json.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'text'], + 'NormalizationFieldRequired' => ['description' => 'Indicates whether the key for a normalization field of the json type is required.', 'type' => 'boolean', 'required' => false, 'title' => '', 'example' => 'true'], + 'NormalizationFieldDescription' => ['description' => 'The description of the key for a normalization field of the json type.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'The alert severity levels are represented by the values 1, 2, 3, and 4.'], + 'NormalizationFieldFrom' => ['description' => 'The source of the key for a normalization field of the json type.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + 'NormalizationFieldExample' => ['description' => 'An example of the key for a normalization field of the json type.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => '1, 2, 3, 4'], + 'NormalizationFieldTokenize' => ['description' => 'Indicates whether to tokenize the key for a normalization field of the json type.', 'type' => 'boolean', 'title' => '', 'required' => false, 'example' => 'true'], + ], + 'description' => 'A key for a normalization field of the json type.', + 'required' => false, + 'title' => '', + 'example' => '', + ], + 'maxItems' => 50, + 'title' => '', + 'description' => 'The list of keys for a normalization field of the json type.', 'required' => false, - 'example' => 'cn-rds-sqlaudit。', - ], - 'DataSourceStoreFrom' => [ - 'type' => 'string', - ], - 'DataSourceStoreId' => [ - 'type' => 'string', + 'example' => '', ], + 'NormalizationFieldRequirement' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], + 'NormalizationFieldReserved' => ['description' => 'Indicates whether the normalization field is reserved.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], ], + 'description' => 'The normalization fields.', 'required' => false, + 'example' => '', ], 'required' => false, + 'maxItems' => 200, + 'description' => 'The normalization fields.', + 'title' => '', + 'example' => '', ], ], - [ - 'name' => 'DataSourceRecognizeEnabled', - 'in' => 'formData', + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'title' => '', + 'description' => 'The schema for the response.', + 'example' => '', + ], + ], + ], + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'CreateNormalizationSchema', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateNormalizationSchema', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/*'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'CreateProduct' => [ + 'summary' => 'Creates a product.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'DataSourceFrom', + 'AK' => [], + ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'create', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'OrderField', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'LogStoreName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-rds-sqlaudit。', - ], + 'schema' => ['description' => 'The user ID of a member. This parameter is used when an administrator operates as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'LogProjectName', + 'name' => 'VendorName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], + 'schema' => ['description' => 'The name of the vendor.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''], ], [ - 'name' => 'LogRegionId', + 'name' => 'ProductName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The name of the product.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'ProductId' => ['description' => 'The ID of the product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\"\\n}","type":"json"}]', + 'title' => 'CreateProduct', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is available and provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateProduct', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'RefreshDataSource' => [ - 'summary' => '刷新数据源', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'CreateResponseRule' => [ + 'summary' => 'Creates an automatic response rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -1750,90 +1758,134 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - 'autoTest' => true, - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsas104PTS'], ], 'parameters' => [ [ + 'name' => 'NextToken', + 'in' => 'formData', + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The token that specifies the position from which to start the query. If you do not specify this parameter, the query starts from the beginning.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****'], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The maximum number of results to return.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'], + ], + [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The deployment region of the data management center for threat analysis. You must select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese'."\n" + ."\n" + .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'ResponseRuleName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => 'Send Notification When Generating Urgent Incident', 'title' => ''], + ], + [ + 'name' => 'ResponseRulePriority', + 'in' => 'formData', + 'schema' => ['description' => 'The execution priority of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'ResponseExecutionCondition', + 'in' => 'formData', + 'schema' => ['description' => 'The trigger conditions for the rule, specified as a JSON string.', 'type' => 'string', 'required' => false, 'example' => '[{"left":{"value":"threat_level"},"operator":"equals","right":{"value":"suspicious"}}]', 'title' => ''], + ], + [ + 'name' => 'ResponseActionType', + 'in' => 'formData', + 'schema' => ['description' => 'The action type for the automatic response rule. Valid values:'."\n" + ."\n" + .'- doPlaybook: Runs a playbook.'."\n" + ."\n" + .'- changeEventStatus: Changes the status of an event.'."\n" + ."\n" + .'- changeThreatLevel: Changes the threat level of an event.'."\n" + ."\n" + .'- addEventTag: Adds a tag to an event.'."\n" + ."\n" + .'- deleteEventTag: Deletes a tag from an event.'."\n" + ."\n" + .'- alertWhitelist: Adds an alert to the allowlist.', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook', 'title' => ''], + ], + [ + 'name' => 'ResponseTriggerType', + 'in' => 'formData', + 'schema' => ['description' => 'The trigger type for the automatic response rule. Valid values:'."\n" + ."\n" + .'- event: An event is generated.'."\n" + ."\n" + .'- event\\_update: An event is updated.'."\n" + ."\n" + .'- alert: An alert is generated.', 'type' => 'string', 'required' => false, 'example' => 'event', 'title' => ''], + ], + [ + 'name' => 'ResponseActionConfig', + 'in' => 'formData', + 'schema' => ['description' => 'The action configuration, specified as a JSON string.', 'type' => 'string', 'required' => false, 'example' => '[{"actionType":"doPlaybook","playbookName":"block waf IP","playbookUuid":"system_aliyun_waf_whole_process_book","disposeParam":{"period":"7d"}}]', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the member account. An administrator uses this parameter to operate on behalf of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'DataSourceId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ds-jl67vixpe1scwysgyu3x', - ], + 'schema' => ['description' => 'The operational scope. Valid values:'."\n" + ."\n" + .'- 0: Sets the scope to the current Alibaba Cloud account.'."\n" + ."\n" + .'- 1: Sets the scope to all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => 'Id of the request', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'RequestId' => ['description' => 'The unique request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + 'ResponseRuleId' => ['description' => 'The ID of the automatic response rule.', 'type' => 'string', 'example' => '399827', 'title' => ''], ], + 'title' => '', + 'description' => 'The response data.', + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'CreateResponseRule', + 'description' => 'Some parameters require complex JSON configurations. We provide a helper class with configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"ResponseRuleId\\": \\"399827\\"\\n}","type":"json"}]', ], - 'DeleteDataSource' => [ - 'summary' => '删除数据源', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'CreateVendor' => [ + 'summary' => 'Creates a vendor.', + 'path' => '', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -1842,562 +1894,259 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DataSourceId', + 'name' => 'VendorName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ds-txejfbrh94k5cx58a4qh。', - ], + 'schema' => ['description' => 'The name of the vendor.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'VendorId' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"VendorId\\": \\"vd-qlsw5eocx94w9\\"\\n}","type":"json"}]', + 'title' => 'CreateVendor', + 'description' => 'Notifications are limited by frequency and time. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time frame.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:CreateVendor', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'ListDataSources' => [ - 'summary' => '获取厂商列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'DeleteDataIngestion' => [ + 'summary' => 'Deletes a data ingestion policy.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Management Hub for threat analysis. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'DataSourceIds', - 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_waf_alert_log_173326*******,alibaba_cloud_waf_flow_log_173326*******。', - ], - 'required' => false, - ], - ], - [ - 'name' => 'DataSourceName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_waf_alert_log。', - ], + 'schema' => ['description' => 'The user ID of a member. This parameter allows an administrator to operate on behalf of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DataSourceType', + 'name' => 'DataIngestionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'custom。', - ], + 'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''], ], - [ - 'name' => 'LogUserIds', - 'in' => 'formData', - 'style' => 'simple', + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], - 'required' => false, - ], - ], - [ - 'name' => 'LogRegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - ], - [ - 'name' => 'LogProjectName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', + 'example' => '', ], ], - [ - 'name' => 'LogStoreName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'audit-activity。', - ], + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], - [ - 'name' => 'DataSourceTemplateIds', - 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。', + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DeleteDataIngestion', + 'description' => 'Notifications are sent only between 08:00 and 20:00. Each user can receive a maximum of two notifications per day.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDataIngestion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'], ], - 'required' => false, - ], - ], - [ - 'name' => 'OrderField', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'UpdateTime。', - ], - ], - [ - 'name' => 'Order', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'desc。', - ], - ], - [ - 'name' => 'PageNumber', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1。', - ], - ], - [ - 'name' => 'PageSize', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '5。', ], ], + ], + ], + 'DeleteDataSet' => [ + 'summary' => 'Deletes a dataset.', + 'methods' => ['post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'MaxResults', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'AK' => [], ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'delete', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], + ], + 'parameters' => [ [ - 'name' => 'NextToken', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: for assets in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: for assets outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'DataSourceFrom', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'center。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataSourceStoreStatus', + 'name' => 'DataSetId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - 'required' => false, - ], + 'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-10iy8mbifnb4gniv****', 'title' => ''], ], [ - 'name' => 'DataSourceStatus', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - 'required' => false, - ], + 'schema' => ['description' => 'The user ID that an administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'DataSources' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'DataSourceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ds-scpfegri73oyoknbc90c。', - ], - 'DataSourceName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AD_LOG。', - ], - 'DataSourceType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'custom。', - ], - 'LogUserId' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '173326*******。', - ], - 'LogRegionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cn-hangzhou。', - ], - 'LogProjectName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], - 'DataSourceFrom' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'center。', - ], - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'audit-activity。', - ], - 'DataSourceTemplateId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。'."\n", - ], - 'DataSourceStores' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'DataSourceStoreId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'di_xxxx_source_1。', - ], - 'DataSourceStoreStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normal。', - 'title' => '日志存储状态码', - ], - 'DataSourceStoreFrom' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'center。', - ], - 'LogRegionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cn-hangzhou。', - ], - 'LogProjectName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], - 'LogStoreName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'audit-activity。', - ], - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'CheckTime' => [ - 'type' => 'integer', - 'format' => 'int64', - ], - 'DataSourceStoreStatusCode' => [ - 'title' => '日志存储状态码', - 'type' => 'string', - 'example' => 'LogStoreNotExist', - ], - ], - ], - ], - 'DataSourceRecognizer' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_account_snapshot。', - ], - 'DataSourceRecognizeEnabled' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'DataSourceReferences' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'DataIngestionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。', - ], - ], - ], - ], - 'DataSourceStatus' => [ - 'type' => 'string', - ], - ], - ], - ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2。', - ], - 'TotalPage' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'title' => 'DeleteDataSet', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDataSet', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/{#DataSetId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataSources\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"DataSourceName\\": \\"AD_LOG\\",\\n \\"DataSourceType\\": \\"custom\\",\\n \\"LogUserId\\": 0,\\n \\"LogRegionId\\": \\"cn-hangzhou\\",\\n \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n \\"DataSourceFrom\\": \\"center\\",\\n \\"LogStoreName\\": \\"audit-activity\\",\\n \\"DataSourceTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\",\\n \\"DataSourceStores\\": [\\n {\\n \\"DataSourceStoreId\\": \\"di_xxxx_source_1\\",\\n \\"DataSourceStoreStatus\\": \\"normal\\",\\n \\"DataSourceStoreFrom\\": \\"center\\",\\n \\"LogRegionId\\": \\"cn-hangzhou\\",\\n \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n \\"LogStoreName\\": \\"audit-activity\\",\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"CheckTime\\": 1733269771123,\\n \\"DataSourceStoreStatusCode\\": \\"LogStoreNotExist\\"\\n }\\n ],\\n \\"DataSourceRecognizer\\": \\"alibaba_cloud_sas_account_snapshot\\",\\n \\"DataSourceRecognizeEnabled\\": true,\\n \\"DataSourceReferences\\": [\\n {\\n \\"DataIngestionId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\"\\n }\\n ],\\n \\"DataSourceStatus\\": \\"unconfigured\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 1,\\n \\"TotalCount\\": 2,\\n \\"TotalPage\\": 1,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'UpdateDataSourceTemplate' => [ - 'summary' => '修改数据源模板', - 'path' => '', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'DeleteDataSetRecord' => [ + 'summary' => 'Deletes dataset records.', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -2406,370 +2155,176 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ - 'name' => 'DataSourceTemplateId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion。'."\n", - ], - ], - [ - 'name' => 'DataSourceTemplateName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion。'."\n", - ], - ], - [ - 'name' => 'LogUserIds', - 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '173326*******。', - ], - 'required' => false, - ], - ], - [ - 'name' => 'LogRegionIds', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - ], - [ - 'name' => 'LogProjectPattern', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******。', - ], - ], - [ - 'name' => 'LogStorePattern', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'audit-activity。', - ], + 'schema' => ['description' => 'The region of the Data Management center for Threat Analysis. Select a region based on where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RegionId', + 'name' => 'DataSetId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-10iy8mbifnb4gniv****', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'DataSetRecordIds', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'A list of dataset record IDs in a JSON array format.', 'type' => 'string', 'required' => true, 'example' => '[1,2,3,4]', 'title' => ''], ], [ - 'name' => 'AutoScanNew', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled。', - ], - ], - [ - 'name' => 'DataSourceRecognizeEnabled', - 'in' => 'query', - 'schema' => [ - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to operate as the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], ], + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'ListDataSourceTemplates' => [ - 'summary' => '查询数据源模板', - 'path' => '', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', + 'title' => 'DeleteDataSetRecord', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDataSetRecord', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'DeleteDataSource' => [ + 'summary' => 'Deletes a data source.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'DataSourceTemplateIds', + 'name' => 'RegionId', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion。', - ], - 'required' => false, - 'minItems' => 0, - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], - ], - [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'PageNumber', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1。', - ], + 'schema' => ['description' => 'The user ID of the member whose permissions you want to use. This parameter is available only to administrators.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'PageSize', + 'name' => 'DataSourceId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '10。', - ], + 'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-txejfbrh94k5cx58a4qh', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'DataSourceTemplates' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'DataSourceTemplateId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_actiontrail_event_ingestion。', - ], - 'DataSourceTemplateName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_actiontrail_event_ingestion。', - ], - 'LogProjectPattern' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun-cloudsiem-data-173326*******。', - ], - 'LogRegionIds' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cn-hangzhou。', - ], - ], - 'LogStorePattern' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'audit-activity。', - ], - 'LogUserIds' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => '173326*******。', - ], - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '2025-01-08 10:28:31', - ], - 'DataSourceFrom' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'custom。', - ], - 'AutoScanNew' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled。', - ], - 'DataSourceRecognizer' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_actiontrail_event_ingestion。', - ], - 'DataSourceRecognizeEnabled' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - ], - ], - ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'string', - 'example' => '1。', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'string', - 'example' => '10。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataSourceTemplates\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"DataSourceTemplateId\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n \\"DataSourceTemplateName\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n \\"LogProjectPattern\\": \\"aliyun-cloudsiem-data-173326*******\\",\\n \\"LogRegionIds\\": [\\n \\"cn-hangzhou\\"\\n ],\\n \\"LogStorePattern\\": \\"audit-activity\\",\\n \\"LogUserIds\\": [\\n \\"173326*******\\"\\n ],\\n \\"UpdateTime\\": 1733269771123,\\n \\"DataSourceFrom\\": \\"custom\\",\\n \\"AutoScanNew\\": \\"enabled\\",\\n \\"DataSourceRecognizer\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n \\"DataSourceRecognizeEnabled\\": true\\n }\\n ],\\n \\"PageNumber\\": \\"1\\",\\n \\"PageSize\\": \\"10\\"\\n}","type":"json"}]', - ], - 'CreateLogStore' => [ - 'summary' => '创建LogStore', - 'methods' => [ - 'post', - 'get', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'schemes' => [ - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DeleteDataSource', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDataSource', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/{#DataSourceId}'], + ], + ], + ], ], + ], + 'DeleteDetectionRule' => [ + 'summary' => 'Deletes a detection rule.', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -2778,126 +2333,84 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Management Hub. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The assets are outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogUserId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogRegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'], ], [ - 'name' => 'LogProjectName', + 'name' => 'DetectionRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-channel-173326*******-cn-hangzhou。', - ], + 'schema' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'dr-53np4nguf5jmh1vc****'], ], [ - 'name' => 'LogStoreName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'logstoreqykug。', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used by an administrator to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + 'title' => 'DeleteDetectionRule', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteDetectionRule', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/{#DetectionRuleId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], 'DeleteLogStore' => [ - 'summary' => '删除LogStore', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'summary' => 'Deletes a Logstore.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -2909,1082 +2422,824 @@ 'operationType' => 'create', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Management Hub. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: if your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: if your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ 'name' => 'LogUserId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID for data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ 'name' => 'LogRegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'LogProjectName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', - ], + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], ], [ 'name' => 'LogStoreName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'rds-logstore。', - ], + 'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'rds-logstore', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'ValidateLogStore' => [ - 'summary' => '校验LogStore', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', + 'title' => 'DeleteLogStore', + 'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A supporting tool class with configuration examples is available. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'create', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteLogStore', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'DeleteNormalizationRule' => [ + 'summary' => 'Deletes a normalization rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'none', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - 'tenantRelevance' => 'tenant', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the threat analysis Management Hub. Select the region of the Management Hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogUserId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogRegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - ], - [ - 'name' => 'LogProjectName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to operate on behalf of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'], ], [ - 'name' => 'LogStoreName', + 'name' => 'NormalizationRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ssglauncher-log。', - ], + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'ListLogRegions' => [ - 'summary' => '获取所有的区域', - 'path' => '', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', + 'title' => 'DeleteNormalizationRule', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class that contains configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteNormalizationRule', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'], + ], + ], + ], ], + ], + 'DeleteNormalizationRuleVersion' => [ + 'summary' => 'Deletes a normalization rule version.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], - 'tenantRelevance' => 'publicInformation', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The region of the Data Management center. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'], + ], + [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'], + ], + [ + 'name' => 'NormalizationRuleId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'], + ], + [ + 'name' => 'NormalizationRuleVersion', + 'in' => 'formData', + 'schema' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'LogRegions' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cn-hangzhou。', - ], - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"LogRegions\\": [\\n \\"cn-hangzhou\\"\\n ]\\n}","type":"json"}]', - ], - 'ListLogProjects' => [ - 'summary' => '获取日志Project列表', - 'methods' => [ - 'post', - 'get', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], - 'schemes' => [ - 'https', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DeleteNormalizationRuleVersion', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class with configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteNormalizationRuleVersion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRuleVersion', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationruleversion/{#NormalizationRuleId}/{#NormalizationRuleVersion}'], + ], + ], + ], ], + ], + 'DeleteProduct' => [ + 'summary' => 'Deletes a product.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center for Threat Analysis. Select a region for the Management Hub based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogUserId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogRegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - ], - [ - 'name' => 'MaxResults', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'LogProjects' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'aliyun-cloudsiem-channel-173326*******-cn-beijing。', - ], - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DeleteProduct', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is provided to help you create the configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteProduct', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/{#ProductId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"LogProjects\\": [\\n \\"aliyun-cloudsiem-channel-173326*******-cn-beijing\\"\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', ], - 'ListLogStores' => [ - 'summary' => '获取日志store列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'DeleteResponseRule' => [ + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas104PTS'], ], 'parameters' => [ [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - ], - [ - 'name' => 'Lang', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'LogUserId', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The token used to retrieve the next page of results. If you do not specify this parameter, the service returns the first page of results.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****'], ], [ - 'name' => 'LogRegionId', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The maximum number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'], ], [ - 'name' => 'LogProjectName', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou。', - ], + 'schema' => ['description' => 'The region ID of the data management center for threat analysis. This must be the region where your assets are located. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: for assets in the Chinese mainland or Hong Kong (China).'."\n" + ."\n" + .'- `ap-southeast-1`: for assets in international regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'ResponseRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The ID of the automatic response rule to delete.', 'type' => 'string', 'required' => false, 'example' => '403235', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'LogStores' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'wadaaaa。', - ], - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9BCE0BF1-4F0C-5860-87D2-C391799AF4F2'], ], + 'title' => '', + 'description' => 'The response object.', + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], - ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'DeleteResponseRule', + 'summary' => 'Deletes an automatic response rule.', + 'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"LogStores\\": [\\n \\"wadaaaa\\"\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9BCE0BF1-4F0C-5860-87D2-C391799AF4F2\\"\\n}","type":"json"}]', ], - 'GetLogTicket' => [ - 'summary' => '查看LogStore', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'DeleteVendor' => [ + 'summary' => 'Deletes a vendor.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'delete', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management Center of your threat analysis service is located. Select a region for the Management Center based on the region of your asset. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'LogUserId', + 'name' => 'VendorId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The vendor ID.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], + ], + [ + 'name' => 'VendorName', + 'in' => 'formData', + 'schema' => ['description' => 'The vendor name.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '173326*******。', - ], - 'LogTicket' => [ - 'description' => '', - 'type' => 'string', - 'example' => '*******。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DeleteVendor', + 'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day. These notifications are sent only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'delete', + 'ramAction' => [ + 'action' => 'yundun-sas:DeleteVendor', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/{#VendorId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"173326*******\\",\\n \\"LogTicket\\": \\"*******\\"\\n}","type":"json"}]', ], - 'CreateProduct' => [ - 'summary' => '创建产品', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'DisableDataIngestion' => [ + 'summary' => 'Disables a data ingestion policy.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region of the management center based on the region where your asset is located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'VendorName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '111。', - ], + 'schema' => ['description' => 'The user ID of the member account that the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'ProductName', + 'name' => 'DataIngestionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n", - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'DisableDataIngestion', + 'description' => 'The frequency and time of notifications are limited. Each user receives a maximum of two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:DisableDataIngestion', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\"\\n}","type":"json"}]', ], - 'UpdateProduct' => [ - 'summary' => '更新产品品', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'EnableDataIngestion' => [ + 'summary' => 'Enables the data ingestion policy.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region of the management center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'en。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1733269771123。', - ], - ], - [ - 'name' => 'ProductId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to assume the permissions of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'ProductName', + 'name' => 'DataIngestionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''], ], [ - 'name' => 'VendorName', + 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '111。', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n", - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'DeleteProduct' => [ - 'summary' => '删除产品', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', + 'title' => 'EnableDataIngestion', + 'description' => 'Notification frequency is limited to a maximum of two per user per day. Notifications are sent only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:EnableDataIngestion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'], + ], + ], + ], ], + ], + 'ExecuteAutoDisposeRecords' => [ + 'path' => '', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ - 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], - ], - [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'SelectedEntityList', 'in' => 'formData', + 'style' => 'flat', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'description' => 'The list of entities selected for manual handling.', + 'type' => 'array', + 'items' => [ + 'description' => 'The entity information selected for manual handling.', + 'type' => 'object', + 'properties' => [ + 'AutoDisposeRecordId' => ['description' => 'The unique ID of the investigation record.', 'type' => 'string', 'required' => false, 'example' => '0000089b040b8935fed2e24ca2ec8335', 'title' => ''], + 'EntityUuid' => ['description' => 'The UUID of the entity.', 'type' => 'string', 'required' => false, 'example' => '9938fc2708ddc7b7651f3a19e4f09962', 'title' => ''], + ], + 'required' => false, + 'title' => '', + 'example' => '', + ], 'required' => false, - 'example' => '173326*******。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'ProductId', + 'name' => 'UnSelectedEntityList', 'in' => 'formData', + 'style' => 'flat', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of entities not selected for manual handling.', + 'type' => 'array', + 'items' => [ + 'description' => 'The entity information not selected for manual handling.', + 'type' => 'object', + 'properties' => [ + 'AutoDisposeRecordId' => ['description' => 'The unique ID of the investigation record.', 'type' => 'string', 'required' => false, 'example' => '0000089b040b8935fed2e24ca2ec8335', 'title' => ''], + 'EntityUuid' => ['description' => 'The UUID of the entity.', 'type' => 'string', 'required' => false, 'example' => 'ae6ac3e1c9ada174eb8dadd029a2e9d1', 'title' => ''], + ], + 'required' => false, + 'title' => '', + 'example' => '', + ], 'required' => false, - 'example' => 'alibaba_cloud_sas。', + 'title' => '', + 'example' => '', ], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['title' => '', 'description' => 'Id of the request', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'InvalidUpdateRecord.Conflict', 'errorMessage' => 'Only one of selectedEntityList or unSelectedEntityList can be specified.', 'description' => 'User fails in performing automatic disposal'], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Manually handle alerts', + 'summary' => 'Manually handles alerts. Batch operations are supported.', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:ExecuteAutoDisposeRecords', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'ListProducts' => [ - 'summary' => '获取产品列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ExecuteLogQuery' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -3993,573 +3248,530 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n" + .'- ap-southeast-1: the asset is outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******', - ], + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'ProductIds', + 'name' => 'LogUserId', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas', - ], - 'required' => false, - ], + 'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'ProductName', + 'name' => 'LogRegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'sas', - ], + 'schema' => ['description' => 'The log storage region ID.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'ProductType', + 'name' => 'LogProjectName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset', - ], + 'schema' => ['description' => 'The Simple Log Service project name.', 'type' => 'string', 'required' => false, 'example' => 'slsaudit-center-173326*******-cn-hangzhou', 'title' => ''], ], [ - 'name' => 'VendorId', + 'name' => 'LogStoreName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'vd-qlsw5eocx94w9', - ], + 'schema' => ['description' => 'The Simple Log Service project name.', 'type' => 'string', 'required' => false, 'example' => 'huawei-cn-cfw', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'LogQuery', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50', - ], + 'schema' => ['description' => 'The Simple Log Service query statement.', 'type' => 'string', 'required' => false, 'example' => '*', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'LogCondition', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + [ + 'name' => 'ExtendContentPacked', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'Specifies whether to pack non-standard fields into the extension field extend_content. Valid values:'."\n" + .'- enabled: Enabled.'."\n" + .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled'], + ], + [ + 'name' => 'NormalizationSchemaId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'If packing is enabled, you must specify NormalizationSchemaId.', 'type' => 'string', 'required' => false, 'example' => 'WAF_ALERT_ACTIVITY'], + ], + [ + 'name' => 'StartTime', + 'in' => 'formData', + 'schema' => ['description' => 'The start time.', 'type' => 'string', 'required' => false, 'example' => '1733269771123', 'title' => ''], + ], + [ + 'name' => 'EndTime', + 'in' => 'formData', + 'schema' => ['description' => 'The end time.', 'type' => 'string', 'required' => false, 'example' => '1733269771123', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - 'Products' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'QueryResult' => [ + 'description' => 'The query result.', 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123', - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas', - ], - 'ProductAlias' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas', - ], - 'ProductName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'sas', - ], - 'ProductType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'preset', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'vd-qlsw5eocx94w9', - ], - 'VendorName' => [ - 'description' => '', - 'type' => 'string', - 'example' => '111', - ], - 'DataIngestionStatus' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'enabled', - ], - 'TotalDataIngestionCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'EnabledDataIngestionCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'AllowAddDataIngestion' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true', - ], - 'AbnormalDataIngestionCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'ActiveTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123', - ], - ], - ], - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57', + 'items' => ['description' => 'The query result.', 'type' => 'any', 'example' => '[]', 'title' => ''], + 'example' => '[]。', + 'title' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Execute a log service query', + 'summary' => 'Executes a data query.', + 'description' => 'The input parameter JsonConfig is a complex JSON Configurations. A utility class is provided to help with specific configuration examples. Refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:CheckLogQuery', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Products\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"ProductAlias\\": \\"alibaba_cloud_sas\\",\\n \\"ProductName\\": \\"sas\\",\\n \\"ProductType\\": \\"preset\\",\\n \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n \\"VendorName\\": \\"111\\",\\n \\"DataIngestionStatus\\": true,\\n \\"TotalDataIngestionCount\\": 10,\\n \\"EnabledDataIngestionCount\\": 1,\\n \\"AllowAddDataIngestion\\": true,\\n \\"AbnormalDataIngestionCount\\": 2,\\n \\"ActiveTime\\": 1733269771123\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"QueryResult\\": [\\n \\"[]\\"\\n ]\\n}","type":"json"}]', ], - 'CreateVendor' => [ - 'summary' => '创建厂商', + 'ExecuteUpgrade' => [ + 'summary' => 'Performs a version upgrade.', 'path' => '', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region for the Management Hub based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'en。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'VendorName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '111。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can switch to the perspective of this member.', 'type' => 'string', 'required' => false, 'example' => '173326*******', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n", - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'vd-qlsw5eocx94w9。', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'ExecuteUpgrade', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class is provided to assist with this configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:ExecuteUpgrade', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"VendorId\\": \\"vd-qlsw5eocx94w9\\"\\n}","type":"json"}]', ], - 'UpdateVendor' => [ - 'summary' => '更新厂商', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetAlert' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region in which the threat detection and response data management center resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'AlertUuid', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。'."\n", - ], + 'schema' => ['description' => 'The ID of the alert that is associated with the incident.', 'type' => 'string', 'required' => false, 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''], ], [ - 'name' => 'VendorId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'vd-qlsw5eocx94w9。', - ], + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'VendorName', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '111。', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n", + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'Alert' => [ + 'description' => 'If this value is true, the minor engine version is not the latest version.'."\n" + ."\n" + .'> If the minor engine version of your server is not the latest version, the sampling logs may be inaccurate, which causes inaccurate IP statistics. We recommend that you upgrade the minor engine version at your earliest convenience.', + 'type' => 'object', + 'properties' => [ + 'AlertUuid' => ['description' => 'The alert UUID.', 'type' => 'string', 'example' => 'sas_1175554881779200_e59368b3ce1690eae7978f7712a69050', 'title' => ''], + 'AlertRecord' => ['description' => 'The alert content.', 'type' => 'string', 'example' => '{***}', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve alert details', + 'summary' => 'Retrieves the details of an alert.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. We provide a utility class to help with specific configuration examples. For more information, see [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Alert\\": {\\n \\"AlertUuid\\": \\"sas_1175554881779200_e59368b3ce1690eae7978f7712a69050\\",\\n \\"AlertRecord\\": \\"{***}\\"\\n }\\n}","type":"json"}]', ], - 'DeleteVendor' => [ - 'summary' => '删除厂商', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetAutoDisposeConfig' => [ + 'path' => '', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'ProductCode', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The code for the cloud product.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + 'AutoDisposeConfig' => [ + 'type' => 'object', + 'properties' => [ + 'ProductCode' => ['description' => 'The code for the cloud product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'AutoDecisionStatus' => ['description' => 'Indicates whether automatic response is enabled. Valid values:'."\n" + ."\n" + .'- enabled: Enabled.'."\n" + ."\n" + .'- disabled: Disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + ], + 'description' => 'The automatic response configuration.', + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'description' => 'The response body.', + 'example' => '', ], ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'GetAutoDisposeConfig', + 'summary' => 'Retrieves the automatic response configuration.', + 'description' => 'The `JsonConfig` input parameter uses a complex JSON structure. Refer to the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java) for a helper utility and configuration examples.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"AutoDisposeConfig\\": {\\n \\"ProductCode\\": \\"alibaba_cloud_sas\\",\\n \\"AutoDecisionStatus\\": \\"enabled\\"\\n }\\n}","type":"json"}]', + ], + 'GetDataBatchIngestion' => [ + 'summary' => 'Retrieves the details of a batch data ingestion task.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'RoleFor', + 'AK' => [], + ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The region where the Data Management Center for threat analysis is located. Select the region of the Management Center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'VendorId', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'vd-qlsw5eocx94w9。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'VendorName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '111。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******'."\n", 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n", + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'DataBatchIngestion' => [ + 'description' => 'The details of the batch data ingestion task.', + 'type' => 'object', + 'properties' => [ + 'DataBatchIngestionStatus' => ['description' => 'The status of the batch data ingestion task. Valid values:'."\n" + ."\n" + .'- pending: The configuration is pending to take effect.'."\n" + ."\n" + .'- running: The configuration is taking effect.'."\n" + ."\n" + .'- success: The configuration has taken effect.'."\n" + ."\n" + .'- failed: The configuration failed to take effect.', 'type' => 'string', 'example' => 'pending', 'title' => ''], + 'DataBatchIngestionSetTime' => ['description' => 'The time when the batch data ingestion task was configured.', 'type' => 'string', 'example' => '1733269771123', 'title' => ''], + 'DataBatchIngestionEffectTime' => ['description' => 'The time when the configuration of the batch data ingestion task took effect.', 'type' => 'string', 'example' => '1733269771123', 'title' => ''], + 'LogUserIds' => [ + 'description' => 'The list of user IDs for batch data ingestion.', + 'type' => 'array', + 'items' => ['description' => 'The user ID for batch data ingestion.', 'type' => 'string', 'example' => '173326*******', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'AutoScanNew' => ['description' => 'Specifies whether to automatically discover new users. Valid values:'."\n" + ."\n" + .'- enabled: New users are automatically discovered.'."\n" + ."\n" + .'- disabled: New users are not automatically discovered.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'DataIngestions' => [ + 'description' => 'The list of data ingestion tasks.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data ingestion object.', + 'type' => 'object', + 'properties' => [ + 'DataIngestionId' => ['description' => 'The ID of the data ingestion task.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_ingestion_173326*******', 'title' => ''], + 'DataIngestionStatus' => ['description' => 'The status of the data ingestion task. Valid values:'."\n" + ."\n" + .'- enabled: enabled'."\n" + ."\n" + .'- disabled: disabled', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_log_173326*******', 'title' => ''], + 'ProductId' => ['description' => 'The ID of the product.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'VendorId' => ['description' => 'The ID of the vendor.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'RecommendDataIngestionIds' => [ + 'description' => 'The list of recommended data ingestion IDs.', + 'type' => 'array', + 'items' => ['description' => 'The recommended data ingestion ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_log_173326*******', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'ApsaraDataIngestionIds' => [ + 'description' => 'The list of data ingestion IDs for Alibaba Cloud services.', + 'type' => 'array', + 'items' => ['description' => 'The data ingestion ID for an Alibaba Cloud service.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_process_log_173326*******', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'DataSourceRecognizeEnabled' => ['description' => 'Specifies whether to automatically discover new Logstores.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'DataBatchIngestionMode' => ['description' => 'The mode of the batch data ingestion task.', 'type' => 'string', 'example' => 'full', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataBatchIngestion\\": {\\n \\"DataBatchIngestionStatus\\": \\"pending\\",\\n \\"DataBatchIngestionSetTime\\": \\"1733269771123\\",\\n \\"DataBatchIngestionEffectTime\\": \\"1733269771123\\",\\n \\"LogUserIds\\": [\\n \\"173326*******\\"\\n ],\\n \\"AutoScanNew\\": \\"enabled\\",\\n \\"DataIngestions\\": [\\n {\\n \\"DataIngestionId\\": \\"alibaba_cloud_sas_process_ingestion_173326*******\\",\\n \\"DataIngestionStatus\\": \\"enabled\\",\\n \\"DataSourceId\\": \\"alibaba_cloud_sas_process_log_173326*******\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"VendorId\\": \\"alibaba_cloud\\"\\n }\\n ],\\n \\"RecommendDataIngestionIds\\": [\\n \\"alibaba_cloud_sas_process_log_173326*******\\"\\n ],\\n \\"ApsaraDataIngestionIds\\": [\\n \\"alibaba_cloud_sas_process_log_173326*******\\"\\n ],\\n \\"DataSourceRecognizeEnabled\\": true,\\n \\"DataBatchIngestionMode\\": \\"full\\"\\n }\\n}","type":"json"}]', + 'title' => 'GetDataBatchIngestion', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class with configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetDataBatchIngestion', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'ListVendors' => [ - 'summary' => '获取厂商列表', - 'path' => '', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetDataStorage' => [ + 'summary' => 'Retrieves the details of user logs in log management.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -4568,809 +3780,1156 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], + 'autoTest' => true, + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。'."\n", - ], + 'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center region based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n" + .'- ap-southeast-1: the asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'en。'."\n", - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。'."\n", + 'title' => '', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'Data' => [ + 'description' => 'The returned details.', + 'type' => 'object', + 'properties' => [ + 'DataStorageRegionId' => ['description' => 'The storage region of user logs.', 'type' => 'string', 'example' => 'cn-shanghai', 'title' => ''], + 'DataStorageTotalCapacity' => ['description' => 'The storage capacity purchased in the subscription scenario.', 'type' => 'integer', 'format' => 'int64', 'example' => '100', 'title' => ''], + 'DataStorageUsedCapacity' => ['description' => 'The storage capacity used in user log management.', 'type' => 'number', 'format' => 'double', 'example' => '100.0', 'title' => ''], + 'LogProject' => ['description' => 'The name of the Simple Log Service project that stores user logs.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-171835723111****-cn-shanghai', 'title' => ''], + 'SasLogStores' => [ + 'description' => 'The details of raw log storage in Security Center.', + 'type' => 'array', + 'items' => [ + 'description' => 'The details of raw log storage in Security Center.', + 'type' => 'object', + 'properties' => [ + 'LogName' => ['description' => 'The log name.', 'type' => 'string', 'example' => 'Process Snapshot', 'title' => ''], + 'LogStoreName' => ['description' => 'The name of the Logstore where the log is stored.', 'type' => 'string', 'example' => 'sas-security-log', 'title' => ''], + 'LogDeliveryStatus' => ['description' => 'The log delivery status. Valid values:'."\n" + .'- enable: log delivery is enabled.'."\n" + .'- disable: log delivery is disabled.', 'type' => 'string', 'example' => 'enable', 'title' => ''], + 'LogStoreTtl' => ['description' => 'The storage duration of the Logstore where the log is stored. Logs are stored for at least 30 days.', 'type' => 'integer', 'format' => 'int32', 'example' => '180', 'title' => ''], + 'LogDeliveryUpdateTime' => ['description' => 'The time when the log delivery was last modified.', 'type' => 'string', 'example' => '2025-07-16T15:10:29', 'title' => ''], + 'LogDeliveryPermission' => ['description' => 'Indicates whether log delivery can be toggled. Log delivery cannot be enabled if the service is not purchased. Valid values:'."\n" + .'- allow: Allowed.'."\n" + .'- deny: Not allowed.', 'type' => 'string', 'example' => 'deny', 'title' => ''], + 'LogDeliveryGroup' => ['description' => 'The group to which the log belongs. Valid values:'."\n" + .'- host: host logs.'."\n" + .'- security: security logs.', 'type' => 'string', 'example' => 'host', 'title' => ''], + 'LogSearchConditions' => ['title' => '', 'description' => 'The default log query conditions for the log. When multiple logs are stored in the same Logstore, log query conditions are required to query individual logs.', 'type' => 'string', 'example' => '[{\\"__topic__\\":\\"sas-net-block\\"}]'], + 'LogCode' => ['description' => 'The log code.', 'type' => 'string', 'example' => 'sas-net-block', 'title' => ''], + 'LogStoreExisted' => ['description' => 'Indicates whether the Logstore where the log is stored exists. Valid values:'."\n" + .'- true: The Logstore exists.'."\n" + .'- false: The Logstore does not exist.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'UsedCapacity' => ['title' => '', 'description' => 'The hot storage capacity used.', 'type' => 'number', 'format' => 'double', 'example' => '10.333'], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'NormalizationLogStores' => [ + 'description' => 'The details of the Logstores for normalized data.', + 'type' => 'array', + 'items' => [ + 'description' => 'The details of the Logstores for normalized data.', + 'type' => 'object', + 'properties' => [ + 'LogStoreName' => ['description' => 'The name of the Logstore that stores normalized data.', 'type' => 'string', 'example' => 'vulnerability-activity', 'title' => ''], + 'LogStoreTtl' => ['description' => 'The storage duration of normalized data.', 'type' => 'integer', 'format' => 'int32', 'example' => '180', 'title' => ''], + 'UsedCapacity' => ['title' => '', 'description' => 'The hot storage capacity used.', 'type' => 'number', 'format' => 'double', 'example' => '10.333'], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'UnusedLogStores' => [ + 'title' => '', + 'description' => 'The list of legacy SIEM V1 Logstores.', + 'type' => 'array', + 'items' => [ + 'title' => '', + 'description' => 'The legacy SIEM V1 Logstore information.', + 'type' => 'object', + 'properties' => [ + 'LogStoreName' => ['title' => '', 'description' => 'The Logstore name.', 'type' => 'string', 'example' => 'cloud-siem'], + 'LogStoreTtl' => ['title' => '', 'description' => 'The data storage duration.', 'type' => 'integer', 'format' => 'int32', 'example' => '180'], + 'UsedCapacity' => ['title' => '', 'description' => 'The hot storage capacity used.', 'type' => 'number', 'format' => 'double', 'example' => '10.333'], + ], + 'example' => '', + ], + 'example' => '', + ], + 'RecordLogStores' => [ + 'title' => '', + 'description' => 'The list of record Logstores.', + 'type' => 'array', + 'items' => [ + 'title' => '', + 'description' => 'The Logstore information.', + 'type' => 'object', + 'properties' => [ + 'LogStoreName' => ['title' => '', 'description' => 'The Logstore name.', 'type' => 'string', 'example' => 'alert-record'], + 'LogStoreTtl' => ['title' => '', 'description' => 'The time-to-live (TTL) of the Logstore.', 'type' => 'integer', 'format' => 'int32', 'example' => '90'], + 'UsedCapacity' => ['title' => '', 'description' => 'The used capacity of the Logstore.', 'type' => 'number', 'format' => 'double', 'example' => '11.111'], + ], + 'example' => '', + ], + 'example' => '', + ], + 'NormalizationLogViews' => [ + 'description' => 'The details of normalized datasets.', + 'type' => 'array', + 'items' => [ + 'description' => 'The details of normalized datasets.', + 'type' => 'object', + 'properties' => [ + 'CategoryName' => ['description' => 'The category of the normalized log.', 'type' => 'string', 'example' => 'Security Category', 'title' => ''], + 'ActivityName' => ['description' => 'The log type of the normalized log.', 'type' => 'string', 'example' => 'API security risk log', 'title' => ''], + 'LogViewName' => ['description' => 'The name of the normalized dataset.', 'type' => 'string', 'example' => 'risk_activity', 'title' => ''], + 'LogStoreName' => ['description' => 'The Logstore where threat analysis stores normalized logs.', 'type' => 'string', 'example' => 'risk-activity', 'title' => ''], + 'DetectionRuleReferenceCount' => ['description' => 'The number of times the normalized dataset is referenced in the threat analysis access center.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''], + 'DetectionRuleReferenceProductIds' => [ + 'description' => 'The list of products that reference the normalized dataset in the threat analysis access center.', + 'type' => 'array', + 'items' => ['description' => 'The product ID in the threat analysis access center.', 'type' => 'string', 'example' => 'azure_active_directory', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'LogSearchConditions' => ['title' => '', 'description' => 'The query statement used to query the log type in the normalized dataset.', 'type' => 'string', 'example' => '[{\\"SCHEMA\\":\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\"}]'], + 'LogViewExisted' => ['description' => 'Indicates whether the normalized dataset exists. Valid values:'."\n" + .'- true: The normalized dataset exists.'."\n" + .'- false: The normalized dataset does not exist.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'ColdStorageUsedCapacity' => ['description' => 'The cold storage capacity used by user logs.', 'type' => 'number', 'format' => 'double', 'example' => '100.0', 'title' => ''], + 'DataStorageUsedCapacityDetail' => ['description' => 'The storage usage details in log management.', 'type' => 'string', 'example' => '{\\"purchasedHotStorageCapacity\\":1000,\\"usedHotStorageCapacity\\":4.2,\\"usedHotStorageCapacityDetail\\":{\\"ap-southeast-1\\":4.2,\\"cn-shenzhen\\":0.0,\\"cn-shanghai\\":0.0}}', 'title' => ''], + 'DataStorageRegionPermission' => ['description' => 'Indicates whether the storage region can be modified. By default, the storage region cannot be modified. Contact your account manager to reset the region. The region can be reset only once. Valid values:'."\n" + .'- allow: The storage region can be modified.'."\n" + .'- deny: The storage region cannot be modified.', 'type' => 'string', 'example' => 'deny', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '81FB0DEA-52C1-55A0-8631-8E1B9A9D****', 'title' => ''], + ], + 'example' => '', ], ], - [ - 'name' => 'VendorIds', - 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'vd-qlsw5eocx94w9。', + ], + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"Data\\": {\\n \\"DataStorageRegionId\\": \\"cn-shanghai\\",\\n \\"DataStorageTotalCapacity\\": 100,\\n \\"DataStorageUsedCapacity\\": 100,\\n \\"LogProject\\": \\"aliyun-cloudsiem-data-171835723111****-cn-shanghai\\",\\n \\"SasLogStores\\": [\\n {\\n \\"LogName\\": \\"Process Snapshot\\",\\n \\"LogStoreName\\": \\"sas-security-log\\",\\n \\"LogDeliveryStatus\\": \\"enable\\",\\n \\"LogStoreTtl\\": 180,\\n \\"LogDeliveryUpdateTime\\": \\"2025-07-16T15:10:29\\",\\n \\"LogDeliveryPermission\\": \\"deny\\",\\n \\"LogDeliveryGroup\\": \\"host\\",\\n \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"__topic__\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"sas-net-block\\\\\\\\\\\\\\"}]\\",\\n \\"LogCode\\": \\"sas-net-block\\",\\n \\"LogStoreExisted\\": true,\\n \\"UsedCapacity\\": 10.333\\n }\\n ],\\n \\"NormalizationLogStores\\": [\\n {\\n \\"LogStoreName\\": \\"vulnerability-activity\\",\\n \\"LogStoreTtl\\": 180,\\n \\"UsedCapacity\\": 10.333\\n }\\n ],\\n \\"UnusedLogStores\\": [\\n {\\n \\"LogStoreName\\": \\"cloud-siem\\",\\n \\"LogStoreTtl\\": 180,\\n \\"UsedCapacity\\": 10.333\\n }\\n ],\\n \\"RecordLogStores\\": [\\n {\\n \\"LogStoreName\\": \\"alert-record\\",\\n \\"LogStoreTtl\\": 90,\\n \\"UsedCapacity\\": 11.111\\n }\\n ],\\n \\"NormalizationLogViews\\": [\\n {\\n \\"CategoryName\\": \\"Security Category\\",\\n \\"ActivityName\\": \\"API security risk log\\",\\n \\"LogViewName\\": \\"risk_activity\\",\\n \\"LogStoreName\\": \\"risk-activity\\",\\n \\"DetectionRuleReferenceCount\\": 3,\\n \\"DetectionRuleReferenceProductIds\\": [\\n \\"azure_active_directory\\"\\n ],\\n \\"LogSearchConditions\\": \\"[{\\\\\\\\\\\\\\"SCHEMA\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"AZURE_ACTIVE_DIRECTORY_AUDIT_ACTIVITY\\\\\\\\\\\\\\"}]\\",\\n \\"LogViewExisted\\": true\\n }\\n ],\\n \\"ColdStorageUsedCapacity\\": 100,\\n \\"DataStorageUsedCapacityDetail\\": \\"{\\\\\\\\\\\\\\"purchasedHotStorageCapacity\\\\\\\\\\\\\\":1000,\\\\\\\\\\\\\\"usedHotStorageCapacity\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"usedHotStorageCapacityDetail\\\\\\\\\\\\\\":{\\\\\\\\\\\\\\"ap-southeast-1\\\\\\\\\\\\\\":4.2,\\\\\\\\\\\\\\"cn-shenzhen\\\\\\\\\\\\\\":0.0,\\\\\\\\\\\\\\"cn-shanghai\\\\\\\\\\\\\\":0.0}}\\",\\n \\"DataStorageRegionPermission\\": \\"deny\\"\\n },\\n \\"RequestId\\": \\"81FB0DEA-52C1-55A0-8631-8E1B9A9D****\\"\\n}","type":"json"}]', + 'title' => 'Retrieve user log details in log management', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetDataStorage', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], ], - 'required' => false, ], ], + ], + ], + 'GetDetectionStatistic' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'VendorName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '111。', - ], + 'AK' => [], ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], + ], + 'parameters' => [ [ - 'name' => 'VendorType', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset。', - ], + 'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: China (Hangzhou). Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Singapore. Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。'."\n", - ], - 'Vendors' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'vd-qlsw5eocx94w9。', - ], - 'VendorName' => [ - 'description' => '', - 'type' => 'string', - 'example' => '111。', - ], - 'VendorType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'preset。', - ], - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6FB890AC-90B2-5EEA-845B-F7C86FB2****', 'title' => ''], + 'DetectionStatistic' => [ + 'description' => 'The detection rule count result.', + 'type' => 'object', + 'properties' => [ + 'DetectionRuleOnlineCount' => ['description' => 'The number of online rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'DetectionRuleTestCount' => ['description' => 'The number of test rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '5', 'title' => ''], + 'DetectionRuleTemplateCount' => ['description' => 'The number of rule templates.', 'type' => 'integer', 'format' => 'int32', 'example' => '20', 'title' => ''], + 'GraphComputeRuleCount' => ['description' => 'The number of graph computing rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '12', 'title' => ''], + 'WindowRuleCount' => ['description' => 'The number of similar aggregation rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '6', 'title' => ''], + 'PassthroughRuleCount' => ['description' => 'The number of alert pass-through rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + 'AiPoweredAggregationRuleCount' => ['type' => 'integer', 'format' => 'int32', 'description' => '', 'title' => '', 'example' => ''], ], - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'minimum' => '0', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Vendors\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n \\"VendorName\\": \\"111\\",\\n \\"VendorType\\": \\"preset\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', - ], - 'CreateDataIngestion' => [ - 'summary' => '创建数据源', - 'methods' => [ - 'post', - 'get', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve detection rule count', + 'summary' => 'Retrieves the count of detection rules.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'schemes' => [ - 'https', + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetDetectionStatistic', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6FB890AC-90B2-5EEA-845B-F7C86FB2****\\",\\n \\"DetectionStatistic\\": {\\n \\"DetectionRuleOnlineCount\\": 10,\\n \\"DetectionRuleTestCount\\": 5,\\n \\"DetectionRuleTemplateCount\\": 20,\\n \\"GraphComputeRuleCount\\": 12,\\n \\"WindowRuleCount\\": 6,\\n \\"PassthroughRuleCount\\": 2,\\n \\"AiPoweredAggregationRuleCount\\": 0\\n }\\n}","type":"json"}]', + ], + 'GetExportTask' => [ + 'summary' => 'Retrieves the progress of an export task.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center is deployed. Select a region based on your asset location. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'ExportId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The ID of the export task.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '200013', 'title' => ''], ], [ - 'name' => 'DataIngestionMode', + 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member account. An administrator can use this parameter to operate as the specified member account.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'realtime。', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'FileName' => ['description' => 'The name of the file.', 'type' => 'string', 'example' => 'event_1193842352994186_17344888****.xlsx', 'title' => ''], + 'Id' => ['description' => 'The ID of the export task.', 'type' => 'integer', 'format' => 'int64', 'example' => '400185', 'title' => ''], + 'ExportType' => ['description' => 'The type of the export task. Valid value:'."\n" + ."\n" + .'- incident\\_list: event list.', 'type' => 'string', 'example' => 'incident_list', 'title' => ''], + 'ExportStatus' => ['description' => 'The status of the task. Valid values:'."\n" + ."\n" + .'- success: The task is successful.'."\n" + ."\n" + .'- exporting: The task is in progress.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'Progress' => ['description' => 'The progress of the export task.', 'type' => 'integer', 'format' => 'int32', 'example' => '66', 'title' => ''], + 'GmtCreate' => ['description' => 'The time when the task was created.', 'type' => 'string', 'example' => '1605076118000', 'title' => ''], + 'Link' => ['description' => 'The download link for the exported Excel file.', 'type' => 'string', 'example' => 'https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx', 'title' => ''], + ], + 'example' => '', ], ], - [ - 'name' => 'DataSourceId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ds-3g6lyf4eonngyohaq7tr。', + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n \\"Id\\": 400185,\\n \\"ExportType\\": \\"incident_list\\",\\n \\"ExportStatus\\": \\"success\\",\\n \\"Progress\\": 66,\\n \\"GmtCreate\\": \\"1605076118000\\",\\n \\"Link\\": \\"https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx\\"\\n}","type":"json"}]', + 'title' => 'GetExportTask', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetExportTask', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + ], + 'GetIncident' => [ + 'summary' => 'Retrieves the details of an event.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'NormalizationRuleId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-hdmady54piigkjfv17yp。', - ], + 'AK' => [], ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], + ], + 'parameters' => [ [ - 'name' => 'DataSourceEditable', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'boolean', - ], + 'schema' => ['description' => 'The region where the data management center of the threat analysis feature is located. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'DataIngestionStateCode', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'CapacityCount', + 'name' => 'IncidentUuid', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The UUID of the event.', 'type' => 'string', 'required' => false, 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''], ], [ - 'name' => 'StreamJobId', + 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'type' => 'string', + 'title' => '', + 'description' => 'The response struct.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'Incident' => [ + 'description' => 'The event information.', + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1757386075000', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1757386075000', 'title' => ''], + 'IncidentUuid' => ['description' => 'The UUID of the event.', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', 'title' => ''], + 'Owner' => ['title' => '', 'description' => 'The owner of the event.', 'type' => 'string', 'example' => '1234567890xxxxxx'], + 'IncidentDescription' => ['description' => 'The description of the event.', 'type' => 'string', 'example' => 'Forti incident desc', 'title' => ''], + 'IncidentName' => ['description' => 'The name of the event.', 'type' => 'string', 'example' => 'Forti', 'title' => ''], + 'ThreatLevel' => ['description' => 'The threat level. Valid values:'."\n" + .'- 5: critical.'."\n" + .'- 4: high.'."\n" + .'- 3: medium.'."\n" + .'- 2: low.'."\n" + .'- 1: informational.', 'type' => 'string', 'example' => '2', 'title' => ''], + 'IncidentAggregationType' => ['description' => 'The event summaries type. Valid values:'."\n" + ."\n" + .'- none: no event is generated.'."\n" + .'- graph_compute: graph computing (supported by predefined rules).'."\n" + .'- expert: expert rule.'."\n" + .'- passthrough: alerting pass-through (one-to-one).'."\n" + .'- window: same-type aggregation (window).', 'type' => 'string', 'example' => 'window', 'title' => ''], + 'ThreatScore' => ['description' => 'The threat score of the event. Valid values: 0 to 100. A higher score indicates a higher risk level.', 'type' => 'string', 'example' => '90', 'title' => ''], + 'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-fy2zvgiykjifbiim****', 'title' => ''], + 'RelateAlertCount' => ['description' => 'The number of alerts associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '23', 'title' => ''], + 'RelateAssetCount' => ['description' => 'The number of assets associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + 'IncidentRemark' => ['description' => 'The remarks of the event.', 'type' => 'string', 'example' => 'Remark', 'title' => ''], + 'AttckTactics' => ['description' => 'The count of attack stages associated with the event alerts.', 'type' => 'any', 'example' => '{'."\n" + .' "AttckTactics": ['."\n" + .' {'."\n" + .' "tacticName": "Reconnaissance",'."\n" + .' "alertNum": 0,'."\n" + .' "tacticId": "TA0040"'."\n" + .' }'."\n" + .' ]'."\n" + .'}', 'title' => ''], + 'IncidentTags' => ['description' => 'The tags of the event.', 'type' => 'string', 'example' => '["sys:data_source:waf"]', 'title' => ''], + 'RelateDataSourceIds' => ['description' => 'The list of associated data sources.', 'type' => 'any', 'example' => '["siem"]', 'title' => ''], + 'RelateUserIds' => ['description' => 'The list of user IDs associated with the event.', 'type' => 'any', 'example' => '["176618589410****","1130916744888****"]', 'title' => ''], + 'IncidentStatus' => ['description' => 'The status of the event. Valid values:'."\n" + .'- 0: unhandled.'."\n" + .'- 1: handling.'."\n" + .'- 5: handling failed.'."\n" + .'- 10: handled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''], + 'ResponseTime' => ['description' => 'The response time. Unit: milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1757386075000', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + ], + 'example' => '', ], ], + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Incident\\": {\\n \\"CreateTime\\": 1757386075000,\\n \\"UpdateTime\\": 1757386075000,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"Owner\\": \\"1234567890xxxxxx\\",\\n \\"IncidentDescription\\": \\"Forti incident desc\\",\\n \\"IncidentName\\": \\"Forti\\",\\n \\"ThreatLevel\\": \\"2\\",\\n \\"IncidentAggregationType\\": \\"window\\",\\n \\"ThreatScore\\": \\"90\\",\\n \\"DetectionRuleId\\": \\"dr-fy2zvgiykjifbiim****\\",\\n \\"RelateAlertCount\\": 23,\\n \\"RelateAssetCount\\": 2,\\n \\"IncidentRemark\\": \\"Remark\\",\\n \\"AttckTactics\\": \\"{\\\\n\\\\t\\\\\\"AttckTactics\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticName\\\\\\": \\\\\\"Reconnaissance\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"alertNum\\\\\\": 0,\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticId\\\\\\": \\\\\\"TA0040\\\\\\"\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\",\\n \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:waf\\\\\\"]\\",\\n \\"RelateDataSourceIds\\": \\"[\\\\\\"siem\\\\\\"]\\",\\n \\"RelateUserIds\\": \\"[\\\\\\"176618589410****\\\\\\",\\\\\\"1130916744888****\\\\\\"]\\",\\n \\"IncidentStatus\\": 0,\\n \\"ResponseTime\\": 1757386075000\\n }\\n}","type":"json"}]', + 'title' => 'Get event details', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration string. A utility class is provided to help with specific configuration examples. For more information, see [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetIncident'], + ], + ], + 'ramActions' => [ [ - 'name' => 'DataIngestionType', - 'in' => 'formData', - 'schema' => [ - 'type' => 'string', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetIncident', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Incident', 'arn' => 'acs:yundun-sas::{#accountId}:incident/{#IncidentUuid}'], + ], ], ], + ], + ], + 'GetLogTicket' => [ + 'summary' => 'Retrieves a log ticket.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'ScanDataSourceId', + 'AK' => [], + ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The region of the Data Management hub for threat analysis. Select the region based on the location of your asset. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'UpdateTime', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int64', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'NormalizationRuleEditable', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'boolean', - ], + 'schema' => ['description' => 'The user ID of a member. This parameter lets an administrator switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'ProductId', + 'name' => 'LogUserId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'DataIngestionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'di-yxtm3l2rwa7fr5uvxtc7。', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '173326*******', 'title' => ''], + 'LogTicket' => ['description' => 'The ticket for Simple Log Service.', 'type' => 'string', 'example' => '*******', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"173326*******\\",\\n \\"LogTicket\\": \\"*******\\"\\n}","type":"json"}]', + 'title' => 'GetLogTicket', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class is provided to assist with the configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetLogTicket', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataIngestionId\\": \\"di-yxtm3l2rwa7fr5uvxtc7\\"\\n}","type":"json"}]', ], - 'EnableDataIngestion' => [ - 'summary' => '启动数据接入', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetNormalizationRule' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the data management center of threat analysis is located. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n" + .'- ap-southeast-1: the asset is outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID that the administrator uses to switch to the view of another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DataIngestionId', + 'name' => 'NormalizationRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。', - ], + 'schema' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], ], [ - 'name' => 'ProductId', + 'name' => 'NormalizationSecurityDomainId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => '', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response struct.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationRule' => [ + 'description' => 'The normalization rule.', + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], + 'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationRuleType' => ['description' => 'The type of the normalization rule. Valid values:'."\n" + .'- predefined: predefined normalization rule.'."\n" + .'- custom: custom normalization rule.', 'type' => 'string', 'example' => 'predefined', 'title' => ''], + 'NormalizationRuleFormat' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'example' => 'SPL', 'title' => ''], + 'NormalizationRuleDescription' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationRuleVersion' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'example' => 'V1', 'title' => ''], + 'NormalizationRuleExpression' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''], + 'NormalizationRuleStatus' => ['description' => 'The status of the normalization rule.', 'type' => 'string', 'example' => 'started', 'title' => ''], + 'NormalizationCategoryId' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''], + 'NormalizationSecurityDomainId' => ['type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => '', 'title' => ''], + 'VendorId' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''], + 'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'NormalizationRuleMode' => ['description' => 'The mode of the normalization rule. Valid values:'."\n" + .'- both'."\n" + .'- scan'."\n" + .'- realtime.', 'type' => 'string', 'example' => 'both', 'title' => ''], + 'NormalizationFieldSource' => ['type' => 'string', 'example' => 'normalized', 'description' => '', 'title' => ''], + 'ExtendContentPacked' => ['description' => 'Specifies whether to pack non-standard fields into the extend_content field. Valid values:'."\n" + .'- enabled: Enabled.'."\n" + .'- disabled: Disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'OrderField' => ['description' => 'The field used to sort the rule list. Valid values:'."\n" + .'- GmtModified: sorted by modification time.'."\n" + .'- Id: sorted by rule ID (default).', 'type' => 'string', 'example' => 'GmtModified', 'title' => ''], + 'NormalizationRuleIds' => [ + 'description' => 'The list of normalization rule IDs.', + 'type' => 'array', + 'items' => ['description' => 'The list of normalization rule IDs.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'ExtendFieldStoreMode' => ['title' => '', 'description' => 'The storage mode for extended fields. Valid values:'."\n" + .'- flat: ingested as-is.'."\n" + .'- reject: not ingested.'."\n" + .'- pack: packed into the extend_content field.', 'type' => 'string', 'example' => 'flat'], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve normalization rule information', + 'summary' => 'Retrieves normalization rule information.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration string. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetNormalizationRule', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRule\\": {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationRuleMode\\": \\"both\\",\\n \\"NormalizationFieldSource\\": \\"normalized\\",\\n \\"ExtendContentPacked\\": \\"enabled\\",\\n \\"OrderField\\": \\"GmtModified\\",\\n \\"NormalizationRuleIds\\": [\\n \\"nr-z0b2ssjteut85uoh9nzp\\"\\n ],\\n \\"ExtendFieldStoreMode\\": \\"flat\\"\\n }\\n}","type":"json"}]', ], - 'DisableDataIngestion' => [ - 'summary' => '停止数据接入', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetNormalizationRuleVersion' => [ + 'summary' => 'Retrieves information about a normalization rule version.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management center for Threat Analysis is located. Select a region for the management center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'], ], [ - 'name' => 'DataIngestionId', + 'name' => 'NormalizationRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。', - ], + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'], + ], + [ + 'name' => 'NormalizationRuleVersion', + 'in' => 'formData', + 'schema' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'title' => '', 'example' => '1'], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'NormalizationRuleVersion' => [ + 'description' => 'The version of the normalization rule.', + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The time when the rule version was created.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '1733269771123'], + 'UpdateTime' => ['description' => 'The time when the rule version was last updated.', 'type' => 'integer', 'format' => 'int64', 'title' => '', 'example' => '1733269771123'], + 'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'nr-z0b2ssjteut85uoh9nzp'], + 'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'normalization_rule_Z57np'], + 'NormalizationRuleType' => ['description' => 'The type of the normalization rule. Valid values:'."\n" + ."\n" + .'- predefined: a predefined rule.'."\n" + ."\n" + .'- custom: a custom rule.', 'type' => 'string', 'title' => '', 'example' => 'predefined'], + 'NormalizationRuleFormat' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'SPL'], + 'NormalizationRuleDescription' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'normalization_rule_Z57np'], + 'NormalizationRuleVersion' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => 'V1'], + 'NormalizationRuleExpression' => ['description' => 'The expression for the normalization rule.', 'type' => 'string', 'title' => '', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content'], + 'NormalizationRuleStatus' => ['description' => 'The status of the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'started'], + 'NormalizationCategoryId' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'title' => '', 'example' => 'NETWORK_CATEGORY'], + 'NormalizationSchemaId' => ['description' => 'The ID of the normalization schema.', 'type' => 'string', 'title' => '', 'example' => 'HTTP_ACTIVITY'], + 'VendorId' => ['description' => 'The ID of the vendor for the normalization rule.', 'type' => 'string', 'title' => '', 'example' => 'alibaba_cloud'], + 'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'title' => '', 'example' => 'alibaba_cloud_sas'], + 'NormalizationRuleVersionName' => ['type' => 'string', 'description' => 'The name of the normalization rule version.', 'title' => '', 'example' => 'v1'], + 'RegionId' => ['type' => 'string', 'description' => 'The region where the Data Management center for Threat Analysis is located. Select a region for the management center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'title' => '', 'example' => 'cn-hangzhou'], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleVersion\\": {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationRuleVersionName\\": \\"v1\\",\\n \\"RegionId\\": \\"cn-hangzhou\\"\\n }\\n}","type":"json"}]', + 'title' => 'GetNormalizationRuleVersion', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class provides examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetNormalizationRuleVersion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRuleVersion', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationruleversion/{#NormalizationRuleId}/{#NormalizationRuleVersion}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'UpdateDataIngestion' => [ - 'summary' => '更新数据接入信息', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetNormalizationSchema' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center resides. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'DataIngestionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。', - ], - ], - [ - 'name' => 'DataIngestionMode', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'realtime。', - ], + 'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DataSourceId', + 'name' => 'NormalizationSchemaType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_log_173326*******。', - ], + 'schema' => ['description' => 'The normalization schema type. Valid values:'."\n" + .'- log: log.'."\n" + .'- entity: entity.', 'type' => 'string', 'required' => false, 'example' => 'log', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_rule。', - ], + 'schema' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationSchema' => [ + 'description' => 'The normalization schema.', + 'type' => 'object', + 'properties' => [ + 'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''], + 'NormalizationSchemaName' => ['description' => 'The normalization schema name.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationCategoryId' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'NormalizationFields' => [ + 'description' => 'The list of normalization fields.', + 'type' => 'array', + 'items' => [ + 'description' => 'The normalization field.', + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['title' => '', 'description' => 'The normalization field name.', 'type' => 'string', 'example' => 'cloud_user'], + 'NormalizationFieldType' => ['title' => '', 'description' => 'The normalization field type. Valid values:'."\n" + .'- varchar'."\n" + .'- bigint'."\n" + .'- double', 'type' => 'string', 'example' => 'varchar'], + 'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the field is required.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldDescription' => ['title' => '', 'description' => 'The normalization field description.', 'type' => 'string', 'example' => 'cloud_user'], + 'NormalizationFieldExample' => ['title' => '', 'description' => 'The normalization field example.', 'type' => 'string', 'example' => '173326*******'], + 'NormalizationFieldReserved' => ['title' => '', 'description' => 'Indicates whether the normalization field is reserved.', 'type' => 'boolean', 'example' => 'true'], + 'NormalizationFieldFrom' => ['title' => '', 'description' => 'The source of the standard field. Valid values:'."\n" + .'- preset: built-in.'."\n" + .'- custom: custom.', 'type' => 'string', 'example' => 'preset'], + 'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the standard field is tokenized.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldJsonIndexAll' => ['title' => '', 'description' => 'Indicates whether indexes are created for all keys of the JSON-type standard field.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldJsonKeys' => [ + 'title' => '', + 'description' => 'The key list of the JSON-type standard field.', + 'type' => 'array', + 'items' => [ + 'title' => '', + 'description' => 'The key of the JSON-type standard field.', + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['title' => '', 'description' => 'The key name of the JSON-type standard field.', 'type' => 'string', 'example' => 'cloud_code'], + 'NormalizationFieldType' => ['title' => '', 'description' => 'The key type of the JSON-type standard field.', 'type' => 'string', 'example' => 'varchar'], + 'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the key of the JSON-type standard field is required.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldDescription' => ['title' => '', 'description' => 'The key description of the JSON-type standard field.', 'type' => 'string', 'example' => 'Cloud Provider Code'], + 'NormalizationFieldExample' => ['title' => '', 'description' => 'The key example of the JSON-type standard field.', 'type' => 'string', 'example' => 'alibaba_cloud'], + 'NormalizationFieldFrom' => ['title' => '', 'description' => 'The key source of the JSON-type standard field.', 'type' => 'string', 'example' => 'preset'], + 'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the key of the JSON-type standard field is tokenized.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldReserved' => ['title' => '', 'description' => 'Indicates whether the field is a system built-in standard field name.', 'type' => 'boolean', 'example' => ''], + 'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + ], + 'example' => '', + ], + 'example' => '', + ], + 'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'NormalizationFieldRequirement' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'TargetLogStore' => ['title' => '', 'description' => 'The Simple Log Service LogStore.', 'type' => 'string', 'example' => 'network-activity'], + 'TargetStoreView' => ['title' => '', 'description' => 'The Simple Log Service StoreView.', 'type' => 'string', 'example' => 'network_activity'], + 'NormalizationSchemaType' => ['title' => '', 'description' => 'The normalization schema type. Valid values:'."\n" + .'- log'."\n" + .'- entity'."\n" + .'- incident', 'type' => 'string', 'example' => 'log'], + 'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123'], + 'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123'], + 'NormalizationSchemaReferences' => [ + 'title' => '', + 'description' => 'The list of normalization schema references.', + 'type' => 'array', + 'items' => [ + 'title' => '', + 'description' => 'The normalization schema reference.', + 'type' => 'object', + 'properties' => [ + 'NormalizationRuleId' => ['title' => '', 'description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'alibaba_cloud_cfw_flow_rule'], + ], + 'example' => '', + ], + 'example' => '', + ], + 'NormalizationSchemaFrom' => ['title' => '', 'description' => 'The source of the normalization schema. Valid values:'."\n" + .'- preset: predefined.'."\n" + .'- custom: custom.', 'type' => 'string', 'example' => 'preset'], + 'VendorId' => ['type' => 'string', 'example' => 'alibaba_cloud', 'description' => '', 'title' => ''], + 'ProductId' => ['type' => 'string', 'example' => 'alibaba_cloud_bastionhost', 'description' => '', 'title' => ''], + 'NormalizationSecurityDomainId' => ['type' => 'string', 'example' => 'DATA_SECURITY', 'description' => '', 'title' => ''], + 'NormalizationSchemaDescription' => ['title' => '', 'description' => 'The normalization schema description.', 'type' => 'string', 'example' => 'Network 5-Tuple Logs'], + 'NormalizationFieldSource' => ['type' => 'string', 'example' => 'native', 'description' => '', 'title' => ''], + 'RecommendEntities' => [ + 'type' => 'array', + 'items' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'description' => '', + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve normalization schema', + 'summary' => 'Retrieves a normalization schema.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration string. A supporting tool class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetNormalizationSchema', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/{#NormalizationSchemaId}'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationSchema\\": {\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationFields\\": [\\n {\\n \\"NormalizationFieldName\\": \\"cloud_user\\",\\n \\"NormalizationFieldType\\": \\"varchar\\",\\n \\"NormalizationFieldRequired\\": false,\\n \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n \\"NormalizationFieldExample\\": \\"173326*******\\",\\n \\"NormalizationFieldReserved\\": true,\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": false,\\n \\"NormalizationFieldJsonIndexAll\\": false,\\n \\"NormalizationFieldJsonKeys\\": [\\n {\\n \\"NormalizationFieldName\\": \\"cloud_code\\",\\n \\"NormalizationFieldType\\": \\"varchar\\",\\n \\"NormalizationFieldRequired\\": false,\\n \\"NormalizationFieldDescription\\": \\"Cloud Provider Code\\",\\n \\"NormalizationFieldExample\\": \\"alibaba_cloud\\",\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": false,\\n \\"NormalizationFieldReserved\\": false,\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000\\n }\\n ],\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000,\\n \\"NormalizationFieldRequirement\\": true\\n }\\n ],\\n \\"TargetLogStore\\": \\"network-activity\\",\\n \\"TargetStoreView\\": \\"network_activity\\",\\n \\"NormalizationSchemaType\\": \\"log\\",\\n \\"UpdateTime\\": 1733269771123,\\n \\"CreateTime\\": 1733269771123,\\n \\"NormalizationSchemaReferences\\": [\\n {\\n \\"NormalizationRuleId\\": \\"alibaba_cloud_cfw_flow_rule\\"\\n }\\n ],\\n \\"NormalizationSchemaFrom\\": \\"preset\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_bastionhost\\",\\n \\"NormalizationSecurityDomainId\\": \\"DATA_SECURITY\\",\\n \\"NormalizationSchemaDescription\\": \\"Network 5-Tuple Logs\\",\\n \\"NormalizationFieldSource\\": \\"native\\",\\n \\"RecommendEntities\\": [\\n \\"\\"\\n ]\\n }\\n}","type":"json"}]', ], - 'DeleteDataIngestion' => [ - 'summary' => '删除数据接入', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetResponseRuleStatistic' => [ + 'summary' => 'Retrieves the count of automated response rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: the Chinese mainland and Hong Kong (China)'."\n" + .'- ap-southeast-1: regions outside China', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The Alibaba Cloud account ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'DataIngestionId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。', - ], + 'schema' => ['description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: the current Alibaba Cloud account view.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'ResponseStatistic' => [ + 'description' => 'The statistics of automated response rules.', + 'type' => 'object', + 'properties' => [ + 'ResponseRuleOnlineCount' => ['description' => 'The number of online automated response rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'ResponseRuleAllCount' => ['description' => 'The total number of automated response rules.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve automated response rule count', + 'description' => 'Notifications are subject to frequency and time restrictions.'."\n" + .'Each user receives a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time range.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ResponseStatistic\\": {\\n \\"ResponseRuleOnlineCount\\": 1,\\n \\"ResponseRuleAllCount\\": 2\\n }\\n}","type":"json"}]', ], - 'GetDataBatchIngestion' => [ - 'summary' => '获取数据批量接入', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'GetUserConfig' => [ + 'summary' => 'Retrieves user information.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -5382,180 +4941,96 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region for the Management Hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。'."\n", - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the specified member.', 'type' => 'string', 'required' => false, 'example' => '173326*******', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'DataBatchIngestion' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'User' => [ + 'description' => 'The user.', 'type' => 'object', 'properties' => [ - 'DataBatchIngestionStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'pending。', - ], - 'DataBatchIngestionSetTime' => [ - 'description' => '', - 'type' => 'string', - 'example' => '1733269771123。', - ], - 'DataBatchIngestionEffectTime' => [ - 'description' => '', - 'type' => 'string', - 'example' => ' '."\n" - .'1733269771123。', - ], - 'LogUserIds' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => '173326*******。', - ], - ], - 'AutoScanNew' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled。', - ], - 'DataIngestions' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'DataIngestionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_process_ingestion_173326*******。', - ], - 'DataIngestionStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled。', - ], - 'DataSourceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_process_log_173326*******。', - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas。', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud。', - ], - ], - ], - ], - 'RecommendDataIngestionIds' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_process_log_173326*******。', - ], - ], - 'ApsaraDataIngestionIds' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_process_log_173326*******。'."\n", - ], - ], - 'DataSourceRecognizeEnabled' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'DataBatchIngestionMode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'full。', - ], + 'CtdrVersion' => ['description' => 'The current CTDR version.', 'type' => 'string', 'example' => 'v2', 'title' => ''], + 'DataStorageVersion' => ['description' => 'The upgrade status. Valid values:'."\n" + ."\n" + .'- pending: The upgrade is pending.'."\n" + ."\n" + .'- upgrading: The upgrade is in progress.'."\n" + ."\n" + .'- success: The upgrade is successful.'."\n" + ."\n" + .'- failed: The upgrade failed.', 'type' => 'string', 'example' => 'pending', 'title' => ''], + 'UpgradeStatus' => ['description' => 'The target CTDR version for the upgrade.', 'type' => 'string', 'example' => 'v2', 'title' => ''], + 'UpgradeCtdrVersion' => ['description' => 'The version of Log Management.', 'type' => 'string', 'example' => 'v2', 'title' => ''], ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"User\\": {\\n \\"CtdrVersion\\": \\"v2\\",\\n \\"DataStorageVersion\\": \\"pending\\",\\n \\"UpgradeStatus\\": \\"v2\\",\\n \\"UpgradeCtdrVersion\\": \\"v2\\"\\n }\\n}","type":"json"}]', + 'title' => 'GetUserConfig', + 'description' => 'The JsonConfig request parameter is a complex JSON object. A supporting tool class is provided to help you create the configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:GetUserConfig', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataBatchIngestion\\": {\\n \\"DataBatchIngestionStatus\\": \\"pending\\",\\n \\"DataBatchIngestionSetTime\\": \\"1733269771123\\",\\n \\"DataBatchIngestionEffectTime\\": \\"1733269771123\\",\\n \\"LogUserIds\\": [\\n \\"173326*******\\"\\n ],\\n \\"AutoScanNew\\": \\"enabled\\",\\n \\"DataIngestions\\": [\\n {\\n \\"DataIngestionId\\": \\"alibaba_cloud_sas_process_ingestion_173326*******\\",\\n \\"DataIngestionStatus\\": \\"enabled\\",\\n \\"DataSourceId\\": \\"alibaba_cloud_sas_process_log_173326*******\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"VendorId\\": \\"alibaba_cloud\\"\\n }\\n ],\\n \\"RecommendDataIngestionIds\\": [\\n \\"alibaba_cloud_sas_process_log_173326*******\\"\\n ],\\n \\"ApsaraDataIngestionIds\\": [\\n \\"alibaba_cloud_sas_process_log_173326*******\\"\\n ],\\n \\"DataSourceRecognizeEnabled\\": true,\\n \\"DataBatchIngestionMode\\": \\"full\\"\\n }\\n}","type":"json"}]', ], - 'UpdateDataBatchIngestion' => [ - 'summary' => '更新数据批量接入', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListAlerts' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -5564,517 +5039,513 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are located in the Chinese mainland or Hong Kong (China).'."\n" + .'- ap-southeast-1: Your assets are located outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-shanghai', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'AlertLevel', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- 5: critical.'."\n" + .'- 4: high-risk.'."\n" + .'- 3: medium-risk.'."\n" + .'- 2: low-risk.'."\n" + .'- 1: informational.', + 'type' => 'array', + 'items' => ['description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- 5: critical.'."\n" + .'- 4: high-risk.'."\n" + .'- 3: medium-risk.'."\n" + .'- 2: low-risk.'."\n" + .'- 1: informational.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], 'required' => false, - 'example' => '173326*******。', + 'maxItems' => 100, + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'LogUserIds', + 'name' => 'AlertUuid', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - 'required' => false, - ], + 'schema' => ['description' => 'The alert ID associated with the event.', 'type' => 'string', 'required' => false, 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''], ], [ - 'name' => 'AutoScanNew', + 'name' => 'QueryViewId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled。', - ], + 'schema' => ['description' => 'The unique identifier of the query view.', 'type' => 'string', 'required' => false, 'example' => 'qv-a1b2c3d4e5f6g7****', 'title' => ''], ], [ - 'name' => 'DataIngestionIds', + 'name' => 'QueryCondition', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。', - ], - 'required' => false, - ], + 'schema' => ['description' => 'The query filter condition in JSON format. Valid values:'."\n" + ."\n" + .'- `{"Type":"maxCost", "Value":"100"}`: the top 100 queries with the longest execution duration.'."\n" + .'- `{"Type":"status","Value":"finished"}`: completed queries.'."\n" + .'- `{"Type":"status","Value":"running"}`: running queries.'."\n" + .'- `{"Type":"cost","Min":"30","Max":"50"}`: queries with a custom execution duration range. You can specify the minimum and maximum execution duration. **Min** specifies the minimum execution duration. **Max** specifies the maximum execution duration. Unit: milliseconds (ms).'."\n" + .' - If only **Min** is specified, queries with an execution duration greater than this value are returned.'."\n" + .' - If only **Max** is specified, queries with an execution duration less than this value are returned.'."\n" + .' - If both **Min** and **Max** are specified, queries with an execution duration greater than or equal to **Min** and less than or equal to **Max** are returned.', 'type' => 'string', 'required' => false, 'example' => '{\\"Type\\":\\"cost\\",\\"Max\\":\\"200\\"}', 'title' => ''], ], [ - 'name' => 'DataSourceRecognizeEnabled', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true。', - ], + 'schema' => ['description' => 'The time when the alert first occurred.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '2025-09-30T02:23:00Z', 'title' => ''], ], [ - 'name' => 'DataBatchIngestionMode', + 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'full。', - ], + 'schema' => ['description' => 'The end time of the alert.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1766801904000', 'title' => ''], + ], + [ + 'name' => 'OrderFieldName', + 'in' => 'formData', + 'schema' => ['description' => 'The field used for sorting. Valid values:'."\n" + ."\n" + .'- GmtCreate: creation time.'."\n" + .'- GmtModified: update time.', 'type' => 'string', 'required' => false, 'example' => 'GmtModified', 'title' => ''], + ], + [ + 'name' => 'OrderDirection', + 'in' => 'formData', + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- **asc** (default): ascending order.'."\n" + .'- **desc**: descending order.', 'type' => 'string', 'required' => false, 'example' => 'asc', 'title' => ''], + ], + [ + 'name' => 'PageNumber', + 'in' => 'formData', + 'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the member accounts in the resource folder.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination token. You do not need to specify this parameter for the first request or if no more results exist. If more results exist, set this parameter to the NextToken value returned in the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'Alerts' => [ + 'description' => 'The alert details.', + 'type' => 'array', + 'items' => [ + 'description' => 'The alert details.', + 'type' => 'object', + 'properties' => [ + 'AlertUuid' => ['description' => 'The alert UUID.', 'type' => 'string', 'example' => '798341271677187', 'title' => ''], + 'AlertRecord' => ['description' => 'The alert details.', 'type' => 'string', 'example' => '{"alert_uuid":"a3f8c2e1-9b7d-4f6a-8c2e-1d5b9a7f****"}', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token for the next query.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve alert list', + 'summary' => 'Retrieves a list of alerts.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. We provide a utility class with configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Alerts\\": [\\n {\\n \\"AlertUuid\\": \\"798341271677187\\",\\n \\"AlertRecord\\": \\"{\\\\\\"alert_uuid\\\\\\":\\\\\\"a3f8c2e1-9b7d-4f6a-8c2e-1d5b9a7f****\\\\\\"}\\"\\n }\\n ],\\n \\"PageSize\\": 10,\\n \\"PageNumber\\": 1,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'ListDataIngestions' => [ - 'summary' => '获取数据接入任务列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListAutoDisposeEntities' => [ + 'path' => '', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'Lang', + 'name' => 'CurrentPage', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The page number. The value must be 1 or greater.', 'type' => 'string', 'required' => true, 'example' => '1', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The number of entries to return on each page.', 'type' => 'string', 'required' => true, 'example' => '10', 'title' => ''], ], [ - 'name' => 'DataIngestionIds', + 'name' => 'DataSourceType', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。', - ], - 'required' => false, - ], + 'schema' => ['description' => 'The type of the data source.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ - 'name' => 'DataIngestionStatus', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled。', - ], + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. You can obtain this token from the response to a previous call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], [ - 'name' => 'ProductId', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], ], [ - 'name' => 'DataIngestionTemplateIds', + 'name' => 'AutoDisposeRecordIds', 'in' => 'formData', 'style' => 'simple', 'schema' => [ - 'description' => '', 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_netstat_ingestion。', - ], + 'items' => ['description' => 'The ID of the automated disposal record.', 'type' => 'string', 'required' => false, 'example' => '01f2c3ed23e1e157eb5368fc49db*****', 'title' => ''], + 'description' => 'The IDs of automated disposal records.', 'required' => false, + 'title' => '', + 'example' => '', ], ], + [ + 'name' => 'Uuid', + 'in' => 'formData', + 'schema' => ['description' => 'The unique identifier of the playbook.', 'type' => 'string', 'required' => false, 'example' => 'b2491e39-ddf2-478a-8c07-*****', 'title' => ''], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'DataIngestions' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'AutoDecisionEntities' => [ 'type' => 'array', 'items' => [ - 'description' => '', 'type' => 'object', 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'DataIngestionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******。', - ], - 'DataIngestionType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'preset。', - ], - 'DataIngestionMode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'realtime。', - ], - 'DataIngestionStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled。', - ], - 'DataIngestionState' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ingested。', - ], - 'DataSourceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ds-scpfegri73oyoknbc90c。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-0aywiqdtaqdvwac7xkbjsf3a。', - ], - 'StreamJobId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '73a78aa245e3b1299d6ceed093de7bd8。', - ], - 'CapacityCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3。', - ], - 'DataSourceEditable' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'NormalizationRuleEditable' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'DataIngestionModeEditable' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'DataIngestionTemplateId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_netstat_ingestion。', - ], - 'RealtimeDataSourceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ds-scpfegri73oyoknbc90c。', - ], - 'ScanDataSourceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ds-scpfegri73oyoknbc90c。', - ], - 'DataIngestionStateCode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'UserUnauthorized。', - ], - 'ActiveTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], + 'EntityType' => ['description' => 'The entity type. Valid values:'."\n" + ."\n" + .'- `ip`: An IP address.'."\n" + ."\n" + .'- `domain`: A domain.'."\n" + ."\n" + .'- `process`: A process.'."\n" + ."\n" + .'- `file`: A file.'."\n" + ."\n" + .'- `host`: A host.', 'type' => 'string', 'example' => 'process', 'title' => ''], + 'EntityName' => ['description' => 'The entity name.', 'type' => 'string', 'example' => '/apps/ext/ka****', 'title' => ''], + 'EntityUuid' => ['description' => 'The entity UUID.', 'type' => 'string', 'example' => '022ed6c601514a370cc9e3acd37a****', 'title' => ''], + 'DisposalMethod' => ['description' => 'The disposal method. Valid values:'."\n" + ."\n" + .'- `ignore`: Ignore.'."\n" + ."\n" + .'- `dispose`: Playbook-based disposal.', 'type' => 'string', 'example' => 'dispose', 'title' => ''], + 'PlaybookUuid' => ['description' => 'The playbook UUID.', 'type' => 'string', 'example' => '6fd2b143-e420-4c1b-a118-e764*****', 'title' => ''], + 'DisposeRecordId' => ['description' => 'The disposal ID.', 'type' => 'string', 'example' => '1ec121479b341a61886dbd2c4ccd*****', 'title' => ''], + 'Uuid' => ['description' => 'The unique identifier (UUID) of the entry.', 'type' => 'string', 'example' => '0d23f133-22d7-4388-b738-ab******', 'title' => ''], + 'AlertId' => ['description' => 'The alert rule ID.', 'type' => 'string', 'example' => '20403189', 'title' => ''], ], + 'description' => '', + 'title' => '', + 'example' => '', ], - ], + 'description' => 'A list of AI-powered automated analysis entities.', + 'title' => '', + 'example' => '', + ], + 'CurrentPage' => ['description' => 'The current page number. The value must be greater than or equal to 1.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total count of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries returned in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token used to retrieve the next page of results. An empty value indicates that all results have been returned.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'title' => '', + 'description' => 'The response body.', + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], - ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListAutoDisposeEntities', + 'summary' => 'Get AI-analyzed entity list', + 'description' => 'Each user can receive up to two notifications daily, but only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataIngestions\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"DataIngestionId\\": \\"alibaba_cloud_sas_netstat_ingestion_173326*******\\",\\n \\"DataIngestionType\\": \\"preset\\",\\n \\"DataIngestionMode\\": \\"realtime\\",\\n \\"DataIngestionStatus\\": \\"enabled\\",\\n \\"DataIngestionState\\": \\"ingested\\",\\n \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"NormalizationRuleId\\": \\"nr-0aywiqdtaqdvwac7xkbjsf3a\\",\\n \\"StreamJobId\\": \\"73a78aa245e3b1299d6ceed093de7bd8\\",\\n \\"CapacityCount\\": 3,\\n \\"DataSourceEditable\\": true,\\n \\"NormalizationRuleEditable\\": true,\\n \\"DataIngestionModeEditable\\": true,\\n \\"DataIngestionTemplateId\\": \\"alibaba_cloud_sas_netstat_ingestion\\",\\n \\"RealtimeDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"ScanDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"DataIngestionStateCode\\": \\"UserUnauthorized\\",\\n \\"ActiveTime\\": 1733269771123\\n }\\n ]\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"AutoDecisionEntities\\": [\\n {\\n \\"EntityType\\": \\"process\\",\\n \\"EntityName\\": \\"/apps/ext/ka****\\",\\n \\"EntityUuid\\": \\"022ed6c601514a370cc9e3acd37a****\\",\\n \\"DisposalMethod\\": \\"dispose\\",\\n \\"PlaybookUuid\\": \\"6fd2b143-e420-4c1b-a118-e764*****\\",\\n \\"DisposeRecordId\\": \\"1ec121479b341a61886dbd2c4ccd*****\\",\\n \\"Uuid\\": \\"0d23f133-22d7-4388-b738-ab******\\",\\n \\"AlertId\\": \\"20403189\\"\\n }\\n ],\\n \\"CurrentPage\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'UpdateDataIngestionTemplate' => [ - 'summary' => '更新接入模板', + 'ListDataConnectors' => [ + 'summary' => 'Queries collectors by paging.', 'path' => '', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ - 'name' => 'DataIngestionTemplateId', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。'."\n", - ], + 'schema' => ['description' => 'The region where the threat analysis data management center resides. Specify the management center region based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: The assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: The assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'DataIngestionTemplateName', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******。'."\n", - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_actiontrail_event_rule。', - ], + 'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'Lang', + 'name' => 'DataConnectorIds', 'in' => 'formData', + 'style' => 'json', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of collector IDs.', + 'type' => 'array', + 'items' => ['description' => 'The collector ID.', 'type' => 'string', 'required' => false, 'example' => 'dc-1a2b3c4d5e6f7a8d1****', 'title' => ''], 'required' => false, - 'example' => 'zh。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'RegionId', + 'name' => 'DataConnectorName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The collector name.', 'type' => 'string', 'required' => false, 'example' => 'SAS-CTDR-2026070210****', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'SlsIngestionJobName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The name of the Simple Log Service (SLS) data import job for the collector.', 'type' => 'string', 'required' => false, 'example' => 'ingest-oss-dc-1a2b3c4d5e6f7a8****', 'title' => ''], ], [ - 'name' => 'DataIngestionStatus', + 'name' => 'SrcDataType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled。', - ], + 'schema' => ['description' => 'The source data type.', 'type' => 'string', 'required' => false, 'example' => 's3', 'title' => ''], + ], + [ + 'name' => 'DataConnectorType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The collector type. Valid values:'."\n" + .'- oss'."\n" + .'- s3'."\n" + .'- kafka', 'type' => 'string', 'required' => false, 'example' => 's3'], + ], + [ + 'name' => 'DestDataSourceId', + 'in' => 'formData', + 'schema' => ['description' => 'The destination data source ID. This parameter is required only for synchronization.', 'type' => 'string', 'required' => false, 'example' => 'ds-5sfe68t122pxnti1cjpl', 'title' => ''], + ], + [ + 'name' => 'DataConnectorStatus', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The collector status. Valid values:'."\n" + .'- "enabled": enabled.'."\n" + .'- "disabled" (default): disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled'], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The number of records per page. Default value: 1000.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], + ], + [ + 'name' => 'PageNumber', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The current page number. Default value: 1.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1'], + ], + [ + 'name' => 'OrderField', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The sort field. Currently, only sorting by updateTime is supported. If OrderField is left empty, the default order returned by the database is used.', 'type' => 'string', 'required' => false, 'example' => 'Id'], + ], + [ + 'name' => 'OrderType', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The sort order. Valid values:'."\n" + .'- "asc": ascending order.'."\n" + .'- "desc" (default): descending order.', 'type' => 'string', 'required' => false, 'example' => 'desc'], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of results to return when you use the NextToken-based pagination method. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination token. You do not need to set this parameter for the first request or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'PageSize' => ['description' => 'The number of records per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'PageNumber' => ['description' => 'The current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of records returned in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token for the next query.', 'type' => 'string', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'title' => ''], + 'DataConnector' => [ + 'description' => 'The list of collectors.', + 'type' => 'array', + 'items' => [ + 'description' => 'The collector.', + 'type' => 'object', + 'properties' => [ + 'CreationTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2026-06-01T02:14:24Z', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2025-01-04 22:31:54', 'title' => ''], + 'DataConnectorId' => ['description' => 'The collector ID.', 'type' => 'string', 'example' => 'dc-07423146117d77db266f78bc41f4fd80', 'title' => ''], + 'DataConnectorName' => ['description' => 'The data connector name.', 'type' => 'string', 'example' => 'dc-***', 'title' => ''], + 'DataConnectorStatus' => ['description' => 'The connector status.', 'type' => 'string', 'example' => 'enable', 'title' => ''], + 'DataConnectorType' => ['description' => 'The connector type.', 'type' => 'string', 'example' => 'oss', 'title' => ''], + 'SrcDataType' => ['title' => '', 'description' => 'The source data type.', 'type' => 'string', 'example' => 's3'], + 'DestDataSourceId' => ['description' => 'The destination data source ID. This parameter is required only for synchronization.', 'type' => 'string', 'example' => 'ds-t3ywipile7gctobaunx0', 'title' => ''], + 'LogProjectName' => ['description' => 'The Simple Log Service project name.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-channel-1371069058301795-cn-shanghai', 'title' => ''], + 'LogStoreName' => ['description' => 'The Simple Log Service Logstore name.', 'type' => 'string', 'example' => 'ls-wecom-crontasklog-prod', 'title' => ''], + 'LogRegionId' => ['description' => 'The log storage region ID.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''], + 'AuthConfigId' => ['title' => '', 'description' => 'The configuration item ID of the collector access object in the multi-cloud configuration.', 'type' => 'string', 'example' => 'cn-smbc-prod-cloudtrail.s3.cn-north-1.amazonaws.com.cn_AKIAX4AUG6AYSJO7FAG4'], + 'AuthConfigVendor' => ['description' => 'The cloud vendor of the authentication configuration.', 'type' => 'string', 'example' => 'SALESFORCE', 'title' => ''], + 'AuthConfigProduct' => ['description' => 'The cloud product of the authentication configuration.', 'type' => 'string', 'example' => 'salesForceRestAPI', 'title' => ''], + 'DataConnectorConfig' => ['title' => '', 'description' => 'The collector configuration information.', 'type' => 'string', 'example' => '{\\"endpoint\\":\\"csrm-sentinel.s3.cn-north-1.amazonaws.com.cn_AKIARGUYUGSX6A6VUXQJ\\",\\"bucket\\":\\"csrm-sentinel\\",\\"prefix\\":\\"AliTest/\\",\\"format\\":{\\"type\\":\\"JSON\\"},\\"encoding\\":\\"UTF-8\\"}'], + 'SlsIngestionJobName' => ['title' => '', 'description' => 'The name of the SLS data import job associated with the collector.', 'type' => 'string', 'example' => '1a2b3c4d5e6f7a8b9c0d1e2f3a4b****'], + 'SlsIngestionJobState' => ['title' => '', 'description' => 'The status of the SLS data import job associated with the collector.', 'type' => 'string', 'example' => 'running'], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Query collectors by paging', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"PageSize\\": 10,\\n \\"PageNumber\\": 1,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****\\",\\n \\"DataConnector\\": [\\n {\\n \\"CreationTime\\": 0,\\n \\"UpdateTime\\": 0,\\n \\"DataConnectorId\\": \\"dc-07423146117d77db266f78bc41f4fd80\\",\\n \\"DataConnectorName\\": \\"dc-***\\",\\n \\"DataConnectorStatus\\": \\"enable\\",\\n \\"DataConnectorType\\": \\"oss\\",\\n \\"SrcDataType\\": \\"s3\\",\\n \\"DestDataSourceId\\": \\"ds-t3ywipile7gctobaunx0\\",\\n \\"LogProjectName\\": \\"aliyun-cloudsiem-channel-1371069058301795-cn-shanghai\\",\\n \\"LogStoreName\\": \\"ls-wecom-crontasklog-prod\\",\\n \\"LogRegionId\\": \\"cn-hangzhou\\",\\n \\"AuthConfigId\\": \\"cn-smbc-prod-cloudtrail.s3.cn-north-1.amazonaws.com.cn_AKIAX4AUG6AYSJO7FAG4\\",\\n \\"AuthConfigVendor\\": \\"SALESFORCE\\",\\n \\"AuthConfigProduct\\": \\"salesForceRestAPI\\",\\n \\"DataConnectorConfig\\": \\"{\\\\\\\\\\\\\\"endpoint\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"csrm-sentinel.s3.cn-north-1.amazonaws.com.cn_AKIARGUYUGSX6A6VUXQJ\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"bucket\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"csrm-sentinel\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"prefix\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"AliTest/\\\\\\\\\\\\\\",\\\\\\\\\\\\\\"format\\\\\\\\\\\\\\":{\\\\\\\\\\\\\\"type\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"JSON\\\\\\\\\\\\\\"},\\\\\\\\\\\\\\"encoding\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"UTF-8\\\\\\\\\\\\\\"}\\",\\n \\"SlsIngestionJobName\\": \\"1a2b3c4d5e6f7a8b9c0d1e2f3a4b****\\",\\n \\"SlsIngestionJobState\\": \\"running\\"\\n }\\n ]\\n}","type":"json"}]', ], 'ListDataIngestionTemplates' => [ - 'summary' => '查询接入模板', + 'summary' => 'Queries data ingestion templates.', 'path' => '', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -6086,200 +5557,148 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'DataSourceTemplateIds', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。', - ], + 'schema' => ['description' => 'A list of data source template IDs.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''], ], [ 'name' => 'DataIngestionTemplateStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'running。', - ], + 'schema' => ['description' => 'The status of the data ingestion template. Valid values:'."\n" + ."\n" + .'- pending'."\n" + ."\n" + .'- running'."\n" + ."\n" + .'- success'."\n" + ."\n" + .'- failed', 'type' => 'string', 'required' => false, 'example' => 'running', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member whose perspective you want to use. This parameter is available only for administrators.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management center of threat analysis is located. You must select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ 'name' => 'PageNumber', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1。', - ], + 'schema' => ['description' => 'The page number.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '10。', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'string', 'required' => false, 'example' => '10', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], 'DataIngestionTemplates' => [ - 'description' => '', + 'description' => 'The list of data ingestion templates.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The data ingestion template.', 'type' => 'object', 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'DataIngestionStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled。', - ], - 'DataIngestionTemplateId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_account_snapshot_log。', - ], - 'DataIngestionTemplateName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_account_snapshot_log。', - ], - 'DataSourceTemplateId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******。'."\n", - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_actiontrail_event_rule。', - ], - 'NormalizationRuleName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_ke1RN。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '173326*******。', - ], - 'CapacityCount' => [ - 'description' => '', - 'type' => 'string', - 'example' => '3。', - ], - 'DataIngestionMode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'realtime。', - ], - 'DataIngestionTemplateStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'running。', - ], - ], + 'CreateTime' => ['description' => 'The time when the template was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'DataIngestionStatus' => ['description' => 'The data ingestion status. Valid values:'."\n" + ."\n" + .'- enabled: enabled.'."\n" + ."\n" + .'- disabled: disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'DataIngestionTemplateId' => ['description' => 'The ID of the data ingestion template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log', 'title' => ''], + 'DataIngestionTemplateName' => ['description' => 'The name of the data ingestion template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log', 'title' => ''], + 'DataSourceTemplateId' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''], + 'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_rule', 'title' => ''], + 'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_ke1RN', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the template was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '173326*******', 'title' => ''], + 'CapacityCount' => ['description' => 'The number of associated security capabilities.', 'type' => 'string', 'example' => '3', 'title' => ''], + 'DataIngestionMode' => ['description' => 'The data ingestion mode. Valid values:'."\n" + ."\n" + .'- realtime'."\n" + ."\n" + .'- scan', 'type' => 'string', 'example' => 'realtime', 'title' => ''], + 'DataIngestionTemplateStatus' => ['description' => 'The status of the data ingestion template. Valid values:'."\n" + ."\n" + .'- pending'."\n" + ."\n" + .'- running'."\n" + ."\n" + .'- success'."\n" + ."\n" + .'- failed', 'type' => 'string', 'example' => 'running', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'string', - 'example' => '1。', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'string', - 'example' => '10。', - ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'string', 'example' => '10', 'title' => ''], ], + 'example' => '', ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataIngestionTemplates\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"DataIngestionStatus\\": \\"enabled\\",\\n \\"DataIngestionTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log\\",\\n \\"DataIngestionTemplateName\\": \\"alibaba_cloud_sas_account_snapshot_log\\",\\n \\"DataSourceTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\",\\n \\"NormalizationRuleId\\": \\"alibaba_cloud_actiontrail_event_rule\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_ke1RN\\",\\n \\"UpdateTime\\": 0,\\n \\"CapacityCount\\": \\"3\\",\\n \\"DataIngestionMode\\": \\"realtime\\",\\n \\"DataIngestionTemplateStatus\\": \\"running\\"\\n }\\n ],\\n \\"PageNumber\\": \\"1\\",\\n \\"PageSize\\": \\"10\\"\\n}","type":"json"}]', - ], - 'ListTrafficStatistics' => [ - 'summary' => '获取接入流量统计', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', + 'title' => 'ListDataIngestionTemplates', + 'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time frame.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataIngestionTemplates', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestionTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestiontemplate/*'], + ], + ], + ], ], + ], + 'ListDataIngestions' => [ + 'summary' => 'Retrieves a list of data access policies.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -6291,120 +5710,83 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the threat analysis feature is deployed. Select the region that corresponds to the location of your asset. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: Your asset is in the Chinese mainland.'."\n" + ."\n" + .'- `ap-southeast-1`: Your asset is in a region outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'TrafficStatisticPeriod', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '30。', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to query data as the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'TrafficStatisticPeriodType', + 'name' => 'DataIngestionIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'An array of data ingestion policy IDs.', + 'type' => 'array', + 'items' => ['description' => 'The data ingestion policy ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''], 'required' => false, - 'example' => 'day。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'TrafficStatisticType', + 'name' => 'DataIngestionStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'Region。', - ], + 'schema' => ['description' => 'The data ingestion status. Valid values:'."\n" + ."\n" + .'- `enabled`: Enabled.'."\n" + ."\n" + .'- `disabled`: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''], ], [ 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], - ], - [ - 'name' => 'TrafficType', - 'in' => 'formData', - 'schema' => [ - 'title' => '日志流量类型:'."\n" - .'- "commonLogTraffic"：通用日志流量 (默认)'."\n" - .'- "agentAnalysisLogTraffic"：AI智能分析日志流量', - 'type' => 'string', - 'example' => 'agentAnalysisLogTraffic', - 'default' => 'commonLogTraffic', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ - 'name' => 'RegionTag', + 'name' => 'DataIngestionTemplateIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', + 'description' => 'An array of data ingestion template IDs.', + 'type' => 'array', + 'items' => ['description' => 'The data ingestion template ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_netstat_ingestion', 'title' => ''], 'required' => false, - 'example' => '1。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'LogUserIds', + 'name' => 'NormalizationSchemaIds', 'in' => 'formData', 'style' => 'simple', 'schema' => [ - 'description' => '', 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'items' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_SESSION_ACTIVITY', 'title' => ''], + 'title' => '', + 'description' => 'An array of normalization schema IDs.', 'required' => false, + 'example' => '', ], ], ], @@ -6412,78 +5794,97 @@ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'TrafficStatistics' => [ - 'description' => '', + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'DataIngestions' => [ + 'description' => 'The list of data ingestions.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The data ingestion.', 'type' => 'object', 'properties' => [ - 'TrafficStatisticTarget' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'all。', - ], - 'TrafficStatisticData' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'TrafficStatisticTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '20250815。', - ], - 'TrafficStatisticValue' => [ - 'description' => '', - 'type' => 'number', - 'format' => 'double', - 'example' => '1.699814。', - ], - ], - ], - ], - ], + 'CreateTime' => ['description' => 'The time when the data ingestion was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the data ingestion was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'DataIngestionId' => ['description' => 'The ID of the data ingestion.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_netstat_ingestion_173326*******', 'title' => ''], + 'DataIngestionType' => ['description' => 'The type of the data ingestion. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'preset', 'title' => ''], + 'DataIngestionMode' => ['description' => 'The mode of the data ingestion. Valid values:'."\n" + ."\n" + .'- realtime'."\n" + ."\n" + .'- scan', 'type' => 'string', 'example' => 'realtime', 'title' => ''], + 'DataIngestionStatus' => ['description' => 'The status of the data ingestion. Valid values:'."\n" + ."\n" + .'- enabled: The data ingestion is enabled.'."\n" + ."\n" + .'- disabled: The data ingestion is disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'DataIngestionState' => ['description' => 'The state of the data ingestion. Valid values:'."\n" + ."\n" + .'- ingested'."\n" + ."\n" + .'- uningested'."\n" + ."\n" + .'- abnormal', 'type' => 'string', 'example' => 'ingested', 'title' => ''], + 'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''], + 'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'nr-0aywiqdtaqdvwac7xkbjsf3a', 'title' => ''], + 'StreamJobId' => ['description' => 'The job ID of the stream processing task.', 'type' => 'string', 'example' => '73a78aa245e3b1299d6ceed093de7bd8', 'title' => ''], + 'CapacityCount' => ['description' => 'The number of associated security capabilities.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''], + 'DataSourceEditable' => ['description' => 'Indicates whether the data source is editable.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'NormalizationRuleEditable' => ['description' => 'Indicates whether the normalization rule is editable.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'DataIngestionModeEditable' => ['description' => 'Indicates whether the data ingestion mode is editable.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'DataIngestionTemplateId' => ['description' => 'The ID of the data ingestion template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_netstat_ingestion', 'title' => ''], + 'RealtimeDataSourceId' => ['description' => 'The ID of the data source for real-time ingestion.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''], + 'ScanDataSourceId' => ['description' => 'The ID of the data source for scan-based ingestion.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''], + 'DataIngestionStateCode' => ['description' => 'The error code for the data ingestion anomaly.', 'type' => 'string', 'example' => 'UserUnauthorized', 'title' => ''], + 'ActiveTime' => ['description' => 'The time when the data ingestion was enabled.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataIngestions\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"DataIngestionId\\": \\"alibaba_cloud_sas_netstat_ingestion_173326*******\\",\\n \\"DataIngestionType\\": \\"preset\\",\\n \\"DataIngestionMode\\": \\"realtime\\",\\n \\"DataIngestionStatus\\": \\"enabled\\",\\n \\"DataIngestionState\\": \\"ingested\\",\\n \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"NormalizationRuleId\\": \\"nr-0aywiqdtaqdvwac7xkbjsf3a\\",\\n \\"StreamJobId\\": \\"73a78aa245e3b1299d6ceed093de7bd8\\",\\n \\"CapacityCount\\": 3,\\n \\"DataSourceEditable\\": true,\\n \\"NormalizationRuleEditable\\": true,\\n \\"DataIngestionModeEditable\\": true,\\n \\"DataIngestionTemplateId\\": \\"alibaba_cloud_sas_netstat_ingestion\\",\\n \\"RealtimeDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"ScanDataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"DataIngestionStateCode\\": \\"UserUnauthorized\\",\\n \\"ActiveTime\\": 1733269771123\\n }\\n ]\\n}","type":"json"}]', + 'title' => 'ListDataIngestions', + 'description' => 'Each user receives up to two notifications per day, sent only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataIngestions', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"TrafficStatistics\\": [\\n {\\n \\"TrafficStatisticTarget\\": \\"all\\",\\n \\"TrafficStatisticData\\": [\\n {\\n \\"TrafficStatisticTime\\": 20250815,\\n \\"TrafficStatisticValue\\": 1.699814\\n }\\n ]\\n }\\n ]\\n}","type":"json"}]', ], - 'ExecuteLogQuery' => [ - 'summary' => '查看LogStore', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListDataSetRecords' => [ + 'summary' => 'Retrieves a list of dataset records.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -6492,1199 +5893,1667 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the data management center for Threat Analysis. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: For assets in the Chinese mainland.'."\n" + ."\n" + .'- `ap-southeast-1`: For assets in regions outside mainland China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], - ], - [ - 'name' => 'RoleFor', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese'."\n" + ."\n" + .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'LogUserId', + 'name' => 'DataSetId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-nhcrmjpx1zsorlaq****', 'title' => ''], ], [ - 'name' => 'LogRegionId', + 'name' => 'PageNumber', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''], ], [ - 'name' => 'LogProjectName', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'slsaudit-center-173326*******-cn-hangzhou', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], ], [ - 'name' => 'LogStoreName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'huawei-cn-cfw', - ], + 'schema' => ['description' => 'The user ID that an administrator can use to view data as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'LogQuery', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '*', - ], + 'schema' => ['description' => 'The maximum number of results to return for each request when `NextToken` is used for pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], ], [ - 'name' => 'ExtendContentPacked', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'title' => '用于标识否将非标准字段打包到扩展字段extend_content,取值：'."\n" - .'- "enabled" ：启用打包'."\n" - .'- "disabled" ：不启用打包'."\n" - .'默认："disabled"', - 'description' => '', - 'type' => 'string', - 'required' => false, - ], + 'schema' => ['description' => 'The pagination token that is used in the next request to retrieve a new page of results.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaId', + 'name' => 'Filter', 'in' => 'formData', - 'schema' => [ - 'title' => '如果启用打包，则需要指定NormalizationSchemaId', - 'description' => '', - 'type' => 'string', - 'required' => false, - ], + 'schema' => ['description' => 'The filter conditions, specified as a JSON string. For example: {"field1":"value1","field2":"value2"}', 'type' => 'string', 'example' => '{"field1":"value1","field2":"value2"}', 'title' => '', 'required' => false], ], [ - 'name' => 'StartTime', + 'name' => 'Order', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1733269771123。', - ], + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- "desc" (default)'."\n" + ."\n" + .'- "asc"', 'type' => 'string', 'example' => 'desc', 'title' => '', 'required' => false], ], [ - 'name' => 'EndTime', + 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1733269771123。', - ], + 'schema' => ['description' => 'The sort field. Valid values:'."\n" + ."\n" + .'- "updatetime" (default)'."\n" + ."\n" + .'- "createtime"', 'type' => 'string', 'example' => 'updatetime', 'title' => '', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'QueryResult' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'DataSetRecords' => [ + 'description' => 'A list of dataset records.', 'type' => 'array', 'items' => [ - 'description' => '', - 'type' => 'any', - 'example' => '[]。', + 'description' => 'The dataset record.', + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1658974643000', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1658974643000', 'title' => ''], + 'DataSetId' => ['description' => 'The dataset ID.', 'type' => 'string', 'example' => 'dataset-t8ha6p7k61rmniqw****', 'title' => ''], + 'DataSetName' => ['description' => 'The dataset name.', 'type' => 'string', 'example' => 'lmftest', 'title' => ''], + 'DataSetRecordId' => ['description' => 'The dataset record ID.', 'type' => 'string', 'example' => '124566', 'title' => ''], + 'DataSetRecordValues' => ['description' => 'The dataset record value.', 'type' => 'string', 'example' => '{"ip":"10.0.*.*/8","region":"shanghai"}', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], - 'example' => '[]。', - ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries that match the query.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of results to return per page for token-based pagination. Valid values: 1 to 100. Default: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token to retrieve the next page of results.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"DataSetRecords\\": [\\n {\\n \\"CreateTime\\": 1658974643000,\\n \\"UpdateTime\\": 1658974643000,\\n \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n \\"DataSetName\\": \\"lmftest\\",\\n \\"DataSetRecordId\\": \\"124566\\",\\n \\"DataSetRecordValues\\": \\"{\\\\\\"ip\\\\\\":\\\\\\"10.0.*.*/8\\\\\\",\\\\\\"region\\\\\\":\\\\\\"shanghai\\\\\\"}\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'title' => 'ListDataSetRecords', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataSetRecords', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"QueryResult\\": [\\n \\"[]\\"\\n ]\\n}","type":"json"}]', ], - 'CreateNormalizationRule' => [ - 'summary' => '创建标准化规则', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListDataSets' => [ + 'summary' => 'Retrieves a list of datasets.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management Center for threat analysis is deployed. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'DataSetId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => false, 'example' => 'dataset-qt0n8246gs9nackg****', 'title' => ''], ], [ - 'name' => 'NormalizationRuleName', + 'name' => 'DataSetName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'normalization_rule_Z57np。', - ], + 'schema' => ['description' => 'The name of the dataset.', 'type' => 'string', 'required' => false, 'example' => 'lmftest', 'title' => ''], ], [ - 'name' => 'NormalizationRuleDescription', + 'name' => 'DataSetStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'normalization_rule_Z57np。', - ], + 'schema' => ['description' => 'The status of the dataset. Valid values:'."\n" + ."\n" + .'- 0: deleted.'."\n" + ."\n" + .'- 1: enabled.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0', 'title' => ''], ], [ - 'name' => 'NormalizationRuleFormat', + 'name' => 'OrderFieldName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'SPL。', - ], + 'schema' => ['description' => 'The field to use for sorting. Valid values:'."\n" + ."\n" + .'- GmtCreate: creation time.'."\n" + ."\n" + .'- GmtModified: update time.', 'type' => 'string', 'required' => false, 'example' => 'GmtCreate', 'title' => ''], ], [ - 'name' => 'NormalizationRuleExpression', + 'name' => 'OrderDirection', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- **asc** (default): ascending.'."\n" + ."\n" + .'- **desc**: descending.', 'type' => 'string', 'required' => false, 'example' => 'asc', 'title' => ''], ], [ - 'name' => 'NormalizationCategoryId', + 'name' => 'PageNumber', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY。', - ], + 'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaId', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'HTTP_ACTIVITY。', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], ], [ - 'name' => 'VendorId', + 'name' => 'DataSetIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of dataset IDs.', + 'type' => 'array', + 'items' => ['description' => 'The list of dataset IDs.', 'type' => 'string', 'required' => false, 'example' => '["dataset-1lz4nf2x08mklchy****"]', 'title' => ''], 'required' => false, - 'example' => 'alibaba_cloud。', + 'maxItems' => 50, + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'ProductId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The user ID that an administrator uses to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'NormalizationRuleMode', + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of results to return for the request. This parameter is used for queries that use NextToken. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + ], + [ + 'name' => 'DataSetType', 'in' => 'formData', + 'schema' => ['description' => 'The type of the dataset. Valid values:'."\n" + ."\n" + .'- custom: custom.'."\n" + ."\n" + .'- preset: predefined.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'both。', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '157CFBB5-B56F-566F-8991-B3C51799****', 'title' => ''], + 'DataSets' => [ + 'description' => 'The list of datasets.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The time when the dataset was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1713787368000', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the dataset was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1713787368000', 'title' => ''], + 'DataSetId' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'example' => 'dataset-t8ha6p7k61rmniqw****', 'title' => ''], + 'DataSetName' => ['description' => 'The name of the dataset.', 'type' => 'string', 'example' => 'lmftest', 'title' => ''], + 'DataSetDescription' => ['description' => 'The description of the dataset.', 'type' => 'string', 'example' => 'lmftest desc', 'title' => ''], + 'DataSetFieldNames' => ['description' => 'The names of the fields in the dataset.', 'type' => 'string', 'example' => '["ip","region"]', 'title' => ''], + 'DataSetFieldKeyName' => ['description' => 'The name of the unique key for the dataset.', 'type' => 'string', 'example' => 'ip', 'title' => ''], + 'DataSetFileName' => ['description' => 'The name of the uploaded dataset file.', 'type' => 'string', 'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv', 'title' => ''], + 'DataSetStatus' => ['description' => 'The status of the dataset. Valid values:'."\n" + ."\n" + .'- 0: deleted.'."\n" + ."\n" + .'- 1: enabled.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'DataSetReferences' => [ + 'description' => 'The dataset references.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'DataSetId' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'example' => 'dataset-nhcrmjpx1zsorlaq****', 'title' => ''], + 'DataSetReferenceType' => ['description' => 'The type of the service that is associated with the dataset. Valid values:'."\n" + ."\n" + .'- custom\\_rule: custom rule.'."\n" + ."\n" + .'- playbook: playbook.', 'type' => 'string', 'example' => 'playbook', 'title' => ''], + 'DataSetReferenceId' => ['description' => 'The ID of the rule or playbook that is associated with the dataset.', 'type' => 'string', 'example' => '456232', 'title' => ''], + 'DataSetReferenceName' => ['description' => 'The name of the rule or playbook that is associated with the dataset.', 'type' => 'string', 'example' => 'playbook_name', 'title' => ''], + ], + 'description' => 'The dataset reference.', + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'DataSetType' => ['description' => 'The type of the dataset. Valid values:'."\n" + ."\n" + .'- custom: custom.'."\n" + ."\n" + .'- preset: predefined.', 'type' => 'string', 'example' => 'preset', 'title' => ''], + 'IpWhitelistRecognizers' => [ + 'description' => 'The list of recognizers.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'IpWhitelistRecognizerType' => ['description' => 'The type of IP address that the recognizer detects. Valid values:'."\n" + ."\n" + .'- sas\\_vulnerability\\_scanner\\_ip: Security Center web vulnerability scanner IP address.'."\n" + ."\n" + .'- waf\\_back\\_source\\_ip: Web Application Firewall back-to-origin IP address.'."\n" + ."\n" + .'- ddos\\_back\\_source\\_ip: Anti-DDoS back-to-origin IP address.'."\n" + ."\n" + .'- esa\\_back\\_source\\_ip: Edge Security Acceleration (ESA) back-to-origin node IP address.'."\n" + ."\n" + .'- ecs\\_public\\_ip: Elastic Compute Service (ECS) public IP address.'."\n" + ."\n" + .'- slb\\_public\\_ip: Server Load Balancer (SLB) public IP address.'."\n" + ."\n" + .'- vpc\\_eip: Elastic IP Address (EIP).'."\n" + ."\n" + .'- cdn\\_back\\_source\\_ip: Alibaba Cloud CDN back-to-origin IP address.'."\n" + ."\n" + .'- ga\\_back\\_source\\_ip: Global Accelerator (GA) back-to-origin IP address.', 'type' => 'string', 'example' => 'waf_back_source_ip', 'title' => ''], + 'AutoRecognizeStatus' => ['description' => 'The status of automatic detection. Valid values:'."\n" + ."\n" + .'- enabled: enabled.'."\n" + ."\n" + .'- disabled: disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'RecognizeScope' => ['description' => 'The detection scope. Valid values:'."\n" + ."\n" + .'- current\\_account: current account only.'."\n" + ."\n" + .'- rd\\_accounts: multiple accounts.', 'type' => 'string', 'example' => 'current_account', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the dataset was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1713787368000', 'title' => ''], + ], + 'description' => 'The recognizer.', + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + ], + 'description' => 'The dataset.', + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of results to return for the request. This parameter is used for queries that use NextToken. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + ], + 'example' => '', + ], + ], + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"157CFBB5-B56F-566F-8991-B3C51799****\\",\\n \\"DataSets\\": [\\n {\\n \\"CreateTime\\": 1713787368000,\\n \\"UpdateTime\\": 1713787368000,\\n \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n \\"DataSetName\\": \\"lmftest\\",\\n \\"DataSetDescription\\": \\"lmftest desc\\",\\n \\"DataSetFieldNames\\": \\"[\\\\\\"ip\\\\\\",\\\\\\"region\\\\\\"]\\",\\n \\"DataSetFieldKeyName\\": \\"ip\\",\\n \\"DataSetFileName\\": \\"cloudsiem-dataset/1358117679873357_174338773****.csv\\",\\n \\"DataSetStatus\\": 1,\\n \\"DataSetReferences\\": [\\n {\\n \\"DataSetId\\": \\"dataset-nhcrmjpx1zsorlaq****\\",\\n \\"DataSetReferenceType\\": \\"playbook\\",\\n \\"DataSetReferenceId\\": \\"456232\\",\\n \\"DataSetReferenceName\\": \\"playbook_name\\"\\n }\\n ],\\n \\"DataSetType\\": \\"preset\\",\\n \\"IpWhitelistRecognizers\\": [\\n {\\n \\"IpWhitelistRecognizerType\\": \\"waf_back_source_ip\\",\\n \\"AutoRecognizeStatus\\": \\"enabled\\",\\n \\"RecognizeScope\\": \\"current_account\\",\\n \\"UpdateTime\\": 1713787368000\\n }\\n ]\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'title' => 'ListDataSets', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataSets', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/*'], + ], ], ], + ], + ], + 'ListDataSourceTemplates' => [ + 'summary' => 'Queries data source templates.', + 'path' => '', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], + 'security' => [ + [ + 'AK' => [], + ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'list', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ [ - 'name' => 'ExtendContentPacked', + 'name' => 'DataSourceTemplateIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'title' => '用于标识否将非标准字段打包到扩展字段extend_content,取值：'."\n" - .' - "enabled" ：启用打包'."\n" - .' - "disabled" ：不启用打包'."\n" - .' 默认："disabled"', - 'description' => '', - 'type' => 'string', + 'description' => 'The list of data source template IDs.', + 'type' => 'array', + 'items' => ['description' => 'The list of data source template IDs.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''], 'required' => false, + 'minItems' => 0, + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'NormalizationRuleType', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'OrderField', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'NormalizationRuleVersion', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationRuleIds', + 'name' => 'PageNumber', 'in' => 'formData', - 'style' => 'json', - 'schema' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'string', - ], - ], + 'schema' => ['description' => 'The page number.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'ExtendFieldStoreMode', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'title' => '扩展字段存储模式，可选项：flat、pack、reject。', - 'type' => 'string', - 'example' => 'flat', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'string', 'required' => false, 'example' => '10', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'DataSourceTemplates' => [ + 'description' => 'The list of data source templates.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data source template.', + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The time when the template was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'DataSourceTemplateId' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''], + 'DataSourceTemplateName' => ['description' => 'The name of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''], + 'LogProjectPattern' => ['description' => 'The rule for matching the name of the Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-173326*******', 'title' => ''], + 'LogRegionIds' => [ + 'description' => 'The list of log storage region IDs.', + 'type' => 'array', + 'items' => ['description' => 'The log storage region ID.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'LogStorePattern' => ['description' => 'The rule for matching the name of the Simple Log Service Logstore.', 'type' => 'string', 'example' => 'audit-activity', 'title' => ''], + 'LogUserIds' => [ + 'description' => 'The list of user IDs for batch data ingestion.', + 'type' => 'array', + 'items' => ['description' => 'The user ID for batch data ingestion.', 'type' => 'string', 'example' => '173326*******', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'UpdateTime' => ['description' => 'The time when the template was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'DataSourceFrom' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'custom', 'title' => ''], + 'AutoScanNew' => ['description' => 'Indicates whether to automatically discover new users. Valid values:'."\n" + ."\n" + .'- enabled: enabled.'."\n" + ."\n" + .'- disabled: disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'DataSourceRecognizer' => ['description' => 'The data source recognizer.', 'type' => 'string', 'example' => 'alibaba_cloud_actiontrail_event_ingestion', 'title' => ''], + 'DataSourceRecognizeEnabled' => ['description' => 'Indicates whether to automatically discover new data sources.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'string', 'example' => '10', 'title' => ''], ], + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataSourceTemplates\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"DataSourceTemplateId\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n \\"DataSourceTemplateName\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n \\"LogProjectPattern\\": \\"aliyun-cloudsiem-data-173326*******\\",\\n \\"LogRegionIds\\": [\\n \\"cn-hangzhou\\"\\n ],\\n \\"LogStorePattern\\": \\"audit-activity\\",\\n \\"LogUserIds\\": [\\n \\"173326*******\\"\\n ],\\n \\"UpdateTime\\": 1733269771123,\\n \\"DataSourceFrom\\": \\"custom\\",\\n \\"AutoScanNew\\": \\"enabled\\",\\n \\"DataSourceRecognizer\\": \\"alibaba_cloud_actiontrail_event_ingestion\\",\\n \\"DataSourceRecognizeEnabled\\": true\\n }\\n ],\\n \\"PageNumber\\": \\"1\\",\\n \\"PageSize\\": \\"10\\"\\n}","type":"json"}]', + 'title' => 'ListDataSourceTemplates', + 'description' => 'Notifications are limited by frequency and time. Each user receives a maximum of two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataSourceTemplates', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSourceTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:datasourcetemplate/*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n}","type":"json"}]', ], - 'UpdateNormalizationRule' => [ - 'summary' => '更新标准化规则', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListDataSources' => [ + 'summary' => 'Lists data sources.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management Center of your threat analysis feature is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member. You can use this parameter to switch the perspective to a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'DataSourceIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The IDs of the data sources.', + 'type' => 'array', + 'items' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_alert_log_173326*******,alibaba_cloud_waf_flow_log_173326*******', 'title' => ''], 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'NormalizationRuleName', + 'name' => 'DataSourceName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'normalization_rule_Z57np。', - ], + 'schema' => ['description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_waf_alert_log', 'title' => ''], ], [ - 'name' => 'NormalizationRuleDescription', + 'name' => 'DataSourceType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'normalization_rule_Z57np。', - ], + 'schema' => ['description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], ], [ - 'name' => 'NormalizationRuleFormat', + 'name' => 'LogUserIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The IDs of the users who can access the data.', + 'type' => 'array', + 'items' => ['description' => 'The ID of the user who can access the data.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], 'required' => false, - 'example' => 'SPL。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'NormalizationRuleExpression', + 'name' => 'LogRegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaId', + 'name' => 'LogProjectName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'HTTP_ACTIVITY。', - ], + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], ], [ - 'name' => 'VendorId', + 'name' => 'LogStoreName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud。', - ], + 'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'audit-activity', 'title' => ''], ], [ - 'name' => 'ProductId', + 'name' => 'DataSourceTemplateIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The IDs of the data source templates.', + 'type' => 'array', + 'items' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''], 'required' => false, - 'example' => 'alibaba_cloud_sas。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'NormalizationRuleMode', + 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'both。', - ], + 'schema' => ['description' => 'The sorting field.', 'type' => 'string', 'required' => false, 'example' => 'UpdateTime', 'title' => ''], ], [ - 'name' => 'ExtendContentPacked', + 'name' => 'Order', 'in' => 'formData', - 'schema' => [ - 'title' => '用于标识否将非标准字段打包到扩展字段extend_content,取值：'."\n" - .'- "enabled" ：启用打包'."\n" - .'- "disabled" ：不启用打包'."\n" - .'默认："disabled"', - 'description' => '', - 'type' => 'string', - 'required' => false, - ], + 'schema' => ['description' => 'The sorting order. Valid values:'."\n" + ."\n" + .'- desc'."\n" + ."\n" + .'- asc', 'type' => 'string', 'required' => false, 'example' => 'desc', 'title' => ''], ], [ - 'name' => 'OrderField', + 'name' => 'PageNumber', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The page number.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'NormalizationRuleType', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'string', 'required' => false, 'example' => '5', 'title' => ''], ], [ - 'name' => 'NormalizationRuleIds', + 'name' => 'MaxResults', 'in' => 'formData', - 'style' => 'json', - 'schema' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'string', - ], - ], + 'schema' => ['description' => 'The maximum number of entries to return for a single request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], ], [ - 'name' => 'ExtendFieldStoreMode', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'title' => '扩展字段存储模式，可选项：flat、pack、reject。', - 'type' => 'string', - 'example' => 'flat', - ], + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. Set this parameter to the value of NextToken that is returned in the response to the previous query. Leave this parameter empty for the first query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], [ - 'name' => 'NormalizationCategoryId', + 'name' => 'DataSourceFrom', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY。', - 'title' => '所属标准化类目', - ], + 'schema' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'center', 'title' => ''], + ], + [ + 'name' => 'DataSourceStoreStatus', + 'in' => 'formData', + 'schema' => ['description' => 'The status of the Logstore. Valid values:'."\n" + ."\n" + .'- normal'."\n" + ."\n" + .'- abnormal', 'type' => 'string', 'required' => false, 'example' => 'normal', 'title' => ''], + ], + [ + 'name' => 'DataSourceStatus', + 'in' => 'formData', + 'schema' => ['description' => 'The status of the data source. Valid values:'."\n" + ."\n" + .'- unconfigured'."\n" + ."\n" + .'- normal'."\n" + ."\n" + .'- abnormal', 'type' => 'string', 'required' => false, 'example' => 'unconfigured', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'DataSources' => [ + 'description' => 'The data sources.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data sources.', + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The time when the data source was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the data source was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'DataSourceId' => ['description' => 'The ID of the data source.', 'type' => 'string', 'example' => 'ds-scpfegri73oyoknbc90c', 'title' => ''], + 'DataSourceName' => ['description' => 'The name of the data source.', 'type' => 'string', 'example' => 'AD_LOG', 'title' => ''], + 'DataSourceType' => ['description' => 'The type of the data source. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'custom', 'title' => ''], + 'LogUserId' => ['description' => 'The ID of the user who can access the data.', 'type' => 'integer', 'format' => 'int64', 'example' => '173326*******', 'title' => ''], + 'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''], + 'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], + 'DataSourceFrom' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'center', 'title' => ''], + 'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'example' => 'audit-activity', 'title' => ''], + 'DataSourceTemplateId' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''], + 'DataSourceStores' => [ + 'description' => 'The list of Logstores.', + 'type' => 'array', + 'items' => [ + 'description' => 'The Logstore.', + 'type' => 'object', + 'properties' => [ + 'DataSourceStoreId' => ['description' => 'The ID of the log storage.', 'type' => 'string', 'example' => 'di_xxxx_source_1', 'title' => ''], + 'DataSourceStoreStatus' => ['description' => 'The status of the log storage. Valid values:'."\n" + ."\n" + .'- normal'."\n" + ."\n" + .'- abnormal', 'type' => 'string', 'title' => '', 'example' => 'normal'], + 'DataSourceStoreFrom' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'center', 'title' => ''], + 'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''], + 'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], + 'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'example' => 'audit-activity', 'title' => ''], + 'CreateTime' => ['description' => 'The time when the log storage was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the log storage was last updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'CheckTime' => ['description' => 'The time when the check was performed.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'DataSourceStoreStatusCode' => ['description' => 'The status code of the log storage.', 'type' => 'string', 'example' => 'LogStoreNotExist', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'DataSourceRecognizer' => ['description' => 'The data source recognizer.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot', 'title' => ''], + 'DataSourceRecognizeEnabled' => ['description' => 'Indicates whether new Logstores are automatically discovered.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'DataSourceReferences' => [ + 'description' => 'The list of data ingestion IDs that are associated with the data source.', + 'type' => 'array', + 'items' => [ + 'description' => 'The data ingestion ID that is associated with the data source.', + 'type' => 'object', + 'properties' => [ + 'DataIngestionId' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas_account_snapshot_log_173326*******', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'DataSourceStatus' => ['description' => 'The status of the data source. Valid values:'."\n" + ."\n" + .'- unconfigured'."\n" + ."\n" + .'- normal'."\n" + ."\n" + .'- abnormal', 'type' => 'string', 'example' => 'unconfigured', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + 'TotalPage' => ['description' => 'The total number of pages.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries returned on each page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If a value is returned, it indicates that not all results have been returned. You can use this token in the next query to continue retrieving results.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"DataSources\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"DataSourceId\\": \\"ds-scpfegri73oyoknbc90c\\",\\n \\"DataSourceName\\": \\"AD_LOG\\",\\n \\"DataSourceType\\": \\"custom\\",\\n \\"LogUserId\\": 0,\\n \\"LogRegionId\\": \\"cn-hangzhou\\",\\n \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n \\"DataSourceFrom\\": \\"center\\",\\n \\"LogStoreName\\": \\"audit-activity\\",\\n \\"DataSourceTemplateId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\",\\n \\"DataSourceStores\\": [\\n {\\n \\"DataSourceStoreId\\": \\"di_xxxx_source_1\\",\\n \\"DataSourceStoreStatus\\": \\"normal\\",\\n \\"DataSourceStoreFrom\\": \\"center\\",\\n \\"LogRegionId\\": \\"cn-hangzhou\\",\\n \\"LogProjectName\\": \\"aliyun-cloudsiem-data-173326*******-cn-hangzhou\\",\\n \\"LogStoreName\\": \\"audit-activity\\",\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"CheckTime\\": 1733269771123,\\n \\"DataSourceStoreStatusCode\\": \\"LogStoreNotExist\\"\\n }\\n ],\\n \\"DataSourceRecognizer\\": \\"alibaba_cloud_sas_account_snapshot\\",\\n \\"DataSourceRecognizeEnabled\\": true,\\n \\"DataSourceReferences\\": [\\n {\\n \\"DataIngestionId\\": \\"alibaba_cloud_sas_account_snapshot_log_173326*******\\"\\n }\\n ],\\n \\"DataSourceStatus\\": \\"unconfigured\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 1,\\n \\"TotalCount\\": 2,\\n \\"TotalPage\\": 1,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'title' => 'ListDataSources', + 'description' => 'Notifications are subject to frequency and time limits. A maximum of two notifications are sent to each user per day, and only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDataSources', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'DeleteNormalizationRule' => [ - 'summary' => '删除标准化规则', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListDetectionRules' => [ + 'summary' => 'Retrieves a list of detection rules.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'Detect Discovery Behavior for Local Systems Groups', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'dr-ppa85gfw69tgwkys****', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleIds', + 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of detection rule IDs.', + 'type' => 'array', + 'items' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'dr-ppa85gfw69tgwkys****'."\n", 'title' => ''], 'required' => false, - 'example' => 'zh。', + 'title' => '', + 'example' => '', ], ], [ + 'name' => 'DetectionRuleType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the detection rule. Valid values:'."\n" + ."\n" + .'- preset: a built-in detection rule.'."\n" + ."\n" + .'- custom: a custom detection rule.'."\n" + ."\n" + .'- custom\\_template: a rule template.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + ], + [ + 'name' => 'DetectionRuleStatus', + 'in' => 'formData', + 'schema' => ['description' => 'The status of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''], + ], + [ + 'name' => 'AlertType', + 'in' => 'formData', + 'schema' => ['description' => 'The alert type.', 'type' => 'string', 'required' => false, 'example' => 'siem_rule_type_alert_storm', 'title' => ''], + ], + [ + 'name' => 'AlertLevel', + 'in' => 'formData', + 'schema' => ['description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- 5: critical.'."\n" + ."\n" + .'- 4: important.'."\n" + ."\n" + .'- 3: medium.'."\n" + ."\n" + .'- 2: low.'."\n" + ."\n" + .'- 1: informational.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'AlertTacticId', + 'in' => 'formData', + 'schema' => ['description' => 'The alert tactic phase.', 'type' => 'string', 'required' => false, 'example' => 'TA0042', 'title' => ''], + ], + [ + 'name' => 'AlertAttCk', + 'in' => 'formData', + 'schema' => ['description' => 'The ATT\\&CK technique of the alert.', 'type' => 'string', 'required' => false, 'example' => 'Discovery', 'title' => ''], + ], + [ + 'name' => 'IncidentAggregationType', + 'in' => 'formData', + 'schema' => ['description' => 'The event aggregation type. Valid values:'."\n" + ."\n" + .'- none: No events are generated.'."\n" + ."\n" + .'- graph\\_compute: graph computing (supported by predefined rules).'."\n" + ."\n" + .'- expert: expert rule.'."\n" + ."\n" + .'- passthrough: alert passthrough (one-to-one).'."\n" + ."\n" + .'- window: aggregation of similar alerts (by window).', 'type' => 'string', 'required' => false, 'example' => 'graph_compute', 'title' => ''], + ], + [ + 'name' => 'LogCategoryId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''], + ], + [ + 'name' => 'LogSchemaId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'required' => false, 'example' => 'API_RISK_ACTIVITY', 'title' => ''], + ], + [ + 'name' => 'DetectionExpressionType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the detection rule expression.', 'type' => 'string', 'required' => false, 'example' => 'playbook', 'title' => ''], + ], + [ + 'name' => 'OrderFieldName', + 'in' => 'formData', + 'schema' => ['description' => 'The field to sort by. Valid values:'."\n" + ."\n" + .'- GmtCreate: the creation time.'."\n" + ."\n" + .'- GmtModified: the update time.', 'type' => 'string', 'required' => false, 'example' => 'GmtModified', 'title' => ''], + ], + [ + 'name' => 'OrderDirection', + 'in' => 'formData', + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + ."\n" + .'- **asc**: ascending order. This is the default value.'."\n" + ."\n" + .'- **desc**: descending order.', 'type' => 'string', 'required' => false, 'example' => 'asc', 'title' => ''], + ], + [ + 'name' => 'PageNumber', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination parameter. This specifies the current page number.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '1', 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination parameter. This specifies the number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'maximum' => '100', 'minimum' => '1', 'example' => '100', 'title' => ''], + ], + [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID that the administrator uses to switch to the perspective of another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'schema' => ['description' => 'The maximum number of data entries to read.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '508DCFFD-4508-54BF-A8A0-E97A0FA6****', 'title' => ''], + 'DetectionRules' => [ + 'description' => 'The list of detection rules.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2023-03-21 13:47:01', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '2023-04-16 10:51:00', 'title' => ''], + 'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'jndi-attack-success_http_netstat', 'title' => ''], + 'DetectionRuleName' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'example' => 'Detect Discovery Behavior for Local Systems Groups'."\n", 'title' => ''], + 'DetectionRuleDescription' => ['description' => 'The description of the detection rule.', 'type' => 'string', 'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.', 'title' => ''], + 'DetectionRuleType' => ['description' => 'The type of the detection rule. Valid values:'."\n" + ."\n" + .'- preset: a built-in detection rule.'."\n" + ."\n" + .'- custom: a custom detection rule.'."\n" + ."\n" + .'- custom\\_template: a rule template.', 'type' => 'string', 'example' => 'custom', 'title' => ''], + 'DetectionRuleStatus' => ['description' => 'The status of the detection rule. Valid values:'."\n" + ."\n" + .'- enabled: The rule is enabled.'."\n" + ."\n" + .'- disabled: The rule is disabled.'."\n" + ."\n" + .'- testing: The rule is being tested.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'DetectionExpressionType' => ['description' => 'The type of the detection rule expression.', 'type' => 'string', 'example' => 'playbook', 'title' => ''], + 'DetectionExpressionContent' => ['description' => 'The content of the detection rule expression.', 'type' => 'string', 'example' => '*|set session mode=scan;SELECT * FROM log'."\n" + .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n" + .'AND ('."\n" + .' proc_path LIKE \'%/groups\''."\n" + .' OR ('."\n" + .' ('."\n" + .' proc_path LIKE \'%/cat\''."\n" + .' OR proc_path LIKE \'%/head\''."\n" + .' OR proc_path LIKE \'%/tail\''."\n" + .' OR proc_path LIKE \'%/more\''."\n" + .' )'."\n" + .' AND cmdline LIKE \'%/etc/group%\''."\n" + .' )'."\n" + .')', 'title' => ''], + 'LogCategoryId' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'LogSchemaId' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'example' => 'API_RISK_ACTIVITY', 'title' => ''], + 'AlertSchemaId' => ['description' => 'The ID of the alert template for the detection rule. Valid values:'."\n" + ."\n" + .'- ALERT\\_ACTIVITY: other alerts.'."\n" + ."\n" + .'- EDR\\_ALERT\\_ACTIVITY: Endpoint Detection and Response (EDR) alerts.'."\n" + ."\n" + .'- FIREWALL\\_ALERT\\_ACTIVITY: firewall alerts.'."\n" + ."\n" + .'- WAF\\_ALERT\\_ACTIVITY: Web Application Firewall (WAF) alerts.', 'type' => 'string', 'example' => 'ALERT_ACTIVITY', 'title' => ''], + 'ScheduleType' => ['description' => 'The scheduling type. Valid values:'."\n" + ."\n" + .'- fixed\\_rate: fixed interval'."\n" + ."\n" + .'- cron: cron expression', 'type' => 'string', 'example' => 'fixed_rate', 'title' => ''], + 'ScheduleExpression' => ['description' => 'The cron expression for scheduling. This parameter is required when ScheduleType is set to cron.', 'type' => 'string', 'example' => '5m', 'title' => ''], + 'ScheduleMaxRetries' => ['description' => 'The maximum number of retries after a timeout. The value can be from 1 to 100.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'ScheduleBeginTime' => ['description' => 'The start time of the scheduling. This is a 13-digit timestamp.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'ScheduleWindow' => ['description' => 'The length of the scheduling window.', 'type' => 'string', 'example' => '5m', 'title' => ''], + 'ScheduleMaxTimeout' => ['description' => 'The maximum timeout period, in seconds. The value can be from 60 to 1800.', 'type' => 'integer', 'format' => 'int32', 'example' => '60', 'title' => ''], + 'AlertType' => ['description' => 'The alert type.', 'type' => 'string', 'example' => 'WebShell', 'title' => ''], + 'AlertLevel' => ['description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- 5: critical.'."\n" + ."\n" + .'- 4: important.'."\n" + ."\n" + .'- 3: medium.'."\n" + ."\n" + .'- 2: low.'."\n" + ."\n" + .'- 1: informational.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'AlertTacticId' => ['description' => 'The alert tactic phase.', 'type' => 'string', 'example' => 'TA0042', 'title' => ''], + 'AlertAttCk' => ['description' => 'The ATT\\&CK technique of the alert.', 'type' => 'string', 'example' => 'Discovery', 'title' => ''], + 'AlertThresholdPeriod' => ['description' => 'The length of the alert threshold period.', 'type' => 'string', 'example' => '5m', 'title' => ''], + 'AlertThresholdCount' => ['description' => 'The number of alert thresholds.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'AlertThresholdGroup' => ['description' => 'The list of alert threshold fields, separated by commas.', 'type' => 'string', 'example' => 'alert_type,ip', 'title' => ''], + 'IncidentAggregationType' => ['description' => 'The event aggregation type. Valid values:'."\n" + ."\n" + .'- none: No events are generated.'."\n" + ."\n" + .'- graph\\_compute: graph computing (supported by predefined rules).'."\n" + ."\n" + .'- expert: expert rule.'."\n" + ."\n" + .'- passthrough: alert passthrough (one-to-one).'."\n" + ."\n" + .'- window: aggregation of similar alerts (by window).', 'type' => 'string', 'example' => 'passthrough', 'title' => ''], + 'IncidentAggregationExpression' => ['description' => 'The configuration of the event aggregation period.', 'type' => 'string', 'example' => '5m', 'title' => ''], + 'PlaybookUuid' => ['description' => 'The UUID of the playbook.', 'type' => 'string', 'example' => 'dde983ed-eb56-45ea-ac2e-3b12b2a9****', 'title' => ''], + 'PlaybookParameters' => ['description' => 'The custom parameters of the playbook.', 'type' => 'string', 'example' => '{'."\n" + .' "ip": {'."\n" + .' "ip": "124.23.*.*"'."\n" + .' }'."\n" + .'}', 'title' => ''], + 'Playbook' => [ + 'description' => 'The configuration of the playbook.', + 'type' => 'object', + 'properties' => [ + 'Flow' => ['description' => 'The flow configuration of the playbook.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "id": "EndEvent_1fqpq4h",'."\n" + .' "zIndex": 1,'."\n" + .' "data": {'."\n" + .' "nodeType": "endEvent",'."\n" + .' "appType": "basic",'."\n" + .' "valueData": {'."\n" + ."\n" + .' },'."\n" + .' "icon": "icon-radio-off-full"'."\n" + .' },'."\n" + .' "position": {'."\n" + .' "x": 1369,'."\n" + .' "y": 174'."\n" + .' }'."\n" + .' }'."\n" + .']', 'title' => ''], + 'Config' => ['description' => 'The configuration of the input parameters for invoking the playbook.', 'type' => 'string', 'example' => '['."\n" + .' {'."\n" + .' "name": "expireDay",'."\n" + .' "dataType": "Integer",'."\n" + .' "required": true,'."\n" + .' "isArray": false,'."\n" + .' "example": "7",'."\n" + .' "description": "desc",'."\n" + .' "typeName": "Integer",'."\n" + .' "dataClass": "normal",'."\n" + .' "stanchDefaultValue": "7"'."\n" + .' }'."\n" + .']', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'EntityMappings' => [ + 'description' => 'The entity mapping configuration.', + 'type' => 'array', + 'items' => [ + 'description' => 'The entity mapping configuration.', + 'type' => 'object', + 'properties' => [ + 'NormalizationSchemaId' => ['description' => 'The entity type ID.', 'type' => 'string', 'example' => 'ip', 'title' => ''], + 'NormalizationFieldMappings' => [ + 'description' => 'The entity mapping configuration.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['description' => 'The standard entity field.', 'type' => 'string', 'example' => 'src_ip', 'title' => ''], + 'MappingFieldName' => ['description' => 'The mapped field.', 'type' => 'string', 'example' => 'ip', 'title' => ''], + 'NormalizationFieldType' => ['description' => 'The data type of the standard entity field.', 'type' => 'string', 'example' => 'vachar', 'title' => ''], + ], + 'description' => 'The entity mapping configuration.', + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'AlertName' => ['description' => 'The alert name. You can use $$ to reference the output fields of the query.', 'type' => 'string', 'example' => 'Detected high-frequency multi-type network attacks from $src_ip$', 'title' => ''], + 'AlertDescription' => ['description' => 'The alert description. You can use $$ to reference the output fields of the query.', 'type' => 'string', 'example' => 'Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$', 'title' => ''], + 'AlertTypeMapping' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'AlertLevelMapping' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'AlertAttCkMapping' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + 'description' => 'The detection rule.', + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The pagination parameter. This specifies the current page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + 'PageSize' => ['description' => 'The pagination parameter. This specifies the number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '6', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of data entries to read.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to start the next query.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'ValidateNormalizationRule' => [ - 'summary' => '校验规则和数据', - 'methods' => [ - 'post', - 'get', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListDetectionRules', + 'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day. These notifications are sent only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'schemes' => [ - 'https', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListDetectionRules', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"508DCFFD-4508-54BF-A8A0-E97A0FA6****\\",\\n \\"DetectionRules\\": [\\n {\\n \\"CreateTime\\": 0,\\n \\"UpdateTime\\": 0,\\n \\"DetectionRuleId\\": \\"jndi-attack-success_http_netstat\\",\\n \\"DetectionRuleName\\": \\"Detect Discovery Behavior for Local Systems Groups\\\\n\\",\\n \\"DetectionRuleDescription\\": \\"Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.\\",\\n \\"DetectionRuleType\\": \\"custom\\",\\n \\"DetectionRuleStatus\\": \\"enabled\\",\\n \\"DetectionExpressionType\\": \\"playbook\\",\\n \\"DetectionExpressionContent\\": \\"*|set session mode=scan;SELECT * FROM log\\\\nWHERE schema = \'PROCESS_START_ACTIVITY\'\\\\nAND (\\\\n proc_path LIKE \'%/groups\'\\\\n OR (\\\\n (\\\\n proc_path LIKE \'%/cat\'\\\\n OR proc_path LIKE \'%/head\'\\\\n OR proc_path LIKE \'%/tail\'\\\\n OR proc_path LIKE \'%/more\'\\\\n )\\\\n AND cmdline LIKE \'%/etc/group%\'\\\\n )\\\\n)\\",\\n \\"LogCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"LogSchemaId\\": \\"API_RISK_ACTIVITY\\",\\n \\"AlertSchemaId\\": \\"ALERT_ACTIVITY\\",\\n \\"ScheduleType\\": \\"fixed_rate\\",\\n \\"ScheduleExpression\\": \\"5m\\",\\n \\"ScheduleMaxRetries\\": 1,\\n \\"ScheduleBeginTime\\": 1733269771123,\\n \\"ScheduleWindow\\": \\"5m\\",\\n \\"ScheduleMaxTimeout\\": 60,\\n \\"AlertType\\": \\"WebShell\\",\\n \\"AlertLevel\\": \\"1\\",\\n \\"AlertTacticId\\": \\"TA0042\\",\\n \\"AlertAttCk\\": \\"Discovery\\",\\n \\"AlertThresholdPeriod\\": \\"5m\\",\\n \\"AlertThresholdCount\\": 10,\\n \\"AlertThresholdGroup\\": \\"alert_type,ip\\",\\n \\"IncidentAggregationType\\": \\"passthrough\\",\\n \\"IncidentAggregationExpression\\": \\"5m\\",\\n \\"PlaybookUuid\\": \\"dde983ed-eb56-45ea-ac2e-3b12b2a9****\\",\\n \\"PlaybookParameters\\": \\"{\\\\n \\\\\\"ip\\\\\\": {\\\\n \\\\\\"ip\\\\\\": \\\\\\"124.23.*.*\\\\\\"\\\\n }\\\\n}\\",\\n \\"Playbook\\": {\\n \\"Flow\\": \\"[\\\\n {\\\\n \\\\\\"id\\\\\\": \\\\\\"EndEvent_1fqpq4h\\\\\\",\\\\n \\\\\\"zIndex\\\\\\": 1,\\\\n \\\\\\"data\\\\\\": {\\\\n \\\\\\"nodeType\\\\\\": \\\\\\"endEvent\\\\\\",\\\\n \\\\\\"appType\\\\\\": \\\\\\"basic\\\\\\",\\\\n \\\\\\"valueData\\\\\\": {\\\\n\\\\n },\\\\n \\\\\\"icon\\\\\\": \\\\\\"icon-radio-off-full\\\\\\"\\\\n },\\\\n \\\\\\"position\\\\\\": {\\\\n \\\\\\"x\\\\\\": 1369,\\\\n \\\\\\"y\\\\\\": 174\\\\n }\\\\n }\\\\n]\\",\\n \\"Config\\": \\"[\\\\n {\\\\n \\\\\\"name\\\\\\": \\\\\\"expireDay\\\\\\",\\\\n \\\\\\"dataType\\\\\\": \\\\\\"Integer\\\\\\",\\\\n \\\\\\"required\\\\\\": true,\\\\n \\\\\\"isArray\\\\\\": false,\\\\n \\\\\\"example\\\\\\": \\\\\\"7\\\\\\",\\\\n \\\\\\"description\\\\\\": \\\\\\"desc\\\\\\",\\\\n \\\\\\"typeName\\\\\\": \\\\\\"Integer\\\\\\",\\\\n \\\\\\"dataClass\\\\\\": \\\\\\"normal\\\\\\",\\\\n \\\\\\"stanchDefaultValue\\\\\\": \\\\\\"7\\\\\\"\\\\n }\\\\n]\\"\\n },\\n \\"EntityMappings\\": [\\n {\\n \\"NormalizationSchemaId\\": \\"ip\\",\\n \\"NormalizationFieldMappings\\": [\\n {\\n \\"NormalizationFieldName\\": \\"src_ip\\",\\n \\"MappingFieldName\\": \\"ip\\",\\n \\"NormalizationFieldType\\": \\"vachar\\"\\n }\\n ]\\n }\\n ],\\n \\"AlertName\\": \\"Detected high-frequency multi-type network attacks from $src_ip$\\",\\n \\"AlertDescription\\": \\"Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$\\",\\n \\"AlertTypeMapping\\": \\"\\",\\n \\"AlertLevelMapping\\": \\"\\",\\n \\"AlertAttCkMapping\\": \\"\\"\\n }\\n ],\\n \\"PageNumber\\": 2,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 6,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + ], + 'ListIncidents' => [ + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'readAndWrite', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'none', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The data management center of the threat detection and response feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Chinese mainland.'."\n" + .'- ap-southeast-1: Outside the Chinese mainland.', 'type' => 'string', 'example' => 'cn-hangzhou', 'required' => false, 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'example' => 'zh', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'IncidentName', + 'in' => 'query', + 'schema' => ['description' => 'The name of the event.', 'type' => 'string', 'example' => 'ECS unusual log in', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'IncidentUuids', + 'in' => 'query', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of event UUIDs, separated by commas (,).', + 'type' => 'array', + 'items' => ['description' => 'The list of event UUIDs, separated by commas (,).', 'type' => 'string', 'example' => '85ea4241-798f-4684-a876-65d4f0c3****,90ea4241-798f-4684-a876-65d4f0c3****'."\n" + ."\n", 'required' => false, 'title' => ''], 'required' => false, - 'example' => 'zh。', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'RoleFor', + 'name' => 'IncidentStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The status of the event. Valid values:'."\n" + .'- 0: unhandled.'."\n" + .'- 1: handling.'."\n" + .'- 5: handling failed.'."\n" + .'- 10: handled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'required' => false, 'title' => ''], ], [ - 'name' => 'Data', + 'name' => 'ThreatLevel', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The threat level. Valid values:'."\n" + .'- 5: critical.'."\n" + .'- 4: high.'."\n" + .'- 3: medium.'."\n" + .'- 2: low.'."\n" + .'- 1: informational.', + 'type' => 'array', + 'items' => ['description' => 'The threat level. Valid values:'."\n" + .'- 5: critical.'."\n" + .'- 4: high.'."\n" + .'- 3: medium.'."\n" + .'- 2: low.'."\n" + .'- 1: informational.', 'type' => 'string', 'example' => '2', 'required' => false, 'title' => ''], 'required' => false, - 'example' => '123456。', + 'maxItems' => 100, + 'example' => '5', + 'title' => '', ], ], [ - 'name' => 'NormalizationCategoryId', + 'name' => 'RelateAssetId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY。', - ], + 'schema' => ['description' => 'The ID of the asset associated with the event.', 'type' => 'string', 'example' => '6c740667-80b2-476d-8924-2e706feb****'."\n", 'required' => false, 'title' => ''], ], [ - 'name' => 'NormalizationSchemaId', + 'name' => 'RelateEntityId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'HTTP_ACTIVITY。', - ], + 'schema' => ['description' => 'The ID of the entity associated with the event.', 'type' => 'string', 'example' => 'b920ed22259f5412099e97dfda96****', 'required' => false, 'title' => ''], ], [ - 'name' => 'VendorId', + 'name' => 'IncidentTags', 'in' => 'formData', - 'schema' => [ - 'title' => '厂商ID。', - 'type' => 'string', - 'example' => 'alibaba_cloud', - ], + 'schema' => ['description' => 'The tags of the event.', 'type' => 'string', 'example' => '[{\\"data_source\\":[\\"sas\\"]}]', 'title' => '', 'required' => false], ], [ - 'name' => 'ProductId', + 'name' => 'AlertUuid', 'in' => 'formData', - 'schema' => [ - 'title' => '产品ID。', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas', - ], + 'schema' => ['description' => 'The alert ID.', 'type' => 'string', 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'required' => false, 'title' => ''], ], [ - 'name' => 'ExtendFieldStoreMode', + 'name' => 'StartTime', 'in' => 'formData', - 'schema' => [ - 'title' => '扩展字段存储模式，取值：flat、pack、reject。', - 'type' => 'string', - 'example' => 'flat', - ], + 'schema' => ['description' => 'The start time as a timestamp in milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1690102943000', 'required' => false, 'title' => ''], ], [ - 'name' => 'NormalizationRuleMode', + 'name' => 'EndTime', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化规则模式。取值：both、realtime', - 'type' => 'string', - 'example' => 'realtime', - ], + 'schema' => ['description' => 'The end time as a timestamp in milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1749090526055', 'required' => false, 'title' => ''], ], [ - 'name' => 'LogSample', + 'name' => 'OrderFieldName', + 'in' => 'formData', + 'schema' => ['description' => 'The field name used to sort the list. Valid values:'."\n" + .'- GmtModified: event update time (default).'."\n" + .'- ThreatScore: threat score.', 'type' => 'string', 'example' => 'GmtModified', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'OrderDirection', + 'in' => 'formData', + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + .'- **desc** (default): descending order.'."\n" + .'- **asc**: ascending order.', 'type' => 'string', 'example' => 'desc', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'PageNumber', + 'in' => 'formData', + 'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'minimum' => '1', 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'PageSize', + 'in' => 'formData', + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'maximum' => '100', 'minimum' => '1', 'example' => '10', 'title' => ''], + ], + [ + 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'example' => '113091674488****', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type. Valid values:'."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'required' => false, 'title' => ''], + ], + [ + 'name' => 'Owners', + 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '日志样例，JSON格式。', - 'type' => 'string', - 'example' => '{"aaa":"bbb","xxx":"yyy"}', + 'title' => '', + 'description' => 'The UID of the account that owns the event.', + 'type' => 'array', + 'items' => ['title' => '', 'description' => 'The UID of the account that owns the event.', 'type' => 'string', 'example' => '1234567890xxxxxx', 'required' => false], + 'required' => false, + 'maxItems' => 100, + 'example' => '', ], ], [ - 'name' => 'NormalizationRuleExpression', + 'name' => 'IncidentStatusList', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'title' => '标准化规则表达式。', - 'type' => 'string', - 'example' => '*', + 'type' => 'array', + 'items' => ['type' => 'string', 'example' => '1', 'description' => '', 'title' => ''], + 'example' => '[0,1,5]', + 'maxItems' => 100, + 'description' => '', + 'title' => '', ], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => 'Id of the request', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'ValidateResult' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'Incidents' => [ + 'description' => 'The list of events.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The event.', 'type' => 'object', 'properties' => [ - 'FieldName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'host。', - ], - 'FieldValue' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ze。', - ], - 'NormalizationFieldName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'host。', - ], - 'NormalizationFieldRequired' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'Result' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'Message' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'success。', - ], - 'NormalizationFieldType' => [ - 'title' => '标准字段类型，支持text、long、double、json四种类型。', - 'type' => 'string', - 'example' => 'text', - ], - 'NormalizationFieldFrom' => [ - 'title' => '标准字段来源，preset-内置，custom-自定义。', - 'type' => 'string', - 'example' => 'preset', - ], - 'NormalizationFieldReserved' => [ - 'title' => '是否是系统内置的标准字段名。', - 'type' => 'boolean', - ], - 'NormalizationFieldValidationStatus' => [ - 'title' => '标准字段校验状态，取值：pass、fail。', - 'type' => 'string', - 'example' => 'pass', - ], - 'NormalizationFieldValidationReason' => [ - 'title' => '标准字段校验失败原因。', - 'type' => 'string', - 'example' => 'OperationDenied.TheValueIsRequired', - ], - 'LogFieldName' => [ - 'title' => '日志字段名。', - 'type' => 'string', - 'example' => 'aaa', - ], - 'LogFieldValue' => [ - 'title' => '日志字段值。', - 'type' => 'string', - 'example' => 'bbb', - ], - ], + 'IncidentName' => ['description' => 'The name of the event.', 'type' => 'string', 'example' => 'ECS unusual log in', 'title' => ''], + 'ThreatLevel' => ['description' => 'The threat level. Valid values:'."\n" + .'- 5: critical.'."\n" + .'- 4: high.'."\n" + .'- 3: medium.'."\n" + .'- 2: low.'."\n" + .'- 1: informational.', 'type' => 'string', 'example' => '2', 'title' => ''], + 'IncidentStatus' => ['description' => 'The status of the event. Valid values:'."\n" + .'- 0: unhandled.'."\n" + .'- 1: handling.'."\n" + .'- 5: handling failed.'."\n" + .'- 10: handled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''], + 'Owner' => ['title' => '', 'description' => 'The UID of the account that owns the event.', 'type' => 'string', 'example' => '1234567890xxxxxx'], + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1603248483000', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1603248483000', 'title' => ''], + 'RelateAssetCount' => ['description' => 'The number of assets associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '4', 'title' => ''], + 'IncidentUuid' => ['description' => 'The UUID of the event.', 'type' => 'string', 'example' => 'dbb1d7211c9285c862aa89385098****', 'title' => ''], + 'IncidentRemark' => ['description' => 'The remarks of the event.', 'type' => 'string', 'example' => 'remark', 'title' => ''], + 'RelateAlertCount' => ['description' => 'The number of alerts associated with the event.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''], + 'IncidentTags' => ['title' => '', 'description' => 'The tags of the event.', 'type' => 'string', 'example' => '["sys:data_source:siem","sys:trigger_type:auto"]'], + 'DetectionRuleId' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'example' => 'dr-qo5ww6ux0uc28*****', 'title' => ''], + 'ResponseTime' => ['description' => 'The response time, in milliseconds (ms).', 'type' => 'integer', 'format' => 'int64', 'example' => '1603248483000', 'title' => ''], + 'AlertInfos' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'EntityInfos' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'IncidentDescription' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + 'AttckTactics' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + 'title' => '', + 'example' => '', ], - ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ValidateResult\\": [\\n {\\n \\"FieldName\\": \\"host\\",\\n \\"FieldValue\\": \\"ze\\",\\n \\"NormalizationFieldName\\": \\"host\\",\\n \\"NormalizationFieldRequired\\": true,\\n \\"Result\\": 1,\\n \\"Message\\": \\"success\\",\\n \\"NormalizationFieldType\\": \\"text\\",\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldReserved\\": true,\\n \\"NormalizationFieldValidationStatus\\": \\"pass\\",\\n \\"NormalizationFieldValidationReason\\": \\"OperationDenied.TheValueIsRequired\\",\\n \\"LogFieldName\\": \\"aaa\\",\\n \\"LogFieldValue\\": \\"bbb\\"\\n }\\n ]\\n}","type":"json"}]', - ], - 'GetNormalizationRule' => [ - 'summary' => '获取标准化规则', - 'methods' => [ - 'post', - 'get', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve event list', + 'summary' => 'Retrieves a list of events.', + 'description' => 'Notifications are subject to frequency and time restrictions.'."\n" + .'Each user can receive a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time window.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListIncidents'], + ], ], - 'schemes' => [ - 'https', + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListIncidents', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Incident', 'arn' => 'acs:yundun-sas::{#accountId}:incident/*'], + ], + ], + ], ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Incidents\\": [\\n {\\n \\"IncidentName\\": \\"ECS unusual log in\\",\\n \\"ThreatLevel\\": \\"2\\",\\n \\"IncidentStatus\\": 0,\\n \\"Owner\\": \\"1234567890xxxxxx\\",\\n \\"CreateTime\\": 1603248483000,\\n \\"UpdateTime\\": 1603248483000,\\n \\"RelateAssetCount\\": 4,\\n \\"IncidentUuid\\": \\"dbb1d7211c9285c862aa89385098****\\",\\n \\"IncidentRemark\\": \\"remark\\",\\n \\"RelateAlertCount\\": 3,\\n \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:siem\\\\\\",\\\\\\"sys:trigger_type:auto\\\\\\"]\\",\\n \\"DetectionRuleId\\": \\"dr-qo5ww6ux0uc28*****\\",\\n \\"ResponseTime\\": 1603248483000,\\n \\"AlertInfos\\": \\"\\",\\n \\"EntityInfos\\": \\"\\",\\n \\"IncidentDescription\\": \\"\\",\\n \\"AttckTactics\\": \\"\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + ], + 'ListLogProjects' => [ + 'summary' => 'Lists log projects.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management hub for threat analysis is located. Select the region of the Data Management hub based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The ID of the member account in the resource directory.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'LogUserId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'LogRegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of entries to return on this call.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. You do not need to specify this parameter for the first call. To retrieve the next page of results, set this parameter to the NextToken value that was returned from the previous call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationRule' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - 'NormalizationRuleName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'predefined。', - ], - 'NormalizationRuleFormat' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'SPL。', - ], - 'NormalizationRuleDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'integer', - 'example' => 'V1。', - 'format' => 'int32', - ], - 'NormalizationRuleExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], - 'NormalizationRuleStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'started。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY。', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud。', - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas。', - ], - 'NormalizationRuleMode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'both。', - ], - 'ExtendContentPacked' => [ - 'type' => 'string', - ], - 'OrderField' => [ - 'type' => 'string', - ], - 'NormalizationRuleIds' => [ - 'type' => 'array', - 'items' => [ - 'type' => 'string', - ], - ], - 'ExtendFieldStoreMode' => [ - 'title' => '扩展字段存储模式，flat-原样接入，reject-不接入，pack-打包到extend_content字段。', - 'type' => 'string', - 'example' => 'flat', - ], - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'LogProjects' => [ + 'description' => 'The list of Simple Log Service projects.', + 'type' => 'array', + 'items' => ['description' => 'The Simple Log Service project.', 'type' => 'string', 'example' => 'aliyun-cloudsiem-channel-173326*******-cn-beijing', 'title' => ''], + 'title' => '', + 'example' => '', ], + 'MaxResults' => ['description' => 'The maximum number of entries returned on this call.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If this parameter is not returned, no more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"LogProjects\\": [\\n \\"aliyun-cloudsiem-channel-173326*******-cn-beijing\\"\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListLogProjects', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is available to simplify this configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListLogProjects', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRule\\": {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationRuleMode\\": \\"both\\",\\n \\"ExtendContentPacked\\": \\"enabled\\",\\n \\"OrderField\\": \\"GmtModified\\",\\n \\"NormalizationRuleIds\\": [\\n \\"nr-z0b2ssjteut85uoh9nzp\\"\\n ],\\n \\"ExtendFieldStoreMode\\": \\"flat\\"\\n }\\n}","type":"json"}]', ], - 'GetNormalizationSchema' => [ - 'summary' => '获取Schema信息以及字段', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListLogRegions' => [ + 'summary' => 'Retrieves all regions.', + 'path' => '', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -7696,309 +7565,188 @@ 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + 'tenantRelevance' => 'publicInformation', ], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'Lang', + 'in' => 'formData', + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to use.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'LogRegions' => [ + 'description' => 'A list of log storage region IDs.', + 'type' => 'array', + 'items' => ['description' => 'The log storage region ID.', 'type' => 'string', 'example' => 'cn-hangzhou', 'title' => ''], + 'title' => '', + 'example' => '', + ], + ], + 'example' => '', ], ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"LogRegions\\": [\\n \\"cn-hangzhou\\"\\n ]\\n}","type":"json"}]', + 'title' => 'ListLogRegions', + 'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:ListLogRegions', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], + ], + ], + 'ListLogStores' => [ + 'summary' => 'Retrieves a list of Logstores.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ + [ + 'AK' => [], + ], + ], + 'operationType' => 'readAndWrite', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'list', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The region of the Data Management center. Select the region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member whose permissions are assumed by the administrator.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaType', + 'name' => 'LogUserId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'log。', - ], + 'schema' => ['description' => 'The ID of the user who ingests the data.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaId', + 'name' => 'LogRegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'HTTP_ACTIVITY。', - ], + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'LogProjectName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of entries to return on this call.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The token that is used to start the next query. You do not need to specify this parameter for the first query. If a subsequent query is required, set the value to the NextToken value that is returned from the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationSchema' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY。', - ], - 'NormalizationSchemaName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationFields' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cloud_user。', - 'title' => '标准字段名。', - ], - 'NormalizationFieldType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'varchar。', - 'title' => '标准字段类型，支持text、long、double、json四种类型。', - ], - 'NormalizationFieldRequired' => [ - 'title' => '是否为必填字段', - 'type' => 'boolean', - ], - 'NormalizationFieldDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cloud_user。', - 'title' => '标准字段描述。', - ], - 'NormalizationFieldExample' => [ - 'description' => '', - 'type' => 'string', - 'example' => '173326*******。', - 'title' => '标准字段示例。', - ], - 'NormalizationFieldReserved' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - 'title' => '是否是系统内置的标准字段名。', - ], - 'NormalizationFieldFrom' => [ - 'title' => '标准字段来源，preset-内置，custom-自定义。', - 'type' => 'string', - 'example' => 'preset', - ], - 'NormalizationFieldTokenize' => [ - 'title' => '标准字段是否分词。', - 'type' => 'boolean', - ], - 'NormalizationFieldJsonIndexAll' => [ - 'title' => 'json类型的标准字段是否针对所有key建立索引。', - 'type' => 'boolean', - ], - 'NormalizationFieldJsonKeys' => [ - 'title' => 'json类型的标准字段key列表。', - 'type' => 'array', - 'items' => [ - 'title' => 'json类型的标准字段key。', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'title' => 'json类型的标准字段key名称。', - 'type' => 'string', - 'example' => 'cloud_code', - ], - 'NormalizationFieldType' => [ - 'title' => 'json类型的标准字段key类型。', - 'type' => 'string', - 'example' => 'varchar', - ], - 'NormalizationFieldRequired' => [ - 'title' => 'json类型的标准字段key是否必填。', - 'type' => 'boolean', - ], - 'NormalizationFieldDescription' => [ - 'title' => 'json类型的标准字段key描述。', - 'type' => 'string', - 'example' => '云code，枚举值：\\n<br>● alibaba_cloud\\n<br>● huawei_cloud\\n<br>● tencent_cloud', - ], - 'NormalizationFieldExample' => [ - 'title' => 'json类型的标准字段key示例。', - 'type' => 'string', - 'example' => 'alibaba_cloud', - ], - 'NormalizationFieldFrom' => [ - 'title' => 'json类型的标准字段key来源。', - 'type' => 'string', - 'example' => 'preset', - ], - 'NormalizationFieldTokenize' => [ - 'title' => 'json类型的标准字段key是否分词。', - 'type' => 'boolean', - ], - 'NormalizationFieldReserved' => [ - 'title' => '是否是系统内置的标准字段名。', - 'type' => 'boolean', - ], - 'CreateTime' => [ - 'title' => '创建时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'UpdateTime' => [ - 'title' => '更新时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - ], - ], - ], - 'CreateTime' => [ - 'title' => '创建时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'UpdateTime' => [ - 'title' => '更新时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'NormalizationFieldRequirement' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - ], - ], - ], - 'TargetLogStore' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'network-activity。', - 'title' => '日志服务 LogStore。', - ], - 'TargetStoreView' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'network_activity。', - 'title' => '日志服务 StoreView。', - ], - 'NormalizationSchemaType' => [ - 'title' => '标准结构类型，preset-预定义，custom-自定义', - 'type' => 'string', - 'example' => 'preset', - ], - 'UpdateTime' => [ - 'title' => '更新时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123', - ], - 'CreateTime' => [ - 'title' => '创建时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123', - ], - 'NormalizationSchemaReferences' => [ - 'title' => '标准化结构引用列表。', - 'type' => 'array', - 'items' => [ - 'title' => '标准化结构引用。', - 'type' => 'object', - 'properties' => [ - 'NormalizationRuleId' => [ - 'title' => '标准化规则ID。', - 'type' => 'string', - 'example' => 'alibaba_cloud_cfw_flow_rule', - ], - ], - ], - ], - 'NormalizationSchemaFrom' => [ - 'title' => '标准化结构来源：preset-预定义，custom-自定义。', - 'type' => 'string', - 'example' => 'preset', - ], - 'NormalizationSchemaDescription' => [ - 'title' => '标准化结构描述。', - 'type' => 'string', - 'example' => '网络五元组日志', - ], - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'LogStores' => [ + 'description' => 'The list of Simple Log Service Logstores.', + 'type' => 'array', + 'items' => ['description' => 'A Simple Log Service Logstore.', 'type' => 'string', 'example' => 'wadaaaa', 'title' => ''], + 'title' => '', + 'example' => '', ], + 'MaxResults' => ['description' => 'The maximum number of entries returned on this call.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to start the next query. If this parameter is empty, no subsequent query is required.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"LogStores\\": [\\n \\"wadaaaa\\"\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListLogStores', + 'description' => 'The notification frequency is limited. Each user can receive up to two notifications per day between 08:00 and 20:00. No notifications are sent outside this time frame.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListLogStores', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationSchema\\": {\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationFields\\": [\\n {\\n \\"NormalizationFieldName\\": \\"cloud_user\\",\\n \\"NormalizationFieldType\\": \\"varchar\\",\\n \\"NormalizationFieldRequired\\": true,\\n \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n \\"NormalizationFieldExample\\": \\"173326*******\\",\\n \\"NormalizationFieldReserved\\": true,\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": true,\\n \\"NormalizationFieldJsonIndexAll\\": true,\\n \\"NormalizationFieldJsonKeys\\": [\\n {\\n \\"NormalizationFieldName\\": \\"cloud_code\\",\\n \\"NormalizationFieldType\\": \\"varchar\\",\\n \\"NormalizationFieldRequired\\": true,\\n \\"NormalizationFieldDescription\\": \\"云code，枚举值：\\\\\\\\n<br>● alibaba_cloud\\\\\\\\n<br>● huawei_cloud\\\\\\\\n<br>● tencent_cloud\\",\\n \\"NormalizationFieldExample\\": \\"alibaba_cloud\\",\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": true,\\n \\"NormalizationFieldReserved\\": true,\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000\\n }\\n ],\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000,\\n \\"NormalizationFieldRequirement\\": true\\n }\\n ],\\n \\"TargetLogStore\\": \\"network-activity\\",\\n \\"TargetStoreView\\": \\"network_activity\\",\\n \\"NormalizationSchemaType\\": \\"log\\",\\n \\"UpdateTime\\": 1733269771123,\\n \\"CreateTime\\": 1733269771123,\\n \\"NormalizationSchemaReferences\\": [\\n {\\n \\"NormalizationRuleId\\": \\"alibaba_cloud_cfw_flow_rule\\"\\n }\\n ],\\n \\"NormalizationSchemaFrom\\": \\"preset\\",\\n \\"NormalizationSchemaDescription\\": \\"网络五元组日志\\"\\n }\\n}","type":"json"}]', ], - 'GetNormalizationRuleVersion' => [ - 'summary' => '获取标准化规则指定版本信息', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListNormalizationCategories' => [ + 'summary' => 'Lists normalization categories.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -8007,363 +7755,343 @@ 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region for the Data Management center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'NormalizationCategoryType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'schema' => ['description' => 'The type of the normalization rule category. Valid values:'."\n" + ."\n" + .'- log'."\n" + ."\n" + .'- entity', 'type' => 'string', 'required' => false, 'example' => 'entity', 'title' => ''], ], [ - 'name' => 'NormalizationRuleVersion', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1。', - ], + 'schema' => ['description' => 'The maximum number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. Set this parameter to the NextToken value returned in the previous API call to retrieve the next page of results. You do not need to specify this parameter for the first query.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - 'NormalizationRuleName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'predefined。', - ], - 'NormalizationRuleFormat' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'SPL。', - ], - 'NormalizationRuleDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'integer', - 'example' => 'V1。', - 'format' => 'int32', - ], - 'NormalizationRuleExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], - 'NormalizationRuleStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'started。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY。', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud。', - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas。', - ], - 'NormalizationRuleVersionName' => [ - 'type' => 'string', - ], - 'RegionId' => [ - 'type' => 'string', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationCategories' => [ + 'description' => 'A list of normalization categories.', + 'type' => 'array', + 'items' => [ + 'description' => 'A normalization category.', + 'type' => 'object', + 'properties' => [ + 'NormalizationCategoryId' => ['description' => 'The ID of the normalization category.', 'type' => 'string', 'example' => 'COMMON_CATEGORY', 'title' => ''], + 'NormalizationCategoryName' => ['description' => 'The name of the normalization category.', 'type' => 'string', 'example' => 'COMMON_CATEGORY', 'title' => ''], ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], + 'MaxResults' => ['description' => 'The maximum number of entries returned on the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If the response does not contain this parameter, no more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationCategories\\": [\\n {\\n \\"NormalizationCategoryId\\": \\"COMMON_CATEGORY\\",\\n \\"NormalizationCategoryName\\": \\"COMMON_CATEGORY\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListNormalizationCategories', + 'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListNormalizationCategories', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleVersion\\": {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationRuleVersionName\\": \\"v1\\",\\n \\"RegionId\\": \\"cn-hangzhou\\"\\n }\\n}","type":"json"}]', ], - 'DeleteNormalizationRuleVersion' => [ - 'summary' => '删除标准化规则版本', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListNormalizationFields' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'Name', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'schema' => ['description' => 'The field name.', 'type' => 'string', 'required' => false, 'example' => 'category', 'title' => ''], ], [ - 'name' => 'NormalizationRuleVersion', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1。', - ], + 'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether a next query token exists. You do not need to specify this parameter for the first query or if no next query exists. If a next query exists, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + ], + [ + 'name' => 'NormalizationFieldSource', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'example' => 'native', 'description' => '', 'title' => ''], + ], + [ + 'name' => 'NormalizationSchemaType', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'example' => 'log', 'description' => '', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response struct.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationFields' => [ + 'description' => 'The list of normalization fields.', + 'type' => 'array', + 'items' => [ + 'description' => 'The normalization field.', + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['description' => 'The name of the normalization field.', 'type' => 'string', 'example' => 'cloud_user', 'title' => ''], + 'NormalizationFieldType' => ['description' => 'The type of the normalization field. Valid values:'."\n" + .'- varchar'."\n" + .'- bigint'."\n" + .'- double.', 'type' => 'string', 'example' => 'varchar', 'title' => ''], + 'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the normalization field key is required.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldDescription' => ['description' => 'The description of the normalization field.', 'type' => 'string', 'example' => 'cloud_user', 'title' => ''], + 'NormalizationFieldExample' => ['description' => 'The example value of the normalization field.', 'type' => 'string', 'example' => '173326*******', 'title' => ''], + 'NormalizationCategoryId' => ['description' => 'The ID of the normalization category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'NormalizationSchemaId' => ['description' => 'The ID of the normalization schema.', 'type' => 'string', 'example' => 'NETWORK_SESSION_ACTIVITY', 'title' => ''], + 'NormalizationFieldReserved' => ['description' => 'Indicates whether the normalization field is reserved.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'NormalizationFieldFrom' => ['title' => '', 'description' => 'The source of the normalization field key of the JSON type.', 'type' => 'string', 'example' => 'preset'], + 'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the normalization field is tokenized.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldJsonIndexAll' => ['title' => '', 'description' => 'Indicates whether indexes are created for all keys of the JSON-type normalization field.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldJsonKeys' => [ + 'title' => '', + 'description' => 'The list of keys for the JSON-type normalization field.', + 'type' => 'array', + 'items' => [ + 'title' => '', + 'description' => 'The key of the JSON-type normalization field.', + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['title' => '', 'description' => 'The name of the JSON-type normalization field key.', 'type' => 'string', 'example' => 'alert_level'], + 'NormalizationFieldType' => ['title' => '', 'description' => 'The type of the JSON-type normalization field key.', 'type' => 'string', 'example' => 'text'], + 'NormalizationFieldRequired' => ['title' => '', 'description' => 'Indicates whether the JSON-type normalization field key is required.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldDescription' => ['title' => '', 'description' => 'The description of the JSON-type normalization field key.', 'type' => 'string', 'example' => 'alert_level'], + 'NormalizationFieldExample' => ['title' => '', 'description' => 'The example value of the JSON-type normalization field key.', 'type' => 'string', 'example' => '1'], + 'NormalizationFieldFrom' => ['title' => '', 'description' => 'The source of the normalization field key of the JSON type.', 'type' => 'string', 'example' => 'preset'], + 'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Indicates whether the JSON-type normalization field key is tokenized.', 'type' => 'boolean', 'example' => ''], + 'NormalizationFieldReserved' => ['title' => '', 'description' => 'Indicates whether the normalization field key is a built-in system field key.', 'type' => 'boolean', 'example' => ''], + 'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + ], + 'example' => '', + ], + 'example' => '', + ], + 'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'NormalizationFieldRequirement' => ['description' => 'Indicates whether the normalization field is required.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'NormalizationSecurityDomainId' => ['type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => '', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], + 'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'Specifies whether a next query token exists. You do not need to specify this parameter for the first query or if no next query exists. If a next query exists, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve normalization field list', + 'summary' => 'Retrieves a list of normalization fields.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, see [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListNormalizationFields', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationFields\\": [\\n {\\n \\"NormalizationFieldName\\": \\"cloud_user\\",\\n \\"NormalizationFieldType\\": \\"varchar\\",\\n \\"NormalizationFieldRequired\\": false,\\n \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n \\"NormalizationFieldExample\\": \\"173326*******\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"NETWORK_SESSION_ACTIVITY\\",\\n \\"NormalizationFieldReserved\\": true,\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": false,\\n \\"NormalizationFieldJsonIndexAll\\": false,\\n \\"NormalizationFieldJsonKeys\\": [\\n {\\n \\"NormalizationFieldName\\": \\"alert_level\\",\\n \\"NormalizationFieldType\\": \\"text\\",\\n \\"NormalizationFieldRequired\\": false,\\n \\"NormalizationFieldDescription\\": \\"alert_level\\",\\n \\"NormalizationFieldExample\\": \\"1\\",\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": false,\\n \\"NormalizationFieldReserved\\": false,\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000\\n }\\n ],\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000,\\n \\"NormalizationFieldRequirement\\": true,\\n \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', ], - 'SetDefaultNormalizationRuleVersion' => [ - 'summary' => '设置标准化规则默认版本', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListNormalizationRuleCapacities' => [ + 'summary' => 'Lists the security capabilities of normalization rules.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'none', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region of the threat analysis Data Management Center. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID that an administrator uses to switch to a member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationRuleVersion', + 'name' => 'NormalizationRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => 'V1。', - ], + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of entries to return on each page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '0', 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The token to start the next query. Leave this parameter empty for the first query. If the response is truncated, use the \\`NextToken\\` value from the previous response.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'A list of normalization rule IDs.', + 'type' => 'array', + 'items' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', + 'title' => '', + 'example' => '', ], ], ], @@ -8371,119 +8099,83 @@ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - 'NormalizationRuleName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'predefined。', - ], - 'NormalizationRuleFormat' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'SPL。', - ], - 'NormalizationRuleDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'integer', - 'example' => 'V1。', - 'format' => 'int32', - ], - 'NormalizationRuleExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], - 'NormalizationRuleStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'started。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY。', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud。', - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas。', + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationRuleCapacities' => [ + 'description' => 'The list of security capabilities that are associated with the normalization rules.', + 'type' => 'array', + 'items' => [ + 'description' => 'The security capability that is associated with the normalization rule.', + 'type' => 'object', + 'properties' => [ + 'CapacityType' => ['description' => 'The type of the security capability. Valid values:'."\n" + ."\n" + .'- detection\\_preset\\_rule: predefined analysis rule.'."\n" + ."\n" + .'- detection\\_custom\\_rule: custom analysis rule.'."\n" + ."\n" + .'- incident\\_investigation: security event handling.'."\n" + ."\n" + .'- soar\\_playbooks: predefined playbook.', 'type' => 'string', 'example' => 'detection_preset_rule', 'title' => ''], + 'Capacities' => [ + 'description' => 'The list of security capabilities.', + 'type' => 'array', + 'items' => ['description' => 'The security capability.', 'type' => 'string', 'example' => 'NETWORK_SESSION_ACTIVITY', 'title' => ''], + 'title' => '', + 'example' => '', + ], + 'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], ], + 'title' => '', + 'example' => '', ], - ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + 'TotalPage' => ['description' => 'The total number of pages.', 'type' => 'integer', 'format' => 'int32', 'example' => '3', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token for the next query. If the response is truncated, use this token in your next request to retrieve the next page of results. If this parameter is empty, all results have been returned.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleCapacities\\": [\\n {\\n \\"CapacityType\\": \\"detection_preset_rule\\",\\n \\"Capacities\\": [\\n \\"NETWORK_SESSION_ACTIVITY\\"\\n ],\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"TotalPage\\": 3,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'title' => 'ListNormalizationRuleCapacities', + 'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A helper tool class is provided with configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListNormalizationRuleCapacities', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleVersion\\": {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\"\\n }\\n}","type":"json"}]', ], 'ListNormalizationRuleVersions' => [ - 'summary' => '获取标准化规则版本列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'summary' => 'Queries a list of normalization rule versions.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -8495,168 +8187,114 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the Data Management Center for threat analysis is located. Select the region for the Management Center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ 'name' => 'NormalizationRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], ], [ 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The maximum number of entries to return for the current request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], ], [ 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. You do not need to specify this parameter for the first request. If a next page exists, set this parameter to the value of NextToken that is returned from the last call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], 'NormalizationRuleVersions' => [ - 'description' => '', + 'description' => 'The list of normalization rule versions.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The normalization rule version.', 'type' => 'object', 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'integer', - 'example' => 'V1。', - 'format' => 'int32', - ], - 'NormalizationRuleExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], - ], + 'CreateTime' => ['description' => 'The time when the version was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the version was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'NormalizationRuleId' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], + 'NormalizationRuleVersion' => ['description' => 'The version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'example' => 'V1', 'title' => ''], + 'NormalizationRuleExpression' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], + 'MaxResults' => ['description' => 'The maximum number of entries returned on each page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token that is used in the next request to retrieve a new page of results. If the NextToken parameter is empty, no more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleVersions\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListNormalizationRuleVersions', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class is available and provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListNormalizationRuleVersions', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRuleVersion', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationruleversion/*'], + ], + ], + ], + ], ], 'ListNormalizationRules' => [ - 'summary' => '获取标准化规则列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'summary' => 'Retrieves a list of normalization rules.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -8668,366 +8306,216 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: the Chinese mainland.'."\n" + .'- ap-southeast-1: outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ 'name' => 'NormalizationRuleIds', 'in' => 'formData', 'style' => 'simple', 'schema' => [ - 'description' => '', + 'description' => 'The list of normalization rule IDs.', 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'items' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], 'required' => false, + 'title' => '', + 'example' => '', ], ], [ 'name' => 'NormalizationRuleName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'normalization_rule_Z57np。', - ], + 'schema' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''], ], [ 'name' => 'NormalizationRuleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'predefined。', - ], + 'schema' => ['description' => 'The type of the normalization rule. Valid values:'."\n" + .'- predefined: predefined normalization rule.'."\n" + .'- custom: custom normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'predefined', 'title' => ''], ], [ 'name' => 'NormalizationCategoryId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY。', - ], + 'schema' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''], ], [ 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'HTTP_ACTIVITY。', - ], + 'schema' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''], ], [ 'name' => 'VendorId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud。', - ], + 'schema' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud', 'title' => ''], ], [ 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alibaba_cloud_sas。', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], + ], + [ + 'name' => 'NormalizationSecurityDomainId', + 'in' => 'formData', + 'schema' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''], ], [ 'name' => 'PageNumber', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '3。', - ], + 'schema' => ['description' => 'The page number of the current page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '3', 'title' => ''], ], [ 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '10。', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''], ], [ 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'UpdateTime。', - ], + 'schema' => ['description' => 'The field used for sorting.', 'type' => 'string', 'required' => false, 'example' => 'UpdateTime', 'title' => ''], ], [ 'name' => 'OrderType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'desc。', - ], + 'schema' => ['description' => 'The sort order. Valid values:'."\n" + .'- desc'."\n" + .'- asc.', 'type' => 'string', 'required' => false, 'example' => 'desc', 'title' => ''], ], [ 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], ], [ 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], 'NormalizationRules' => [ - 'description' => '', + 'description' => 'The list of normalization rules.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The normalization rule.', 'type' => 'object', 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123。', - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - 'NormalizationRuleName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'predefined。', - ], - 'NormalizationRuleFormat' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'SPL。', - ], - 'NormalizationRuleDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationRuleVersion' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'V1。', - ], - 'NormalizationRuleExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content。', - ], - 'NormalizationRuleStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'started。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY。', - ], - 'VendorId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud。', - ], - 'ProductId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_sas。', - ], + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], + 'NormalizationRuleName' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationRuleType' => ['description' => 'The type of the normalization rule. Valid values:'."\n" + .'- predefined: predefined normalization rule.'."\n" + .'- custom: custom normalization rule.', 'type' => 'string', 'example' => 'predefined', 'title' => ''], + 'NormalizationRuleFormat' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'example' => 'SPL', 'title' => ''], + 'NormalizationRuleDescription' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationRuleVersion' => ['description' => 'The current version of the normalization rule.', 'type' => 'string', 'example' => 'V1', 'title' => ''], + 'NormalizationRuleExpression' => ['description' => 'The expression of the normalization rule.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''], + 'NormalizationRuleStatus' => ['description' => 'The status of the normalization rule.', 'type' => 'string', 'example' => 'started', 'title' => ''], + 'NormalizationCategoryId' => ['description' => 'The category ID of the normalization rule.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''], + 'VendorId' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''], + 'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], 'NormalizationRuleReferences' => [ - 'description' => '', + 'description' => 'The list of associated ingestion policies.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The associated ingestion policy.', 'type' => 'object', 'properties' => [ - 'DataIngestionId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alibaba_cloud_bot_flow_ingestion_173326*******。', - ], + 'DataIngestionId' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'example' => 'alibaba_cloud_bot_flow_ingestion_173326*******', 'title' => ''], ], + 'title' => '', + 'example' => '', ], - ], - 'NormalizationRuleMode' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'both。', - ], - 'ExtendContentPacked' => [ - 'type' => 'string', - ], - 'ExtendFieldStoreMode' => [ - 'title' => '扩展字段存储模式，flat-原样接入，reject-不接入，pack-打包到extend_content字段。', - 'type' => 'string', - 'example' => 'flat', - ], - ], + 'title' => '', + 'example' => '', + ], + 'NormalizationRuleMode' => ['description' => 'The mode of the normalization rule. Valid values:'."\n" + .'- both'."\n" + .'- scan'."\n" + .'- realtime.', 'type' => 'string', 'example' => 'both', 'title' => ''], + 'ExtendContentPacked' => ['description' => 'Specifies whether non-standard fields are packed into the extend_content field. Valid values:'."\n" + .'- enabled: Enabled.'."\n" + .'- disabled: Disabled.', 'type' => 'string', 'example' => 'enabled', 'title' => ''], + 'ExtendFieldStoreMode' => ['title' => '', 'description' => 'The storage mode for extended fields. Valid values: flat (ingest as-is), reject (do not ingest), and pack (pack into the extend_content field).', 'type' => 'string', 'example' => 'flat'], + 'NormalizationSecurityDomainId' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''], + 'NormalizationFieldSource' => ['title' => '', 'type' => 'string', 'example' => 'normalized', 'description' => ''], + ], + 'title' => '', + 'example' => '', ], - ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '5。', - ], - 'TotalPage' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'title' => '', + 'example' => '', + ], + 'PageNumber' => ['description' => 'The page number of the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '5', 'title' => ''], + 'TotalPage' => ['description' => 'The total number of pages.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve normalization rules', + 'description' => 'Notifications are subject to frequency and time restrictions.'."\n" + .'Each user can receive a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time window.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListNormalizationRules', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRules\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": \\"V1\\",\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationRuleReferences\\": [\\n {\\n \\"DataIngestionId\\": \\"alibaba_cloud_bot_flow_ingestion_173326*******\\"\\n }\\n ],\\n \\"NormalizationRuleMode\\": \\"both\\",\\n \\"ExtendContentPacked\\": \\"enabled\\",\\n \\"ExtendFieldStoreMode\\": \\"flat\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 2,\\n \\"TotalCount\\": 5,\\n \\"TotalPage\\": 1,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRules\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": \\"V1\\",\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationRuleReferences\\": [\\n {\\n \\"DataIngestionId\\": \\"alibaba_cloud_bot_flow_ingestion_173326*******\\"\\n }\\n ],\\n \\"NormalizationRuleMode\\": \\"both\\",\\n \\"ExtendContentPacked\\": \\"enabled\\",\\n \\"ExtendFieldStoreMode\\": \\"flat\\",\\n \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\",\\n \\"NormalizationFieldSource\\": \\"normalized\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 2,\\n \\"TotalCount\\": 5,\\n \\"TotalPage\\": 1,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'ListNormalizationFields' => [ - 'summary' => '获取标准化日志所有字段', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListNormalizationSchemas' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -9039,268 +8527,148 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n" + .'- ap-southeast-1: the asset is outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the request and response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'Name', + 'name' => 'NormalizationSchemaType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'category。', - ], + 'schema' => ['title' => '', 'description' => 'The normalization schema type. Valid values:'."\n" + .'- log: log.'."\n" + .'- entity: entity.', 'type' => 'string', 'example' => 'entity', 'required' => false], + ], + [ + 'name' => 'NormalizationCategoryId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''], + ], + [ + 'name' => 'NormalizationSecurityDomainId', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The security domain ID.', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'required' => false], ], [ 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], ], [ 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + ], + [ + 'name' => 'NormalizationFieldSource', + 'in' => 'formData', + 'schema' => ['title' => '', 'description' => 'The field source filter. Valid values: normalized / native.', 'type' => 'string', 'example' => 'normalized', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationFields' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationSchemas' => [ + 'description' => 'The list of normalization schemas.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The normalization schema.', 'type' => 'object', 'properties' => [ - 'NormalizationFieldName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cloud_user。', - ], - 'NormalizationFieldType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'varchar。', - ], - 'NormalizationFieldRequired' => [ - 'title' => '标准字段key是否必填。', - 'type' => 'boolean', - ], - 'NormalizationFieldDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cloud_user。', - ], - 'NormalizationFieldExample' => [ - 'description' => '', - 'type' => 'string', - 'example' => '173326*******。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_SESSION_ACTIVITY。', - ], - 'NormalizationFieldReserved' => [ - 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', - ], - 'NormalizationFieldFrom' => [ - 'title' => 'json类型的标准字段key来源。', - 'type' => 'string', - 'example' => 'preset', - ], - 'NormalizationFieldTokenize' => [ - 'title' => '标准字段是否分词。', - 'type' => 'boolean', - ], - 'NormalizationFieldJsonIndexAll' => [ - 'title' => 'json类型的标准字段是否针对所有key建立索引。', - 'type' => 'boolean', - ], - 'NormalizationFieldJsonKeys' => [ - 'title' => 'json类型的标准字段key列表。', + 'NormalizationSchemaId' => ['description' => 'The ID of the normalization schema.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''], + 'NormalizationSchemaName' => ['description' => 'The name of the normalization schema.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationCategoryId' => ['description' => 'The ID of the normalization rule category.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'NormalizationSchemaTargetLogStore' => ['description' => 'The LogStore to which the normalization output is written.', 'type' => 'string', 'example' => 'network-activity', 'title' => ''], + 'CreateTime' => ['title' => '', 'description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'UpdateTime' => ['title' => '', 'description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1736386610000'], + 'NormalizationSchemaDescription' => ['title' => '', 'description' => 'The description of the normalization schema.', 'type' => 'string', 'example' => 'Network flow log'], + 'NormalizationSchemaFrom' => ['title' => '', 'description' => 'The source of the normalization schema. Valid values: preset (predefined) and custom (user-defined).', 'type' => 'string', 'example' => 'preset'], + 'TargetLogStore' => ['title' => '', 'description' => 'The Simple Log Service LogStore.', 'type' => 'string', 'example' => 'network-activity'], + 'TargetStoreView' => ['title' => '', 'description' => 'The Simple Log Service StoreView.', 'type' => 'string', 'example' => 'network-activity'], + 'VendorId' => ['title' => '', 'description' => 'The vendor ID.', 'type' => 'string', 'example' => 'alibaba'], + 'ProductId' => ['title' => '', 'description' => 'The product ID.', 'type' => 'string', 'example' => 'sas'], + 'NormalizationSecurityDomainId' => ['title' => '', 'description' => 'The security domain ID.', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY'], + 'NormalizationSchemaType' => ['title' => '', 'description' => 'The normalization schema type.', 'type' => 'string', 'example' => 'log'], + 'NormalizationFieldSource' => ['title' => '', 'description' => 'The field source. Valid values:'."\n" + .'normalized: normalized field.'."\n" + .'native: native field.', 'type' => 'string', 'example' => 'normalized'], + 'RecommendEntities' => [ 'type' => 'array', - 'items' => [ - 'title' => 'json类型的标准字段key。', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'title' => 'json类型的标准字段key名称。', - 'type' => 'string', - 'example' => 'alert_name', - ], - 'NormalizationFieldType' => [ - 'title' => 'json类型的标准字段key类型。', - 'type' => 'string', - 'example' => 'text', - ], - 'NormalizationFieldRequired' => [ - 'title' => 'json类型的标准字段key是否必填。', - 'type' => 'boolean', - ], - 'NormalizationFieldDescription' => [ - 'title' => 'json类型的标准字段key描述。', - 'type' => 'string', - 'example' => '告警等级', - ], - 'NormalizationFieldExample' => [ - 'title' => 'json类型的标准字段key示例。', - 'type' => 'string', - 'example' => '枚举值：1、2、3、4、5', - ], - 'NormalizationFieldFrom' => [ - 'title' => 'json类型的标准字段key来源。', - 'type' => 'string', - 'example' => 'preset', - ], - 'NormalizationFieldTokenize' => [ - 'title' => 'json类型的标准字段key是否分词。', - 'type' => 'boolean', - ], - 'NormalizationFieldReserved' => [ - 'title' => '是否是系统内置的标准字段key。', - 'type' => 'boolean', - ], - 'CreateTime' => [ - 'title' => '创建时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'UpdateTime' => [ - 'title' => '更新时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - ], - ], - ], - 'CreateTime' => [ - 'title' => '创建时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'UpdateTime' => [ - 'title' => '更新时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'NormalizationFieldRequirement' => [ + 'items' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], 'description' => '', - 'type' => 'boolean', - 'example' => 'true。', + 'title' => '', + 'example' => '', ], ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], + 'MaxResults' => ['title' => '', 'description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50'], + 'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve normalization schema list', + 'summary' => 'Retrieves a list of normalization schemas.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class with specific configuration examples is provided. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListNormalizationSchemas', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationFields\\": [\\n {\\n \\"NormalizationFieldName\\": \\"cloud_user\\",\\n \\"NormalizationFieldType\\": \\"varchar\\",\\n \\"NormalizationFieldRequired\\": true,\\n \\"NormalizationFieldDescription\\": \\"cloud_user\\",\\n \\"NormalizationFieldExample\\": \\"173326*******\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"NETWORK_SESSION_ACTIVITY\\",\\n \\"NormalizationFieldReserved\\": true,\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": true,\\n \\"NormalizationFieldJsonIndexAll\\": true,\\n \\"NormalizationFieldJsonKeys\\": [\\n {\\n \\"NormalizationFieldName\\": \\"alert_level\\",\\n \\"NormalizationFieldType\\": \\"text\\",\\n \\"NormalizationFieldRequired\\": true,\\n \\"NormalizationFieldDescription\\": \\"alert_level\\",\\n \\"NormalizationFieldExample\\": \\"1\\",\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldTokenize\\": true,\\n \\"NormalizationFieldReserved\\": true,\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000\\n }\\n ],\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000,\\n \\"NormalizationFieldRequirement\\": true\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationSchemas\\": [\\n {\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaTargetLogStore\\": \\"network-activity\\",\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000,\\n \\"NormalizationSchemaDescription\\": \\"Network flow log\\",\\n \\"NormalizationSchemaFrom\\": \\"preset\\",\\n \\"TargetLogStore\\": \\"network-activity\\",\\n \\"TargetStoreView\\": \\"network-activity\\",\\n \\"VendorId\\": \\"alibaba\\",\\n \\"ProductId\\": \\"sas\\",\\n \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\",\\n \\"NormalizationSchemaType\\": \\"log\\",\\n \\"NormalizationFieldSource\\": \\"normalized\\",\\n \\"RecommendEntities\\": [\\n \\"\\"\\n ]\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', ], - 'ListNormalizationCategories' => [ - 'summary' => '获取标准化目录', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListNormalizationSecurityDomains' => [ + 'path' => '', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -9312,150 +8680,249 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region where the threat detection and response data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n" + .'- ap-southeast-1: the asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'schema' => ['description' => 'The maximum number of results to return when you use the NextToken-based pagination method. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', + 'title' => '', + 'description' => 'Schema of Response', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => '', 'description' => 'Id of the request', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'NormalizationSecurityDomains' => [ + 'description' => 'The list of security domains.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'NormalizationSecurityDomainId' => ['description' => 'The security domain ID.', 'type' => 'string', 'example' => 'OTHER', 'title' => ''], + 'NormalizationSecurityDomainName' => ['description' => 'The security domain name.', 'type' => 'string', 'example' => 'net', 'title' => ''], + ], + 'description' => '', + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'MaxResults' => ['description' => 'The maximum number of entries returned in this query.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + ], + 'example' => '', ], ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Get security domain list', + 'summary' => 'Retrieves a list of security domains.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationSecurityDomains\\": [\\n {\\n \\"NormalizationSecurityDomainId\\": \\"OTHER\\",\\n \\"NormalizationSecurityDomainName\\": \\"net\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + ], + 'ListProducts' => [ + 'summary' => 'Retrieves a list of products.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'NormalizationCategoryType', + 'AK' => [], + ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'list', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region for the Management Hub based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'Lang', + 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member. An administrator can specify this parameter to switch to the perspective of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'ProductIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of product IDs.', + 'type' => 'array', + 'items' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], 'required' => false, - 'example' => 'entity。', + 'title' => '', + 'example' => '', ], ], [ + 'name' => 'ProductName', + 'in' => 'formData', + 'schema' => ['description' => 'The product name.', 'type' => 'string', 'required' => false, 'example' => 'sas', 'title' => ''], + ], + [ + 'name' => 'ProductType', + 'in' => 'formData', + 'schema' => ['description' => 'The product type. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + ], + [ + 'name' => 'VendorId', + 'in' => 'formData', + 'schema' => ['description' => 'The vendor ID.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], + ], + [ 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], ], [ 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The token that is used to start the next query. You do not need to specify this parameter for the first query. For subsequent queries, set this parameter to the \\`NextToken\\` value that is returned from the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationCategories' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'Products' => [ + 'description' => 'The list of products.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The product.', 'type' => 'object', 'properties' => [ - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'COMMON_CATEGORY。', - ], - 'NormalizationCategoryName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'COMMON_CATEGORY。', - ], - ], + 'CreateTime' => ['description' => 'The time when the product was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the product was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'ProductAlias' => ['description' => 'The product alias.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'ProductName' => ['description' => 'This parameter is deprecated.', 'type' => 'string', 'example' => 'sas', 'title' => ''], + 'ProductType' => ['description' => 'The product type. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'preset', 'title' => ''], + 'VendorId' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], + 'VendorName' => ['description' => 'The vendor name.', 'type' => 'string', 'example' => '111', 'title' => ''], + 'DataIngestionStatus' => ['description' => 'The data ingestion status. Valid values:'."\n" + ."\n" + .'- true: enabled.'."\n" + ."\n" + .'- false: disabled.', 'type' => 'boolean', 'example' => 'enabled', 'title' => ''], + 'TotalDataIngestionCount' => ['description' => 'The total number of data ingestion configurations.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'EnabledDataIngestionCount' => ['description' => 'The number of enabled data ingestion configurations.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'AllowAddDataIngestion' => ['description' => 'Indicates whether data collection configurations can be added.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'AbnormalDataIngestionCount' => ['description' => 'The number of abnormal data ingestion configurations.', 'type' => 'integer', 'format' => 'int32', 'example' => '2', 'title' => ''], + 'ActiveTime' => ['description' => 'The activation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], + 'MaxResults' => ['description' => 'The maximum number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If the value of this parameter is not empty, more results are available. You can use this token in the next request to retrieve the next page of results.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries returned.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Products\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"ProductAlias\\": \\"alibaba_cloud_sas\\",\\n \\"ProductName\\": \\"sas\\",\\n \\"ProductType\\": \\"preset\\",\\n \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n \\"VendorName\\": \\"111\\",\\n \\"DataIngestionStatus\\": true,\\n \\"TotalDataIngestionCount\\": 10,\\n \\"EnabledDataIngestionCount\\": 1,\\n \\"AllowAddDataIngestion\\": true,\\n \\"AbnormalDataIngestionCount\\": 2,\\n \\"ActiveTime\\": 1733269771123\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListProducts', + 'description' => 'The \\`JsonConfig\\` request parameter is a complex JSON configuration. A supporting tool class is provided that contains configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListProducts', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationCategories\\": [\\n {\\n \\"NormalizationCategoryId\\": \\"COMMON_CATEGORY\\",\\n \\"NormalizationCategoryName\\": \\"COMMON_CATEGORY\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', ], - 'ListNormalizationRuleCapacities' => [ - 'summary' => '获取规则的安全能力', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListQueryViews' => [ + 'summary' => 'Retrieves a list of query views.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -9467,193 +8934,117 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'in' => 'query', + 'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets belong to the Chinese mainland or Hong Kong (China).'."\n" + .'- ap-southeast-1: Your assets belong to regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'QueryViewScene', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], + 'schema' => ['description' => 'The scene to which the query view belongs.', 'type' => 'string', 'required' => false, 'example' => 'Alert', 'title' => ''], ], [ - 'name' => 'NormalizationRuleId', + 'name' => 'QueryViewType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], + 'schema' => ['description' => 'The view type. If this parameter is left empty, all views are returned.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The view type.'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'NormalizationRuleIds', + 'name' => 'MaxResults', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - 'required' => false, - ], + 'schema' => ['description' => 'The maximum number of results to return per request when using the NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], + ], + [ + 'name' => 'NextToken', + 'in' => 'formData', + 'schema' => ['description' => 'The pagination token for the next query. You do not need to specify this parameter for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationRuleCapacities' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'QueryViews' => [ + 'description' => 'The list of query views.', 'type' => 'array', 'items' => [ - 'description' => '', + 'description' => 'The query view.', 'type' => 'object', 'properties' => [ - 'CapacityType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'detection_preset_rule。', - ], - 'Capacities' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_SESSION_ACTIVITY。', - ], - ], - 'NormalizationRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'nr-z0b2ssjteut85uoh9nzp。', - ], - ], + 'QueryViewId' => ['description' => 'The unique identifier of the query view.', 'type' => 'string', 'example' => 'qv-a1b2c3d4e5f6g7h8****', 'title' => ''], + 'QueryViewScene' => ['description' => 'The scene to which the view belongs.', 'type' => 'string', 'example' => 'Alert', 'title' => ''], + 'QueryViewName' => ['description' => 'The view name.', 'type' => 'string', 'example' => 'alert', 'title' => ''], + 'QueryViewCriteria' => ['description' => 'The alert filter statement of the view.', 'type' => 'string', 'example' => 'module_code: alibaba_cloud_sas_custom_rule', 'title' => ''], + 'QueryViewType' => ['description' => 'The view type.', 'type' => 'string', 'example' => 'preset', 'title' => ''], + 'QueryViewFields' => ['description' => 'The list of displayed fields.', 'type' => 'string', 'example' => '["alert_name_cn","alert_type_cn","entity_list","alert_level","alert_status","start_time","end_time"]', 'title' => ''], + 'QueryViewStatus' => ['description' => 'The view status.', 'type' => 'string', 'example' => '2', 'title' => ''], + 'QueryViewOrder' => ['description' => 'The display order.', 'type' => 'string', 'example' => '1', 'title' => ''], + 'QueryViewCondition' => ['description' => 'The custom query condition of the view.', 'type' => 'string', 'example' => 'preset', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1。', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], - 'TotalPage' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3。', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'MaxResults' => ['description' => 'The maximum number of results to return per request when using the NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token for the next query. You do not need to specify this parameter for the first query or if no more results exist. If more results exist, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve query view list', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleCapacities\\": [\\n {\\n \\"CapacityType\\": \\"detection_preset_rule\\",\\n \\"Capacities\\": [\\n \\"NETWORK_SESSION_ACTIVITY\\"\\n ],\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"TotalPage\\": 3,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"QueryViews\\": [\\n {\\n \\"QueryViewId\\": \\"qv-a1b2c3d4e5f6g7h8****\\",\\n \\"QueryViewScene\\": \\"Alert\\",\\n \\"QueryViewName\\": \\"alert\\",\\n \\"QueryViewCriteria\\": \\"module_code: alibaba_cloud_sas_custom_rule\\",\\n \\"QueryViewType\\": \\"preset\\",\\n \\"QueryViewFields\\": \\"[\\\\\\"alert_name_cn\\\\\\",\\\\\\"alert_type_cn\\\\\\",\\\\\\"entity_list\\\\\\",\\\\\\"alert_level\\\\\\",\\\\\\"alert_status\\\\\\",\\\\\\"start_time\\\\\\",\\\\\\"end_time\\\\\\"]\\",\\n \\"QueryViewStatus\\": \\"2\\",\\n \\"QueryViewOrder\\": \\"1\\",\\n \\"QueryViewCondition\\": \\"preset\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****\\"\\n}","type":"json"}]', ], - 'ListNormalizationSchemas' => [ - 'summary' => '获取标准化类目', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'ListResponseRuleFields' => [ + 'summary' => 'Retrieves the field list of automated response rules.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -9665,612 +9056,569 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou。', - ], + 'schema' => ['description' => 'The region in which the data management center of the threat analysis feature resides. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Chinese mainland.'."\n" + .'- ap-southeast-1: outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh。', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '173326*******。', - ], - ], - [ - 'name' => 'NormalizationSchemaType', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'entity。', - ], + 'schema' => ['description' => 'The ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'NormalizationCategoryId', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY。', - ], + 'schema' => ['description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '0', - 'example' => '50。', - ], + 'schema' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], ], [ 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], + 'schema' => ['description' => 'The pagination token that marks the position from which to start reading. Leave this parameter empty to read from the beginning.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****。', - ], - 'NormalizationSchemas' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'ListResponseRuleFields' => [ + 'description' => 'The list of response rule fields.', 'type' => 'array', 'items' => [ - 'description' => '', 'type' => 'object', 'properties' => [ - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'HTTP_ACTIVITY。', - ], - 'NormalizationSchemaName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'normalization_rule_Z57np。', - ], - 'NormalizationCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY。', - ], - 'NormalizationSchemaTargetLogStore' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'network-activity。', - ], - 'CreateTime' => [ - 'title' => '创建时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'UpdateTime' => [ - 'title' => '更新时间。', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1736386610000', - ], - 'NormalizationSchemaDescription' => [ - 'title' => '标准结构描述。', - 'type' => 'string', - 'example' => '网络五元组日志', - ], - 'NormalizationSchemaFrom' => [ - 'title' => '标准化结构来源：preset-预定义，custom-自定义。', - 'type' => 'string', - 'example' => 'preset', - ], - 'TargetLogStore' => [ - 'title' => '日志服务 LogStore。', - 'type' => 'string', - 'example' => 'network-activity', + 'Field' => ['description' => 'The whitelisted field.', 'type' => 'string', 'example' => 'appname', 'title' => ''], + 'FieldName' => ['description' => 'The name of the rule field.', 'type' => 'string', 'example' => 'OriginIP,ConsoleLog,CPUTime,Duration,ErrorCode,ErrorMessage,ResponseSize,ResponseStatus,RoutineName,ClientRequestID,LogTimestamp,FetchStatus,SubRequestID', 'title' => ''], + 'DataType' => ['description' => 'The data type of the automated response rule condition field.', 'type' => 'string', 'example' => 'ip', 'title' => ''], + 'FieldNormalization' => ['description' => 'The normalization object type to which the field belongs.', 'type' => 'string', 'example' => 'alert', 'title' => ''], + 'SupportOperators' => [ + 'description' => 'The English descriptions of the operators.', + 'type' => 'array', + 'items' => [ + 'description' => 'The English descriptions of the operators.', + 'type' => 'object', + 'properties' => [ + 'Operator' => ['description' => 'The aggregation method for the dispatch rule condition. Valid values:'."\n" + ."\n" + .'- `=`: equal to'."\n" + .'- `<>`: not equal to'."\n" + .'- `in`: contains'."\n" + .'- `not in`: does not contain'."\n" + .'- `REGEXP`: matches the regular expression'."\n" + .'- `NOT REGEXP`: does not match the regular expression', 'type' => 'string', 'example' => 'BETWEEN', 'title' => ''], + 'OperatorName' => ['description' => 'The display name of the operator.', 'type' => 'string', 'example' => 'autotest-operator', 'title' => ''], + 'SupportDataType' => ['description' => 'The data types supported by the current operator, separated by commas.', 'type' => 'string', 'example' => 'ip', 'title' => ''], + 'HasRightValue' => ['description' => 'Indicates whether a right-side value is required. Valid values:'."\n" + .'- true: Required.'."\n" + .'- false: Not required.', 'type' => 'string', 'example' => 'true', 'title' => ''], + 'Index' => ['description' => 'The position of the operator in the operator list.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], - 'TargetStoreView' => [ - 'title' => '日志服务 StoreView。', - 'type' => 'string', - 'example' => 'network-activity', + 'RightValue' => [ + 'description' => 'The list of optional enumeration values for the field. This parameter is not returned if no enumeration values are available.', + 'type' => 'array', + 'items' => [ + 'description' => 'The enumeration value.', + 'type' => 'object', + 'properties' => [ + 'Value' => ['description' => 'The right-side value.', 'type' => 'string', 'example' => 'dev_selectdb_cluster', 'title' => ''], + 'ValueName' => ['description' => 'The display name of the enumeration value.', 'type' => 'string', 'example' => 'high', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50。', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****。', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57。', - ], + 'MaxResults' => ['description' => 'The maximum number of entries to return in this request.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token for the next query. Valid values: leave this parameter empty for the first query or if no more results exist. If a next query exists, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Retrieve automated response rule fields', + 'description' => 'Notifications are subject to frequency and time restrictions.'."\n" + .'Each user receives a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time range.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationSchemas\\": [\\n {\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"NormalizationSchemaName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaTargetLogStore\\": \\"network-activity\\",\\n \\"CreateTime\\": 1736386610000,\\n \\"UpdateTime\\": 1736386610000,\\n \\"NormalizationSchemaDescription\\": \\"Network flow log\\",\\n \\"NormalizationSchemaFrom\\": \\"preset\\",\\n \\"TargetLogStore\\": \\"network-activity\\",\\n \\"TargetStoreView\\": \\"network-activity\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ListResponseRuleFields\\": [\\n {\\n \\"Field\\": \\"appname\\",\\n \\"FieldName\\": \\"OriginIP,ConsoleLog,CPUTime,Duration,ErrorCode,ErrorMessage,ResponseSize,ResponseStatus,RoutineName,ClientRequestID,LogTimestamp,FetchStatus,SubRequestID\\",\\n \\"DataType\\": \\"ip\\",\\n \\"FieldNormalization\\": \\"alert\\",\\n \\"SupportOperators\\": [\\n {\\n \\"Operator\\": \\"BETWEEN\\",\\n \\"OperatorName\\": \\"autotest-operator\\",\\n \\"SupportDataType\\": \\"ip\\",\\n \\"HasRightValue\\": \\"true\\",\\n \\"Index\\": 1\\n }\\n ],\\n \\"RightValue\\": [\\n {\\n \\"Value\\": \\"dev_selectdb_cluster\\",\\n \\"ValueName\\": \\"high\\"\\n }\\n ]\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'CreateDataSet' => [ - 'summary' => '创建数据集', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'ListResponseRules' => [ + 'summary' => 'Paginated query of auto-response rules', + 'path' => '', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas104PTS'], ], 'parameters' => [ [ + 'name' => 'NextToken', + 'in' => 'formData', + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The token used to retrieve the next page of results. If you leave this parameter empty, the first page of results is returned.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****'], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'], + ], + [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the data management center for threat analysis. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- `ap-southeast-1`: Your assets are in international regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese'."\n" + ."\n" + .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataSetName', + 'name' => 'ResponseRuleName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'lmftest', - 'maxLength' => 100, - ], + 'schema' => ['description' => 'The name of the automated response rule.', 'type' => 'string', 'required' => false, 'example' => 'Send Notification When Generating Urgent Incident'."\n", 'title' => ''], ], [ - 'name' => 'DataSetDescription', + 'name' => 'ResponseRuleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'lmftest contains ip list', - 'maxLength' => 1000, - ], + 'schema' => ['description' => 'The type of the automated response rule. Valid values:'."\n" + ."\n" + .'- `preset`: A preset rule.'."\n" + ."\n" + .'- `custom`: A custom rule.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], ], [ - 'name' => 'DataSetFieldKeyName', + 'name' => 'ResponseRuleStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'ip', - ], + 'schema' => ['description' => 'The status of the automated response rule. Valid values:'."\n" + ."\n" + .'- `0`: disabled'."\n" + ."\n" + .'- `100`: enabled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0', 'title' => ''], ], [ - 'name' => 'DataSetFileName', + 'name' => 'ResponseActionType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'cloudsiem-dataset/1358117679873357_17433*****.csv', - ], + 'schema' => ['description' => 'The action of the automated response rule. Valid values:'."\n" + ."\n" + .'- `doPlaybook`: Executes a playbook.'."\n" + ."\n" + .'- `changeEventStatus`: Updates the status of an event.'."\n" + ."\n" + .'- `changeThreatLevel`: Updates the threat level of an event.'."\n" + ."\n" + .'- `addEventTag`: Adds a tag to an event.'."\n" + ."\n" + .'- `deleteEventTag`: Removes a tag from an event.'."\n" + ."\n" + .'- `alertWhitelist`: Adds an alert to the allowlist.', 'type' => 'string', 'required' => false, 'example' => 'doPlaybook', 'title' => ''], ], [ - 'name' => 'IpWhitelistRecognizers', + 'name' => 'ResponseTriggerType', 'in' => 'formData', - 'style' => 'flat', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'IpWhitelistRecognizerType' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'waf_back_source_ip', - ], - 'AutoRecognizeStatus' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled', - ], - 'RecognizeScope' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'current_account', - ], - ], - 'required' => false, - ], - 'required' => false, - ], + 'schema' => ['description' => 'The trigger type of the automated response rule. Valid values:'."\n" + ."\n" + .'- `event`: An event is generated.'."\n" + ."\n" + .'- `event_update`: An event is updated.'."\n" + ."\n" + .'- `alert`: An alert is generated.', 'type' => 'string', 'required' => false, 'example' => 'event', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'PageNumber', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'example' => '1', 'title' => ''], ], [ - 'name' => 'DataSetStatus', + 'name' => 'PageSize', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'required' => true, 'example' => '10', 'title' => ''], ], [ - 'name' => 'DataSetType', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The ID of a member. An administrator can use this parameter to view data as the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type. Valid values:'."\n" + ."\n" + .'- `0`: Displays data from the current Alibaba Cloud account.'."\n" + ."\n" + .'- `1`: Displays data from all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'DataSetRecordStatistic' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NewDataSetRecordCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '6', - ], - 'DataSetId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dataset-qt0n8246gs9nackg****', + 'TotalCount' => ['description' => 'The total number of entries that match the query conditions. This parameter is optional and may not always be returned.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '57'], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + 'NextToken' => ['description' => 'The position where the current query ends. If this parameter is empty, all data is returned.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****'], + 'MaxResults' => ['description' => 'The maximum number of entries returned for the current request.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'example' => '50'], + 'PageNumber' => ['description' => 'The page number.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'PageSize' => ['description' => 'The number of entries per page.', 'type' => 'integer', 'format' => 'int32', 'example' => '10', 'title' => ''], + 'ResponseRules' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'ResponseRuleId' => ['description' => 'The ID of the automated response rule.', 'type' => 'string', 'example' => '403235', 'title' => ''], + 'ResponseRuleType' => ['description' => 'The type of the response rule. Valid values:'."\n" + ."\n" + .'- `preset`: a predefined rule.'."\n" + ."\n" + .'- `custom`: a custom rule.', 'type' => 'string', 'example' => 'custom', 'title' => ''], + 'ResponseRuleStatus' => ['description' => 'The status of the automated response rule. Valid values:'."\n" + ."\n" + .'- `0`: disabled.'."\n" + ."\n" + .'- `100`: enabled.', 'type' => 'integer', 'format' => 'int32', 'example' => '0', 'title' => ''], + 'ResponseActionConfig' => ['description' => 'The configuration of the action that is performed if the automated response rule is triggered.', 'type' => 'string', 'example' => '[{"actionType":"doPlaybook","playbookName":"block waf IP","playbookUuid":"system_aliyun_waf_whole_process_book","disposeParam":{"period":"7d"}}]', 'title' => ''], + 'ResponseActionType' => ['description' => 'The type of the action. Valid values:'."\n" + ."\n" + .'- `doPlaybook`: executes a playbook.'."\n" + ."\n" + .'- `changeEventStatus`: changes the status of an event.'."\n" + ."\n" + .'- `changeThreatLevel`: changes the threat level of an event.'."\n" + ."\n" + .'- `addEventTag`: adds a tag to an event.'."\n" + ."\n" + .'- `deleteEventTag`: removes a tag from an event.'."\n" + ."\n" + .'- `alertWhitelist`: adds an alert to the whitelist.', 'type' => 'string', 'example' => 'doPlaybook', 'title' => ''], + 'ResponseExecutionCondition' => ['description' => 'The trigger condition of the rule.', 'type' => 'string', 'example' => '[{"left":{"value":"threat_level"},"operator":"equals","right":{"value":"suspicious"}}]', 'title' => ''], + 'ResponseRuleName' => ['description' => 'The name of the automated response rule.', 'type' => 'string', 'example' => 'Send Notification When Generating Urgent Incident'."\n", 'title' => ''], + 'ResponseTriggerType' => ['description' => 'The trigger type of the automated response rule. Valid values:'."\n" + ."\n" + .'- `event`: triggered when an event occurs.'."\n" + ."\n" + .'- `event_update`: triggered when an event is updated.'."\n" + ."\n" + .'- `alert`: triggered when an alert is generated.', 'type' => 'string', 'example' => 'event', 'title' => ''], + 'ResponseRulePriority' => ['description' => 'The priority of the automated response rule.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'UpdateTime' => ['description' => 'The time when the rule was updated.', 'type' => 'integer', 'format' => 'int64', 'example' => '1769843323000', 'title' => ''], + 'CreateTime' => ['description' => 'The time when the rule was created.', 'type' => 'integer', 'format' => 'int64', 'example' => '1769843323000', 'title' => ''], ], + 'description' => '', + 'title' => '', + 'example' => '', ], + 'description' => 'The list of automated response rules.', + 'title' => '', + 'example' => '', ], ], + 'title' => '', + 'description' => 'The response object.', + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], - ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'ListResponseRules', + 'description' => 'Each user can receive up to two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"DataSetRecordStatistic\\": {\\n \\"NewDataSetRecordCount\\": 6,\\n \\"DataSetId\\": \\"dataset-qt0n8246gs9nackg****\\"\\n }\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"TotalCount\\": 57,\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"NextToken\\": \\"AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****\\",\\n \\"MaxResults\\": 50,\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"ResponseRules\\": [\\n {\\n \\"ResponseRuleId\\": \\"403235\\",\\n \\"ResponseRuleType\\": \\"custom\\",\\n \\"ResponseRuleStatus\\": 0,\\n \\"ResponseActionConfig\\": \\"[{\\\\\\"actionType\\\\\\":\\\\\\"doPlaybook\\\\\\",\\\\\\"playbookName\\\\\\":\\\\\\"block waf IP\\\\\\",\\\\\\"playbookUuid\\\\\\":\\\\\\"system_aliyun_waf_whole_process_book\\\\\\",\\\\\\"disposeParam\\\\\\":{\\\\\\"period\\\\\\":\\\\\\"7d\\\\\\"}}]\\",\\n \\"ResponseActionType\\": \\"doPlaybook\\",\\n \\"ResponseExecutionCondition\\": \\"[{\\\\\\"left\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"threat_level\\\\\\"},\\\\\\"operator\\\\\\":\\\\\\"equals\\\\\\",\\\\\\"right\\\\\\":{\\\\\\"value\\\\\\":\\\\\\"suspicious\\\\\\"}}]\\",\\n \\"ResponseRuleName\\": \\"Send Notification When Generating Urgent Incident\\\\n\\",\\n \\"ResponseTriggerType\\": \\"event\\",\\n \\"ResponseRulePriority\\": 1,\\n \\"UpdateTime\\": 1769843323000,\\n \\"CreateTime\\": 1769843323000\\n }\\n ]\\n}","type":"json"}]', ], - 'UpdateDataSet' => [ - 'summary' => '更新数据集', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'ListTags' => [ + 'summary' => 'Queries a list of tags.', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'read', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center is located. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: the asset is in the Chinese mainland.'."\n" + .'- ap-southeast-1: the asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataSetId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dataset-10iy8mbifnb4gniv****', - ], + 'schema' => ['description' => 'The user ID that the administrator switches to when viewing as another member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'DataSetDescription', + 'name' => 'RoleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'lmftest desc', - 'maxLength' => 1000, - ], + 'schema' => ['description' => 'The view type. Valid values:'."\n" + .'- 0: the view of the current Alibaba Cloud account.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'IpWhitelistRecognizers', + 'name' => 'TargetUuid', 'in' => 'formData', - 'style' => 'flat', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'IpWhitelistRecognizerType' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cdn_back_source_ip', - ], - 'AutoRecognizeStatus' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled', - ], - 'RecognizeScope' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'current_account', - ], - ], - 'required' => false, - ], - 'required' => false, - ], + 'schema' => ['description' => 'The UUID of the target asset.', 'type' => 'string', 'required' => false, 'example' => 'a1b2c3-****', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'TargetType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The scan object type. Valid values:'."\n" + ."\n" + .'- **1**: snapshot '."\n" + .'- **2**: image', 'type' => 'string', 'required' => false, 'example' => 'AliUId', 'title' => ''], ], [ - 'name' => 'DataSetName', + 'name' => 'TargetRelation', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The target relationship.', 'type' => 'string', 'required' => false, 'example' => '{"incident_uuid":"3fce2d3b65fc2bd05cac6d******"}', 'title' => ''], ], [ - 'name' => 'DataSetFileName', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If a next query is available, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'required' => false, 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', 'title' => ''], ], [ - 'name' => 'DataSetStatus', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'type' => 'integer', - 'format' => 'int32', - ], + 'schema' => ['description' => 'The maximum number of results to return when using NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '50', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'Tags' => [ + 'description' => 'The entity tags. The value is a JSON array string in the following format:'."\n" + ."\n" + .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`', + 'type' => 'array', + 'items' => [ + 'description' => 'The entity tags. The value is a JSON array string in the following format:'."\n" + ."\n" + .'`"[{"tagKey1":"tagValue1"},{"tagKey2":"tagValue2"}]"`', + 'type' => 'object', + 'properties' => [ + 'Tag' => ['description' => 'The key of the tag to query. You can specify multiple keys. N is a positive integer.', 'type' => 'string', 'example' => 'False', 'title' => ''], + 'Count' => ['description' => 'The number of quick queries returned on the current page.', 'type' => 'integer', 'format' => 'int64', 'example' => '8', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], + 'MaxResults' => ['description' => 'The maximum number of results to return when using NextToken-based pagination. Valid values: 1 to 100. Default value: 50.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The pagination token for the next query. Leave this parameter empty for the first query or if no more results exist. If a next query is available, set this parameter to the NextToken value returned by the previous API call.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Query tag list', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B\\"\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Tags\\": [\\n {\\n \\"Tag\\": \\"False\\",\\n \\"Count\\": 8\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'DeleteDataSet' => [ - 'summary' => '删除数据集', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'ListTrafficStatistics' => [ + 'summary' => 'Retrieves a list of traffic statistics.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'get', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of your asset. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member. This parameter is used by an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'TrafficStatisticPeriod', + 'in' => 'formData', + 'schema' => ['description' => 'The statistical period.', 'type' => 'string', 'required' => false, 'example' => '30', 'title' => ''], + ], + [ + 'name' => 'TrafficStatisticPeriodType', + 'in' => 'formData', + 'schema' => ['description' => 'The statistic granularity. Valid values:'."\n" + ."\n" + .'- day: day. This is the default value.'."\n" + ."\n" + .'- hour: hour.', 'type' => 'string', 'required' => false, 'example' => 'day', 'title' => ''], + ], + [ + 'name' => 'TrafficStatisticType', + 'in' => 'formData', + 'schema' => ['description' => 'The statistic dimension. Valid values:'."\n" + ."\n" + .'- Region'."\n" + ."\n" + .'- Product'."\n" + ."\n" + .'- DataIngetion'."\n" + ."\n" + .'- logUserId', 'type' => 'string', 'required' => false, 'example' => 'Region', 'title' => ''], + ], + [ + 'name' => 'ProductId', + 'in' => 'formData', + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], + ], + [ + 'name' => 'TrafficType', + 'in' => 'formData', 'schema' => [ - 'description' => '', + 'description' => 'The type of the log traffic.', + 'enumValueTitles' => ['commonLogTraffic' => 'commonLogTraffic', 'agentAnalysisLogTraffic' => 'agentAnalysisLogTraffic'], 'type' => 'string', + 'example' => 'agentAnalysisLogTraffic', + 'default' => 'commonLogTraffic', + 'title' => '', 'required' => false, - 'example' => 'zh', ], ], [ - 'name' => 'DataSetId', + 'name' => 'RegionTag', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dataset-10iy8mbifnb4gniv****', - ], + 'schema' => ['description' => 'The region.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'LogUserIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'description' => 'A list of user IDs for batch data ingestion.', + 'type' => 'array', + 'items' => ['description' => 'A user ID for batch data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], 'required' => false, - 'example' => '113091674488****', + 'title' => '', + 'example' => '', ], ], ], @@ -10278,40 +9626,78 @@ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'TrafficStatistics' => [ + 'description' => 'The list of traffic statistics.', + 'type' => 'array', + 'items' => [ + 'description' => 'The traffic statistics.', + 'type' => 'object', + 'properties' => [ + 'TrafficStatisticTarget' => ['description' => 'The statistic target.', 'type' => 'string', 'example' => 'all', 'title' => ''], + 'TrafficStatisticData' => [ + 'description' => 'The statistics information.', + 'type' => 'array', + 'items' => [ + 'description' => 'The traffic information.', + 'type' => 'object', + 'properties' => [ + 'TrafficStatisticTime' => ['description' => 'The statistic time.', 'type' => 'integer', 'format' => 'int64', 'example' => '20250815', 'title' => ''], + 'TrafficStatisticValue' => ['description' => 'The statistic value.', 'type' => 'number', 'format' => 'double', 'example' => '1.699814', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"TrafficStatistics\\": [\\n {\\n \\"TrafficStatisticTarget\\": \\"all\\",\\n \\"TrafficStatisticData\\": [\\n {\\n \\"TrafficStatisticTime\\": 20250815,\\n \\"TrafficStatisticValue\\": 1.699814\\n }\\n ]\\n }\\n ]\\n}","type":"json"}]', + 'title' => 'ListTrafficStatistics', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class with configuration examples is provided. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:ListTrafficStatistics', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', ], - 'ListDataSets' => [ - 'summary' => '获取数据集列表', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'ListUpgradeItems' => [ + 'summary' => 'Retrieves a list of upgrade items.', + 'path' => '', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -10323,354 +9709,245 @@ 'operationType' => 'list', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The maximum number of entries to return.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'minimum' => '0', 'example' => '50', 'title' => ''], ], [ - 'name' => 'Lang', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. Leave this parameter empty for the first request. To retrieve the next page, set this parameter to the NextToken value from the previous response.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], [ - 'name' => 'DataSetId', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'dataset-qt0n8246gs9nackg****', - ], + 'schema' => ['description' => 'The region where the Data Management center is located. Select a region based on where your assets are. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'DataSetName', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'lmftest', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataSetStatus', + 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'string', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'required' => false, - 'example' => '0', - 'format' => 'int32', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'UpgradeItems' => [ + 'description' => 'The list of upgrade items.', + 'type' => 'array', + 'items' => [ + 'description' => 'An upgrade item.', + 'type' => 'object', + 'properties' => [ + 'UpgradeItemId' => ['description' => 'The ID of the upgrade item.', 'type' => 'string', 'example' => 'data_storage_2_upgrade', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', + ], + 'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If the value is not empty, more results are available.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'MaxResults' => ['description' => 'The maximum number of entries returned on the current page.', 'type' => 'integer', 'format' => 'int32', 'example' => '50', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of entries.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], + ], + 'example' => '', ], ], - [ - 'name' => 'OrderFieldName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'GmtCreate', + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"UpgradeItems\\": [\\n {\\n \\"UpgradeItemId\\": \\"data_storage_2_upgrade\\"\\n }\\n ],\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"MaxResults\\": 50,\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListUpgradeItems', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class provides examples for this configuration. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListUpgradeItems', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + ], + 'ListVendors' => [ + 'summary' => 'Retrieves a list of vendors.', + 'path' => '', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'OrderDirection', + 'AK' => [], + ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'list', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'asc', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region for the Management Hub based on the region where your asset resides. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'PageNumber', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en'."\n", 'title' => ''], ], [ - 'name' => 'PageSize', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******'."\n", 'title' => ''], ], [ - 'name' => 'DataSetIds', + 'name' => 'VendorIds', 'in' => 'formData', 'style' => 'simple', 'schema' => [ - 'description' => '', + 'description' => 'A list of vendors.', 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '["dataset-1lz4nf2x08mklchy****"]', - ], + 'items' => ['description' => 'The vendor ID.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], 'required' => false, - 'maxItems' => 50, + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'RoleFor', + 'name' => 'VendorName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The vendor name.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'VendorType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '50', - ], + 'schema' => ['description' => 'The vendor type. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'MaxResults', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'schema' => ['description' => 'The maximum number of entries to return for this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'required' => false, 'example' => '50', 'title' => ''], ], [ - 'name' => 'DataSetType', + 'name' => 'NextToken', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'custom', - ], + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. If this is your first query or if no next page exists, you do not need to specify this parameter. If a next page exists, set the value to the NextToken value that is returned in the last response.', 'type' => 'string', 'required' => false, 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '157CFBB5-B56F-566F-8991-B3C51799****', - ], - 'DataSets' => [ - 'description' => '', + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'Vendors' => [ + 'description' => 'The vendors.', 'type' => 'array', 'items' => [ + 'description' => 'The vendor.', 'type' => 'object', 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1713787368000', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1713787368000', - ], - 'DataSetId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dataset-t8ha6p7k61rmniqw****', - ], - 'DataSetName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'lmftest', - ], - 'DataSetDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'lmftest desc', - ], - 'DataSetFieldNames' => [ - 'description' => '', - 'type' => 'string', - 'example' => '["ip","region"]', - ], - 'DataSetFieldKeyName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ip', - ], - 'DataSetFileName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv', - ], - 'DataSetStatus' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'DataSetReferences' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'DataSetId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dataset-nhcrmjpx1zsorlaq****', - ], - 'DataSetReferenceType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'playbook', - ], - 'DataSetReferenceId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '456232', - ], - 'DataSetReferenceName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'playbook_name', - ], - ], - ], - ], - 'DataSetType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'preset', - ], - 'IpWhitelistRecognizers' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'IpWhitelistRecognizerType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'waf_back_source_ip', - ], - 'AutoRecognizeStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled', - ], - 'RecognizeScope' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'current_account', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1713787368000', - ], - ], - ], - ], - ], + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'VendorId' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], + 'VendorName' => ['description' => 'The vendor name.', 'type' => 'string', 'example' => '111', 'title' => ''], + 'VendorType' => ['description' => 'The vendor type. Valid values:'."\n" + ."\n" + .'- preset'."\n" + ."\n" + .'- custom', 'type' => 'string', 'example' => 'preset', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], + 'title' => '', + 'example' => '', ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'MaxResults' => ['description' => 'The maximum number of entries returned for this request.', 'type' => 'integer', 'format' => 'int32', 'minimum' => '0', 'example' => '50', 'title' => ''], + 'NextToken' => ['description' => 'The token that is used to retrieve the next page of results. If this is your first query or if no next page exists, you do not need to specify this parameter. If a next page exists, set the value to the NextToken value that is returned in the last response.', 'type' => 'string', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', 'title' => ''], + 'TotalCount' => ['description' => 'The total number of records.', 'type' => 'integer', 'format' => 'int32', 'example' => '57', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Vendors\\": [\\n {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"VendorId\\": \\"vd-qlsw5eocx94w9\\",\\n \\"VendorName\\": \\"111\\",\\n \\"VendorType\\": \\"preset\\"\\n }\\n ],\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\",\\n \\"TotalCount\\": 57\\n}","type":"json"}]', + 'title' => 'ListVendors', + 'description' => 'The frequency and time of notifications are limited. Each user can receive a maximum of two notifications per day, which are sent only between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'list', + 'ramAction' => [ + 'action' => 'yundun-sas:ListVendors', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"157CFBB5-B56F-566F-8991-B3C51799****\\",\\n \\"DataSets\\": [\\n {\\n \\"CreateTime\\": 1713787368000,\\n \\"UpdateTime\\": 1713787368000,\\n \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n \\"DataSetName\\": \\"lmftest\\",\\n \\"DataSetDescription\\": \\"lmftest desc\\",\\n \\"DataSetFieldNames\\": \\"[\\\\\\"ip\\\\\\",\\\\\\"region\\\\\\"]\\",\\n \\"DataSetFieldKeyName\\": \\"ip\\",\\n \\"DataSetFileName\\": \\"cloudsiem-dataset/1358117679873357_174338773****.csv\\",\\n \\"DataSetStatus\\": 1,\\n \\"DataSetReferences\\": [\\n {\\n \\"DataSetId\\": \\"dataset-nhcrmjpx1zsorlaq****\\",\\n \\"DataSetReferenceType\\": \\"playbook\\",\\n \\"DataSetReferenceId\\": \\"456232\\",\\n \\"DataSetReferenceName\\": \\"playbook_name\\"\\n }\\n ],\\n \\"DataSetType\\": \\"preset\\",\\n \\"IpWhitelistRecognizers\\": [\\n {\\n \\"IpWhitelistRecognizerType\\": \\"waf_back_source_ip\\",\\n \\"AutoRecognizeStatus\\": \\"enabled\\",\\n \\"RecognizeScope\\": \\"current_account\\",\\n \\"UpdateTime\\": 1713787368000\\n }\\n ]\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'UpdateDataSetRecord' => [ - 'summary' => '更新数据集记录', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'RefreshDataSource' => [ + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -10682,129 +9959,273 @@ 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + 'autoTest' => true, + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the Data Management Center for threat analysis is located. Select the region of the Data Management Center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland or China (Hong Kong).'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese'."\n" + ."\n" + .'- **en**: English', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataSetId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dataset-10iy8mbifnb4gniv****', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the perspective of the specified member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'DataSetRecords', + 'name' => 'DataSourceId', 'in' => 'formData', + 'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-jl67vixpe1scwysgyu3x', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '[{\\"ip\\":\\"1.1.1.1\\",\\"userid\\":\\"1234\\",\\"name\\":\\"a12401\\"},'."\n" - .' {\\"ip\\":\\"2.2.2.2\\",\\"userid\\":\\"33333\\",\\"name\\":\\"a12401\\"}]', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'Id of the request', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + ], + 'title' => '', + 'description' => 'Schema of Response', + 'example' => '', + ], + ], + ], + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'RefreshDataSource', + 'summary' => 'Refreshes a data source.', + 'description' => 'There are limits on the frequency and time of notifications. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside of this time frame.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:RefreshDataSource', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/{#DataSourceId}'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'ResetDataStorage' => [ + 'summary' => 'Resets the log storage for a user.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'DataSetFileName', + 'AK' => [], + ], + ], + 'operationType' => 'readAndWrite', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], + 'autoTest' => true, + 'tenantRelevance' => 'tenant', + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv', - ], + 'schema' => ['description' => 'The region of the Data Management center. Select a region for the Data Management center based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'Lang', + 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member. An administrator uses this ID to switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', + 'title' => 'BaseResponse', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + ], + 'example' => '', + ], + ], + ], + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'ResetDataStorage', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:ResetDataStorage', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], + ], + 'SetDefaultNormalizationRuleVersion' => [ + 'summary' => 'Sets the default version of a normalization rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ + [ + 'AK' => [], + ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'none', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'Lang', + 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleVersion', + 'in' => 'formData', + 'schema' => ['description' => 'The normalization rule version.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => 'V1', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleId', + 'in' => 'formData', + 'schema' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], + ], + ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'DataSetRecordStatistic' => [ - 'description' => '', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], + 'NormalizationRuleVersion' => [ + 'description' => 'The normalization rule version.', 'type' => 'object', 'properties' => [ - 'NewDataSetRecordCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '12', - ], - 'UpdateDataSetRecordCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '4', - ], + 'CreateTime' => ['description' => 'The creation time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'UpdateTime' => ['description' => 'The update time.', 'type' => 'integer', 'format' => 'int64', 'example' => '1733269771123', 'title' => ''], + 'NormalizationRuleId' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], + 'NormalizationRuleName' => ['description' => 'The normalization rule name.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationRuleType' => ['description' => 'The normalization rule type. Valid values:'."\n" + .'- predefined: predefined normalization rule.'."\n" + .'- custom: custom normalization rule.', 'type' => 'string', 'example' => 'predefined', 'title' => ''], + 'NormalizationRuleFormat' => ['description' => 'The normalization rule format.', 'type' => 'string', 'example' => 'SPL', 'title' => ''], + 'NormalizationRuleDescription' => ['description' => 'The normalization rule description.', 'type' => 'string', 'example' => 'normalization_rule_Z57np', 'title' => ''], + 'NormalizationRuleVersion' => ['description' => 'The current version of the normalization rule.', 'type' => 'integer', 'format' => 'int32', 'example' => 'V1', 'title' => ''], + 'NormalizationRuleExpression' => ['description' => 'The normalization rule expression.', 'type' => 'string', 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''], + 'NormalizationRuleStatus' => ['description' => 'The normalization rule status.', 'type' => 'string', 'example' => 'started', 'title' => ''], + 'NormalizationCategoryId' => ['description' => 'The normalization rule category ID.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'title' => ''], + 'NormalizationSchemaId' => ['description' => 'The normalization schema ID.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'title' => ''], + 'VendorId' => ['description' => 'The vendor ID associated with the normalization rule.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => ''], + 'ProductId' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => ''], + 'NormalizationSecurityDomainId' => ['title' => '', 'type' => 'string', 'example' => 'NETWORK_AND_WEB_SECURITY', 'description' => ''], ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Set the default version of a normalization rule', + 'description' => 'Notifications are subject to frequency and time restrictions.'."\n" + .'Each user can receive a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time window.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'none', + 'ramAction' => [ + 'action' => 'yundun-sas:SetDefaultNormalizationRuleVersion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"DataSetRecordStatistic\\": {\\n \\"NewDataSetRecordCount\\": 12,\\n \\"UpdateDataSetRecordCount\\": 4\\n }\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"NormalizationRuleVersion\\": {\\n \\"CreateTime\\": 1733269771123,\\n \\"UpdateTime\\": 1733269771123,\\n \\"NormalizationRuleId\\": \\"nr-z0b2ssjteut85uoh9nzp\\",\\n \\"NormalizationRuleName\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleType\\": \\"predefined\\",\\n \\"NormalizationRuleFormat\\": \\"SPL\\",\\n \\"NormalizationRuleDescription\\": \\"normalization_rule_Z57np\\",\\n \\"NormalizationRuleVersion\\": 0,\\n \\"NormalizationRuleExpression\\": \\"* | pack-fields -include=\'[\\\\\\\\s\\\\\\\\S]+\' as extend_content\\",\\n \\"NormalizationRuleStatus\\": \\"started\\",\\n \\"NormalizationCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"NormalizationSchemaId\\": \\"HTTP_ACTIVITY\\",\\n \\"VendorId\\": \\"alibaba_cloud\\",\\n \\"ProductId\\": \\"alibaba_cloud_sas\\",\\n \\"NormalizationSecurityDomainId\\": \\"NETWORK_AND_WEB_SECURITY\\"\\n }\\n}","type":"json"}]', ], - 'DeleteDataSetRecord' => [ - 'summary' => '删除数据集记录', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateAlert' => [ + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -10813,317 +10234,356 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The data management center of the threat analysis feature. Specify this parameter based on the region where your assets reside. Valid values:'."\n" + .'- cn-hangzhou: the Chinese mainland and Hong Kong (China).'."\n" + .'- ap-southeast-1: regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DataSetId', + 'name' => 'AlertUuid', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dataset-10iy8mbifnb4gniv****', - ], + 'schema' => ['description' => 'The alert ID associated with the event.', 'type' => 'string', 'required' => false, 'example' => 'sas_71e24437d2797ce8fc59692905a4****', 'title' => ''], ], [ - 'name' => 'DataSetRecordIds', + 'name' => 'AlertStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => '[1,2,3,4]', - ], + 'schema' => ['description' => 'The alert status.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the user to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'RoleType', + 'in' => 'formData', + 'schema' => ['description' => 'The view type. Valid values:'."\n" + ."\n" + .'- 0: the current Alibaba Cloud account view.'."\n" + .'- 1: the view of all accounts in the enterprise.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'Schema of Response', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Update an alert', + 'summary' => 'Updates an alert.', + 'description' => 'Notifications are subject to frequency and time restrictions.'."\n" + .'Each user receives a maximum of two notifications per day between 08:00 and 20:00. No notifications are sent outside this time range.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], + 'ramActions' => [], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], - 'ListDataSetRecords' => [ - 'summary' => '获取数据集记录列表', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateAutoDisposeConfig' => [ + 'summary' => 'Updates the auto-dispose configuration.', + 'path' => '', + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'AutoDecisionStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'Specifies whether to enable auto decision. Valid values:'."\n" + ."\n" + .'- `enabled`: Enables auto decision.'."\n" + ."\n" + .'- `disabled`: Disables auto decision.', 'type' => 'string', 'required' => true, 'example' => 'enabled', 'title' => ''], + ], + [ + 'name' => 'ProductCode', + 'in' => 'formData', + 'schema' => ['description' => 'The code for the cloud product.', 'type' => 'string', 'required' => true, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'title' => '', + 'description' => 'The response body.', + 'example' => '', ], ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'UpdateAutoDisposeConfig', + 'description' => 'The `JsonConfig` parameter is a complex JSON configuration. See the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java) for helper utility classes and configuration examples.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'UpdateAutoDisposeRecord' => [ + 'summary' => 'Updates an automatic alert analysis record.', + 'path' => '', + 'methods' => ['post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'DataSetId', + 'AK' => [], + ], + ], + 'operationType' => 'readAndWrite', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas731ZAS'], + 'tenantRelevance' => 'tenant', + ], + 'parameters' => [ + [ + 'name' => 'AutoDisposeRecordId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dataset-nhcrmjpx1zsorlaq****', - ], + 'schema' => ['description' => 'The unique ID of the analysis record.', 'type' => 'string', 'required' => true, 'example' => '4227e0cdc4b7efb45ce7ff09758****', 'title' => ''], ], [ - 'name' => 'PageNumber', + 'name' => 'AutoDecisionConclusion', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['description' => 'The conclusion of the automatic alert analysis.', 'type' => 'string', 'required' => false, 'example' => '疑似误报', 'title' => ''], ], [ - 'name' => 'PageSize', + 'name' => 'Lang', + 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => true, 'example' => 'zh', 'title' => ''], + ], + [ + 'name' => 'AutoDecisionEntityList', + 'in' => 'formData', + 'schema' => ['description' => 'The list of entities for analysis.', 'type' => 'string', 'required' => false, 'example' => '[{"entityType":"file","entityName":"/path/file.file","entityUuid":"b7efb45ce7ff09758****","disposalMethod":"delete","playbookUuid":"9213bhdjagdja****"}]', 'title' => ''], + ], + [ + 'name' => 'AutoDecisionResult', 'in' => 'formData', + 'schema' => ['description' => 'The analysis result.', 'type' => 'string', 'required' => false, 'example' => 'success', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****'], + ], + 'title' => '', + 'description' => 'The returned data.', + 'example' => '', ], ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'UpdateAutoDisposeRecord', + 'description' => 'The AutoDecisionEntityList parameter is a JSON-formatted string. A helper class is available to simplify its creation. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', + ], + 'UpdateDataBatchIngestion' => [ + 'summary' => 'Updates a batch data ingestion task.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ + [ + 'AK' => [], + ], + ], + 'operationType' => 'read', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'get', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ + [ + 'name' => 'RegionId', + 'in' => 'formData', + 'schema' => ['description' => 'The region of the Data Management hub for threat analysis. Select a region for the management hub based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + [ + 'name' => 'Lang', + 'in' => 'formData', + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], + ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator wants to switch to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'LogUserIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', + 'description' => 'The list of user IDs for batch data ingestion.', + 'type' => 'array', + 'items' => ['description' => 'The user ID for batch data ingestion.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], 'required' => false, - 'example' => '50', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'NextToken', + 'name' => 'AutoScanNew', + 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether to automatically discover new users.'."\n" + ."\n" + .'- enabled: Enables the feature.'."\n" + ."\n" + .'- disabled: Disables the feature.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''], + ], + [ + 'name' => 'DataIngestionIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of ingestion policy IDs.', + 'type' => 'array', + 'items' => ['description' => 'The ingestion policy ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******', 'title' => ''], 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', + 'title' => '', + 'example' => '', ], ], + [ + 'name' => 'DataSourceRecognizeEnabled', + 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether to automatically discover new Logstores.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], + ], + [ + 'name' => 'DataBatchIngestionMode', + 'in' => 'formData', + 'schema' => ['description' => 'The mode for batch data ingestion. Valid values:'."\n" + ."\n" + .'- full'."\n" + ."\n" + .'- increment', 'type' => 'string', 'required' => false, 'example' => 'full', 'title' => ''], + ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'DataSetRecords' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1658974643000', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1658974643000', - ], - 'DataSetId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dataset-t8ha6p7k61rmniqw****', - ], - 'DataSetName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'lmftest', - ], - 'DataSetRecordId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '124566', - ], - 'DataSetRecordValues' => [ - 'description' => '', - 'type' => 'string', - 'example' => '{"ip":"10.0.*.*/8","region":"shanghai"}', - ], - ], - ], - ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataBatchIngestion', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class that contains configuration examples is provided to help you. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataBatchIngestion', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"DataSetRecords\\": [\\n {\\n \\"CreateTime\\": 1658974643000,\\n \\"UpdateTime\\": 1658974643000,\\n \\"DataSetId\\": \\"dataset-t8ha6p7k61rmniqw****\\",\\n \\"DataSetName\\": \\"lmftest\\",\\n \\"DataSetRecordId\\": \\"124566\\",\\n \\"DataSetRecordValues\\": \\"{\\\\\\"ip\\\\\\":\\\\\\"10.0.*.*/8\\\\\\",\\\\\\"region\\\\\\":\\\\\\"shanghai\\\\\\"}\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'CreateDetectionRule' => [ - 'summary' => '创建检测规则', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'UpdateDataIngestion' => [ + 'summary' => 'Updates a data ingestion policy.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -11132,438 +10592,476 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'], ], [ - 'name' => 'DetectionRuleName', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dr-ha1i09ob3zmqrs85****', - 'maxLength' => 100, - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can perform operations on behalf of this member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '173326*******'], ], [ - 'name' => 'DetectionRuleDescription', + 'name' => 'DataIngestionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'dr-123', - 'maxLength' => 2000, - ], + 'schema' => ['description' => 'The data ingestion ID.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******'], ], [ - 'name' => 'DetectionRuleType', + 'name' => 'DataIngestionMode', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'custom', - 'enum' => [ - 'custom', - ], - ], + 'schema' => ['description' => 'The data ingestion mode. Valid values:'."\n" + ."\n" + .'- realtime'."\n" + ."\n" + .'- scan', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'realtime'], ], [ - 'name' => 'DetectionRuleStatus', + 'name' => 'DataSourceId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['description' => 'The data source ID.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'alibaba_cloud_actiontrail_event_log_173326*******'], ], [ - 'name' => 'AlertType', + 'name' => 'NormalizationRuleId', 'in' => 'formData', + 'schema' => ['description' => 'The normalization rule ID.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'alibaba_cloud_actiontrail_event_rule'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'WebShell', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'example' => '', ], ], - [ - 'name' => 'AlertLevel', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => '1', - 'enum' => [ - '1', - '2', - '3', - '4', - '5', + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataIngestion', + 'description' => 'Notifications are subject to frequency and time limits. A maximum of two notifications are sent to each user per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataIngestion', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestion', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestion/{#DataIngestionId}'], ], ], ], + ], + ], + 'UpdateDataIngestionTemplate' => [ + 'summary' => 'Updates a data ingestion template.', + 'path' => '', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'AlertTacticId', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'TA0042', - ], + 'AK' => [], ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + 'tenantRelevance' => 'tenant', + ], + 'parameters' => [ [ - 'name' => 'AlertAttCk', + 'name' => 'DataIngestionTemplateId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'Discovery', - ], + 'schema' => ['description' => 'The ID of the data ingestion template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******', 'title' => ''], ], [ - 'name' => 'DetectionExpressionType', + 'name' => 'DataIngestionTemplateName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'enumValueTitles' => [ - 'sql' => 'sql', - 'playbook' => 'playbook', - ], - 'example' => 'sql', - 'enum' => [ - 'sql', - 'graphical', - 'playbook', - ], - ], + 'schema' => ['description' => 'The name of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion_173326*******', 'title' => ''], ], [ - 'name' => 'DetectionExpressionContent', + 'name' => 'NormalizationRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '*|set session mode=scan;SELECT * FROM log'."\n" - .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n" - .'AND ('."\n" - .' proc_path LIKE \'%/groups\''."\n" - .' OR ('."\n" - .' ('."\n" - .' proc_path LIKE \'%/cat\''."\n" - .' OR proc_path LIKE \'%/head\''."\n" - .' OR proc_path LIKE \'%/tail\''."\n" - .' OR proc_path LIKE \'%/more\''."\n" - .' )'."\n" - .' AND cmdline LIKE \'%/etc/group%\''."\n" - .' )'."\n" - .')'."\n", - ], + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_rule', 'title' => ''], ], [ - 'name' => 'LogCategoryId', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'LogSchemaId', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'API_RISK_ACTIVITY', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region for the management center based on the region of your asset. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'AlertSchemaId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'ALERT_ACTIVITY', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter is used by an administrator to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'ScheduleType', + 'name' => 'DataIngestionStatus', 'in' => 'formData', + 'schema' => ['description' => 'The status of data ingestion. Valid values:'."\n" + ."\n" + .'- enabled: Enabled.'."\n" + ."\n" + .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'fixed_rate', - 'enum' => [ - 'fixed_rate', - 'cron', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], - [ - 'name' => 'ScheduleExpression', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '0/5 * * * *', + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataIngestionTemplate', + 'description' => 'Frequency and time limits apply to notifications. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside of this time period.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataIngestionTemplate', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataIngestionTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:dataingestiontemplate/{#DataIngestionTemplateId}'], + ], ], ], + ], + ], + 'UpdateDataSet' => [ + 'summary' => 'Updates a dataset.', + 'methods' => ['post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'ScheduleMaxRetries', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'AK' => [], ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], + ], + 'parameters' => [ [ - 'name' => 'ScheduleBeginTime', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1733269771123', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets are in a region outside China.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cn-hangzhou'], ], [ - 'name' => 'ScheduleWindow', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '5m', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'zh'], ], [ - 'name' => 'ScheduleMaxTimeout', + 'name' => 'DataSetId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '60', - ], + 'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'title' => '', 'example' => 'dataset-10iy8mbifnb4gniv****'], ], [ - 'name' => 'AlertThresholdPeriod', + 'name' => 'DataSetDescription', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '5m', - ], + 'schema' => ['description' => 'The description of the dataset.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'title' => '', 'example' => 'lmftest desc'], ], [ - 'name' => 'AlertThresholdCount', + 'name' => 'IpWhitelistRecognizers', 'in' => 'formData', + 'style' => 'flat', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', + 'description' => 'The IP address types that the recognizer can detect.', + 'type' => 'array', + 'items' => [ + 'description' => 'The IP address types that the recognizer can detect.', + 'type' => 'object', + 'properties' => [ + 'IpWhitelistRecognizerType' => ['description' => 'The IP address type that the recognizer can detect. Valid values:'."\n" + ."\n" + .'- sas\\_vulnerability\\_scanner\\_ip: The IP addresses of the Security Center web vulnerability scanner.'."\n" + ."\n" + .'- waf\\_back\\_source\\_ip: The back-to-origin IP addresses of Web Application Firewall (WAF).'."\n" + ."\n" + .'- ddos\\_back\\_source\\_ip: The back-to-origin IP addresses of Anti-DDoS.'."\n" + ."\n" + .'- esa\\_back\\_source\\_ip: The back-to-origin IP addresses of Edge Security Acceleration (ESA) nodes.'."\n" + ."\n" + .'- ecs\\_public\\_ip: The public IP addresses of Elastic Compute Service (ECS) instances.'."\n" + ."\n" + .'- slb\\_public\\_ip: The public IP addresses of Server Load Balancer (SLB).'."\n" + ."\n" + .'- vpc\\_eip: The elastic IP addresses (EIPs).'."\n" + ."\n" + .'- cdn\\_back\\_source\\_ip: The back-to-origin IP addresses of Alibaba Cloud CDN.'."\n" + ."\n" + .'- ga\\_back\\_source\\_ip: The back-to-origin IP addresses of Global Accelerator (GA).', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'cdn_back_source_ip'], + 'AutoRecognizeStatus' => ['description' => 'The automatic detection status. Valid values:'."\n" + ."\n" + .'- enabled: Enabled.'."\n" + ."\n" + .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'enabled'], + 'RecognizeScope' => ['description' => 'The detection scope. Valid values:'."\n" + ."\n" + .'- current\\_account: The current account only.'."\n" + ."\n" + .'- rd\\_accounts: Multiple accounts are enabled.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'current_account'], + ], + 'required' => false, + 'title' => '', + 'example' => '', + ], 'required' => false, - 'example' => '10', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'AlertThresholdGroup', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alert_type,ip', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can use this parameter to switch to the member\'s view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'title' => '', 'example' => '113091674488****'], ], [ - 'name' => 'IncidentAggregationType', + 'name' => 'DataSetName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'window', - ], + 'schema' => ['type' => 'string', 'description' => 'The name of the dataset.', 'title' => '', 'required' => false, 'example' => 'lmftest'], ], [ - 'name' => 'IncidentAggregationExpression', + 'name' => 'DataSetFileName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '5m', - ], + 'schema' => ['type' => 'string', 'description' => 'The name of the uploaded dataset file.', 'title' => '', 'required' => false, 'example' => 'cloudsiem-dataset/1358117679873357_1743387731614.csv'], ], [ - 'name' => 'PlaybookUuid', + 'name' => 'DataSetStatus', 'in' => 'formData', + 'schema' => ['type' => 'integer', 'format' => 'int32', 'description' => 'The status of the dataset. Valid values:'."\n" + ."\n" + .'- 0: Delete.'."\n" + ."\n" + .'- 1: Enable.', 'title' => '', 'required' => false, 'example' => '1'], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'system_aliyun_clb_process_book', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'title' => '', 'example' => 'DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B'], + ], + 'example' => '', ], ], - [ - 'name' => 'PlaybookParameters', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '{'."\n" - .' "ip": {'."\n" - .' "ip": "124.23.*.*"'."\n" - .' }'."\n" - .'}', + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"DE7E77A9-BFAD-5EAA-9B48-A96760E9DF0B\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataSet', + 'description' => 'Notifications are limited by frequency and time. Each user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time range.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataSet', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSet', 'arn' => 'acs:yundun-sas::{#accountId}:dataset/{#DataSetId}'], + ], ], ], + ], + ], + 'UpdateDataSetRecord' => [ + 'summary' => 'Updates dataset records.', + 'methods' => ['post'], + 'schemes' => ['https'], + 'security' => [ + [ + 'AK' => [], + ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], + ], + 'parameters' => [ [ - 'name' => 'RoleFor', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. Select a region for the management center based on the region of your asset. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'EntityMappings', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DetectionRuleTemplateId', + 'name' => 'DataSetId', 'in' => 'formData', - 'schema' => [ - 'title' => '检测规则模板ID。', - 'type' => 'string', - 'example' => 'cfw-out-ip_aegis-netstat', - ], + 'schema' => ['description' => 'The ID of the dataset.', 'type' => 'string', 'required' => true, 'example' => 'dataset-10iy8mbifnb4gniv****', 'title' => ''], ], [ - 'name' => 'DetectionRuleTemplateVersion', + 'name' => 'DataSetRecords', 'in' => 'formData', - 'schema' => [ - 'title' => '检测规则模板版本。', - 'type' => 'string', - 'example' => 'v1.0.0', - ], + 'schema' => ['description' => 'The content of the dataset records, in JSON array format.', 'type' => 'string', 'required' => false, 'example' => '[{\\"ip\\":\\"1.1.1.1\\",\\"userid\\":\\"1234\\",\\"name\\":\\"a12401\\"},'."\n" + .' {\\"ip\\":\\"2.2.2.2\\",\\"userid\\":\\"33333\\",\\"name\\":\\"a12401\\"}]', 'title' => ''], ], [ - 'name' => 'AlertName', + 'name' => 'DataSetFileName', 'in' => 'formData', - 'schema' => [ - 'title' => '告警名称，支持使用$$引用查询输出字段', - 'type' => 'string', - ], + 'schema' => ['description' => 'The name of the uploaded dataset file.', 'type' => 'string', 'required' => false, 'example' => 'cloudsiem-dataset/1358117679873357_174338773****.csv', 'title' => ''], ], [ - 'name' => 'AlertDescription', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'title' => '告警描述，支持使用$$引用查询输出字段', - 'type' => 'string', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator can use this parameter to switch to the perspective of a specific member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '5CC09D0C-1CD7-54BD-A853-DCB2D945****', - ], - 'DetectionRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dr-ha1i09ob3zmqrs85****', + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', 'title' => ''], + 'DataSetRecordStatistic' => [ + 'description' => 'The result of the dataset update.', + 'type' => 'object', + 'properties' => [ + 'NewDataSetRecordCount' => ['description' => 'The number of new dataset records.', 'type' => 'integer', 'format' => 'int32', 'example' => '12', 'title' => ''], + 'UpdateDataSetRecordCount' => ['description' => 'The number of updated dataset records.', 'type' => 'integer', 'format' => 'int32', 'example' => '4', 'title' => ''], + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"DataSetRecordStatistic\\": {\\n \\"NewDataSetRecordCount\\": 12,\\n \\"UpdateDataSetRecordCount\\": 4\\n }\\n}","type":"json"}]', + 'title' => 'UpdateDataSetRecord', + 'description' => 'Notifications are subject to frequency and time limits. Each user can receive a maximum of two notifications per day between 08:00 and 20:00.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataSetRecord', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"5CC09D0C-1CD7-54BD-A853-DCB2D945****\\",\\n \\"DetectionRuleId\\": \\"dr-ha1i09ob3zmqrs85****\\"\\n}","type":"json"}]', ], - 'UpdateDetectionRule' => [ - 'summary' => '更新检测规则', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateDataSource' => [ + 'summary' => 'Updates a data source.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -11575,398 +11073,476 @@ 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select a region based on the location of the assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DetectionRuleId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'jndi-attack-success_http_dns', - ], + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator switches to.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DetectionRuleName', + 'name' => 'DataSourceId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'CTDR Port Scan Behavior', - 'maxLength' => 100, - ], + 'schema' => ['description' => 'The ID of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ds-014frtpy28m5ct2eoyo1', 'title' => ''], ], [ - 'name' => 'DetectionRuleDescription', + 'name' => 'DataSourceName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.', - 'maxLength' => 2000, - ], + 'schema' => ['description' => 'The name of the data source.', 'type' => 'string', 'required' => false, 'example' => 'ActiontrailLog', 'title' => ''], ], [ - 'name' => 'DetectionRuleType', + 'name' => 'LogUserId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'custom', - 'enum' => [ - 'custom', - 'preset', - 'custom_template', - ], - ], + 'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'DetectionRuleStatus', + 'name' => 'DataSourceStores', 'in' => 'formData', + 'style' => 'flat', 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'enabled', - 'enum' => [ - 'disabled', - 'enabled', - 'testing', + 'description' => 'The list of Simple Log Service Logstores.', + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'LogRegionId' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + 'LogProjectName' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], + 'LogStoreName' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'cn-rds-sqlaudit', 'title' => ''], + 'DataSourceStoreFrom' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], + 'DataSourceStoreId' => ['description' => 'The ID of the log storage.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], + ], + 'required' => false, + 'description' => 'A Simple Log Service Logstore.', + 'title' => '', + 'example' => '', ], + 'required' => false, + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'AlertType', + 'name' => 'DataSourceRecognizeEnabled', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'siem_rule_type_alert_storm', - ], + 'schema' => ['description' => 'Specifies whether to automatically discover new Logstores.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], ], [ - 'name' => 'AlertLevel', + 'name' => 'DataSourceFrom', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The source of the data. Valid values:'."\n" + ."\n" + .'- center'."\n" + ."\n" + .'- custom', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], ], [ - 'name' => 'AlertTacticId', + 'name' => 'OrderField', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'TA0042', - ], + 'schema' => ['description' => 'The field to use for sorting the rule list. Valid values:'."\n" + ."\n" + .'- GmtModified: Sorts the list by modification time.'."\n" + ."\n" + .'- Id: Sorts the list by rule ID. This is the default value.', 'type' => 'string', 'required' => false, 'example' => 'Id', 'title' => ''], ], [ - 'name' => 'AlertAttCk', + 'name' => 'LogStoreName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'Discovery', - ], + 'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'cn-rds-sqlaudit', 'title' => ''], ], [ - 'name' => 'DetectionExpressionType', + 'name' => 'LogProjectName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'sql', - ], + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], ], [ - 'name' => 'DetectionExpressionContent', + 'name' => 'LogRegionId', 'in' => 'formData', + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '*|set session mode=scan;SELECT * FROM log'."\n" - .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n" - .'AND ('."\n" - .' proc_path LIKE \'%/groups\''."\n" - .' OR ('."\n" - .' ('."\n" - .' proc_path LIKE \'%/cat\''."\n" - .' OR proc_path LIKE \'%/head\''."\n" - .' OR proc_path LIKE \'%/tail\''."\n" - .' OR proc_path LIKE \'%/more\''."\n" - .' )'."\n" - .' AND cmdline LIKE \'%/etc/group%\''."\n" - .' )'."\n" - .')', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'example' => '', + ], + ], + ], + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataSource', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataSource', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSource', 'arn' => 'acs:yundun-sas::{#accountId}:datasource/{#DataSourceId}'], + ], ], ], + ], + ], + 'UpdateDataSourceTemplate' => [ + 'summary' => 'Modifies a data source template.', + 'path' => '', + 'methods' => ['get', 'post'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'LogCategoryId', + 'AK' => [], + ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + 'tenantRelevance' => 'tenant', + ], + 'parameters' => [ + [ + 'name' => 'DataSourceTemplateId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY', - ], + 'schema' => ['description' => 'The ID of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion'."\n", 'title' => ''], ], [ - 'name' => 'LogSchemaId', + 'name' => 'DataSourceTemplateName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'API_RISK_ACTIVITY', - ], + 'schema' => ['description' => 'The name of the data source template.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_actiontrail_event_ingestion'."\n", 'title' => ''], ], [ - 'name' => 'AlertSchemaId', + 'name' => 'LogUserIds', 'in' => 'formData', + 'style' => 'simple', 'schema' => [ - 'description' => '', - 'type' => 'string', + 'description' => 'The list of user IDs for batch data access.', + 'type' => 'array', + 'items' => ['description' => 'The user ID for batch data access.', 'type' => 'string', 'required' => false, 'example' => '173326*******', 'title' => ''], 'required' => false, - 'example' => 'ALERT_ACTIVITY', + 'title' => '', + 'example' => '', ], ], [ - 'name' => 'ScheduleType', + 'name' => 'LogRegionIds', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'fixed_rate', - ], + 'schema' => ['description' => 'The list of IDs of log storage regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'ScheduleExpression', + 'name' => 'LogProjectPattern', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1h', - ], + 'schema' => ['description' => 'The matching rule for the names of Simple Log Service projects.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******', 'title' => ''], ], [ - 'name' => 'ScheduleMaxRetries', + 'name' => 'LogStorePattern', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The matching rule for the names of Simple Log Service Logstores.', 'type' => 'string', 'required' => false, 'example' => 'audit-activity', 'title' => ''], ], [ - 'name' => 'ScheduleBeginTime', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1733269771123', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'ScheduleWindow', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '5m', - ], + 'schema' => ['description' => 'The region where the Management Hub of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Assets are outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'ScheduleMaxTimeout', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '60', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter lets an administrator switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'AlertThresholdPeriod', + 'name' => 'AutoScanNew', 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether to automatically discover new users.'."\n" + ."\n" + .'- enabled: Enabled.'."\n" + ."\n" + .'- disabled: Disabled.', 'type' => 'string', 'required' => false, 'example' => 'enabled', 'title' => ''], + ], + [ + 'name' => 'DataSourceRecognizeEnabled', + 'in' => 'query', + 'schema' => ['description' => 'Specifies whether to automatically discover new data sources.', 'type' => 'boolean', 'required' => false, 'example' => 'true', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '5m', + 'title' => 'Schema of Response', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'example' => '', + ], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataSourceTemplate', + 'description' => 'The JsonConfig input parameter accepts a complex JSON configuration. To simplify this process, a supporting tool class is available. For more information, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataSourceTemplate', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DataSourceTemplate', 'arn' => 'acs:yundun-sas::{#accountId}:datasourcetemplate/{#DataSourceTemplateId}'], + ], ], ], + ], + ], + 'UpdateDataStorage' => [ + 'summary' => 'Changes the log storage region for Log Management.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'AlertThresholdCount', + 'AK' => [], + ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], + 'tenantRelevance' => 'publicInformation', + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '10', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is located. This region must be the same as the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The assets are in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'AlertThresholdGroup', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'alert_type,ip', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'IncidentAggregationType', + 'name' => 'DataStorageRegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'window', - ], + 'schema' => ['description' => 'The log storage region.', 'type' => 'string', 'required' => true, 'example' => 'cn-shanghai', 'title' => ''], ], [ - 'name' => 'IncidentAggregationExpression', + 'name' => 'DeliveryStatus', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '60m', - ], + 'schema' => ['description' => 'The global switch for log delivery in Log Management. This parameter is not yet available. Valid values:'."\n" + ."\n" + .'- enable: Enables global delivery.'."\n" + ."\n" + .'- disable: Disables global delivery.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'example' => 'enable', 'title' => ''], ], [ - 'name' => 'PlaybookParameters', + 'name' => 'RoleFor', 'in' => 'formData', + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '{'."\n" - .' "ip": {'."\n" - .' "ip": "124.23.*.*"'."\n" - .' }'."\n" - .'}', + 'title' => 'BaseResponse', + 'description' => 'The response body.', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => 'EA7FC160-8D86-5ABE-A08A-7962FDC1****', 'title' => ''], + ], + 'example' => '', + ], + ], + ], + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"EA7FC160-8D86-5ABE-A08A-7962FDC1****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataStorage', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataStorage', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], + ], + ], + 'UpdateDataStorageDelivery' => [ + 'summary' => 'Updates the status of log delivery.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'PlaybookUuid', + 'AK' => [], + ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], + 'autoTest' => true, + 'tenantRelevance' => 'tenant', + ], + 'parameters' => [ + [ + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '31568394-7a86-487c-b8ec-b3f42b59****', - ], + 'schema' => ['description' => 'The region where the Data Management hub for Threat Analysis is located. Select the region of the management hub based on the region of your asset. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your asset is in a region outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'EntityMappings', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]', - ], + 'schema' => ['description' => 'The language of the response message. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'AlertName', + 'name' => 'LogCode', 'in' => 'formData', - 'schema' => [ - 'title' => '告警名称，支持使用$$引用查询输出字段', - 'type' => 'string', - ], + 'schema' => ['description' => 'The log code.', 'type' => 'string', 'required' => true, 'example' => 'aegis-log-login', 'title' => ''], ], [ - 'name' => 'AlertDescription', + 'name' => 'LogDeliveryStatus', 'in' => 'formData', - 'schema' => [ - 'title' => '告警描述，支持使用$$引用查询输出字段', - 'type' => 'string', - ], + 'schema' => ['description' => 'The status of log delivery. Valid values:'."\n" + ."\n" + .'- enable: Enables log delivery.'."\n" + ."\n" + .'- disable: Disables log delivery.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'example' => 'enable', 'title' => ''], + ], + [ + 'name' => 'RoleFor', + 'in' => 'formData', + 'schema' => ['description' => 'The user ID of the member. This parameter is used when an administrator switches to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => 'BaseResponse', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'B88A2D41-87B8-537E-A7D3-3416A39F****', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'example' => '6D7FBF4A-5B95-5760-8B5A-BF8983D4****', 'title' => ''], ], + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6D7FBF4A-5B95-5760-8B5A-BF8983D4****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataStorageDelivery', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataStorageDelivery', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"B88A2D41-87B8-537E-A7D3-3416A39F****\\"\\n}","type":"json"}]', ], - 'DeleteDetectionRule' => [ - 'summary' => '删除检测规则', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateDataStorageTtl' => [ + 'summary' => 'Modifies the storage duration for logs.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -11975,1404 +11551,829 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'delete', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsasRXJ9SY'], + 'autoTest' => true, + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management Center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DetectionRuleId', + 'name' => 'LogStoreName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'dr-53np4nguf5jmh1vc****', - ], + 'schema' => ['description' => 'The name of the Logstore for threat analysis.', 'type' => 'string', 'required' => false, 'maxLength' => 1000, 'example' => 'network-activity', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member whose perspective the administrator assumes.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], + ], + [ + 'name' => 'LogStoreTtl', + 'in' => 'formData', + 'schema' => ['description' => 'The storage duration of the Logstore.', 'type' => 'string', 'required' => false, 'example' => '180', 'title' => ''], + ], + [ + 'name' => 'LogStoreHotTtl', + 'in' => 'formData', + 'schema' => ['description' => 'The storage duration for hot storage in Simple Log Service.', 'type' => 'string', 'required' => false, 'example' => '180', 'title' => ''], + ], + [ + 'name' => 'LogStoreColdTtl', + 'in' => 'formData', + 'schema' => ['description' => 'The storage duration for cold storage in Simple Log Service. This setting is not yet available.', 'type' => 'string', 'required' => false, 'example' => '0', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => 'BaseResponse', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => 'D92E4FCF-4584-5E50-9C02-26B79A9C****', 'title' => ''], ], + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"D92E4FCF-4584-5E50-9C02-26B79A9C****\\"\\n}","type":"json"}]', + 'title' => 'UpdateDataStorageTtl', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDataStorageTtl', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\"\\n}","type":"json"}]', ], - 'ListDetectionRules' => [ - 'summary' => '获取检测规则列表', - 'methods' => [ - 'post', - 'get', - ], - 'schemes' => [ - 'https', - ], + 'UpdateDetectionRule' => [ + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsasASHGE7'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center for Threat Analysis. Select the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'DetectionRuleName', + 'name' => 'DetectionRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'Detect Discovery Behavior for Local Systems Groups', - ], + 'schema' => ['description' => 'The ID of the detection rule.', 'type' => 'string', 'required' => true, 'maxLength' => 128, 'example' => 'jndi-attack-success_http_dns', 'title' => ''], ], [ - 'name' => 'DetectionRuleId', + 'name' => 'DetectionRuleName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'dr-ppa85gfw69tgwkys****', - ], + 'schema' => ['description' => 'The name of the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'CTDR Port Scan Behavior', 'maxLength' => 100, 'title' => ''], ], [ - 'name' => 'DetectionRuleIds', + 'name' => 'DetectionRuleDescription', 'in' => 'formData', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'dr-ppa85gfw69tgwkys****'."\n", - ], - 'required' => false, - ], + 'schema' => ['description' => 'The description of the detection rule.', 'type' => 'string', 'maxLength' => 2000, 'required' => false, 'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.', 'title' => ''], ], [ 'name' => 'DetectionRuleType', 'in' => 'formData', 'schema' => [ - 'description' => '', + 'description' => 'The type of the detection rule. Valid values:'."\n" + ."\n" + .'- preset: a preset detection rule.'."\n" + ."\n" + .'- custom: a custom detection rule.'."\n" + ."\n" + .'- custom\\_template: a rule template.', 'type' => 'string', - 'required' => false, - 'example' => 'preset', + 'required' => true, + 'enum' => ['custom', 'preset', 'custom_template'], + 'example' => 'custom', + 'title' => '', ], ], [ 'name' => 'DetectionRuleStatus', 'in' => 'formData', 'schema' => [ - 'description' => '', + 'description' => 'The status of the detection rule.', 'type' => 'string', + 'enum' => ['disabled', 'enabled', 'testing'], 'required' => false, 'example' => 'enabled', + 'title' => '', ], ], [ 'name' => 'AlertType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'siem_rule_type_alert_storm', - ], + 'schema' => ['description' => 'The type of the alert.', 'type' => 'string', 'required' => false, 'example' => 'siem_rule_type_alert_storm', 'title' => ''], ], [ 'name' => 'AlertLevel', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The threat level of the alert. Valid values:'."\n" + ."\n" + .'- 5: Critical.'."\n" + ."\n" + .'- 4: Important.'."\n" + ."\n" + .'- 3: Medium.'."\n" + ."\n" + .'- 2: Low.'."\n" + ."\n" + .'- 1: Informational.', 'type' => 'string', 'required' => false, 'example' => '1', 'title' => ''], ], [ 'name' => 'AlertTacticId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'TA0042', - ], + 'schema' => ['description' => 'The ATT\\&CK tactic ID of the alert.', 'type' => 'string', 'required' => false, 'example' => 'TA0042', 'title' => ''], ], [ 'name' => 'AlertAttCk', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'Discovery', - ], + 'schema' => ['description' => 'The ATT\\&CK tactic of the alert.', 'type' => 'string', 'required' => false, 'example' => 'Discovery', 'title' => ''], ], [ - 'name' => 'IncidentAggregationType', + 'name' => 'DetectionExpressionType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'graph_compute', - ], + 'schema' => ['description' => 'The type of the detection expression.', 'type' => 'string', 'required' => false, 'example' => 'sql', 'title' => ''], + ], + [ + 'name' => 'DetectionExpressionContent', + 'in' => 'formData', + 'schema' => ['description' => 'The content of the detection expression.', 'type' => 'string', 'required' => false, 'example' => '*|set session mode=scan;SELECT * FROM log'."\n" + .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n" + .'AND ('."\n" + .' proc_path LIKE \'%/groups\''."\n" + .' OR ('."\n" + .' ('."\n" + .' proc_path LIKE \'%/cat\''."\n" + .' OR proc_path LIKE \'%/head\''."\n" + .' OR proc_path LIKE \'%/tail\''."\n" + .' OR proc_path LIKE \'%/more\''."\n" + .' )'."\n" + .' AND cmdline LIKE \'%/etc/group%\''."\n" + .' )'."\n" + .')', 'title' => ''], ], [ 'name' => 'LogCategoryId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'NETWORK_CATEGORY', - ], + 'schema' => ['description' => 'The ID of the log normalization category.', 'type' => 'string', 'required' => false, 'example' => 'NETWORK_CATEGORY', 'title' => ''], ], [ 'name' => 'LogSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'API_RISK_ACTIVITY', - ], + 'schema' => ['description' => 'The ID of the log normalization schema.', 'type' => 'string', 'required' => false, 'example' => 'API_RISK_ACTIVITY', 'title' => ''], ], [ - 'name' => 'DetectionExpressionType', + 'name' => 'AlertSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'playbook', - ], + 'schema' => ['description' => 'The ID of the alert template for the detection rule.', 'type' => 'string', 'required' => false, 'example' => 'ALERT_ACTIVITY', 'title' => ''], ], [ - 'name' => 'OrderFieldName', + 'name' => 'ScheduleType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'GmtModified', - ], + 'schema' => ['description' => 'The scheduling type. Valid values:'."\n" + ."\n" + .'- fixed\\_rate: fixed interval.'."\n" + ."\n" + .'- cron: cron expression.', 'type' => 'string', 'required' => false, 'example' => 'fixed_rate', 'title' => ''], ], [ - 'name' => 'OrderDirection', + 'name' => 'ScheduleExpression', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'asc', - ], + 'schema' => ['description' => 'The cron expression for scheduling. This parameter is required when you set ScheduleType to cron.', 'type' => 'string', 'required' => false, 'example' => '1h', 'title' => ''], ], [ - 'name' => 'PageNumber', + 'name' => 'ScheduleMaxRetries', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['description' => 'The maximum number of retries after a timeout. The value must be between 1 and 100.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], ], [ - 'name' => 'PageSize', + 'name' => 'ScheduleBeginTime', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '100', - ], + 'schema' => ['description' => 'The start time for scheduling. This is a 13-digit UNIX timestamp.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'ScheduleWindow', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The length of the scheduling window.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'ScheduleMaxTimeout', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '50', - ], + 'schema' => ['description' => 'The maximum timeout period. Unit: seconds. The value must be between 60 and 1800.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '60', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'AlertThresholdPeriod', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'schema' => ['description' => 'The period for the alert threshold.', 'type' => 'string', 'required' => false, 'example' => '5m', 'title' => ''], + ], + [ + 'name' => 'AlertThresholdCount', + 'in' => 'formData', + 'schema' => ['description' => 'The number of alerts for the alert threshold.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '10', 'title' => ''], + ], + [ + 'name' => 'AlertThresholdGroup', + 'in' => 'formData', + 'schema' => ['description' => 'The fields for the alert threshold. Separate multiple fields with commas.', 'type' => 'string', 'required' => false, 'example' => 'alert_type,ip', 'title' => ''], + ], + [ + 'name' => 'IncidentAggregationType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of event aggregation. Valid values:'."\n" + ."\n" + .'- none: Events are not generated.'."\n" + ."\n" + .'- graph\\_compute: graph computing (supported by predefined rules).'."\n" + ."\n" + .'- expert: expert rule.'."\n" + ."\n" + .'- passthrough: pass-through (one-to-one mapping with alerts).'."\n" + ."\n" + .'- window: window-based aggregation of similar events.', 'type' => 'string', 'required' => false, 'example' => 'window', 'title' => ''], + ], + [ + 'name' => 'IncidentAggregationExpression', + 'in' => 'formData', + 'schema' => ['description' => 'The configuration of the event aggregation period.', 'type' => 'string', 'required' => false, 'example' => '60m', 'title' => ''], + ], + [ + 'name' => 'PlaybookParameters', + 'in' => 'formData', + 'schema' => ['description' => 'The custom parameters for the playbook.', 'type' => 'string', 'required' => false, 'example' => '{'."\n" + .' "ip": {'."\n" + .' "ip": "124.23.*.*"'."\n" + .' }'."\n" + .'}', 'title' => ''], + ], + [ + 'name' => 'PlaybookUuid', + 'in' => 'formData', + 'schema' => ['description' => 'The unique ID of the playbook.', 'type' => 'string', 'required' => false, 'example' => '31568394-7a86-487c-b8ec-b3f42b59****', 'title' => ''], + ], + [ + 'name' => 'EntityMappings', + 'in' => 'formData', + 'schema' => ['description' => 'The entity mapping configuration.', 'type' => 'string', 'required' => false, 'example' => '[{\\"NormalizationSchemaId\\":\\"host\\",\\"NormalizationFieldMappings\\":[{\\"NormalizationFieldName\\":\\"uuid\\",\\"MappingFieldName\\":\\"host\\",\\"NormalizationFieldType\\":\\"varchar\\"}]}]', 'title' => ''], + ], + [ + 'name' => 'AlertName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the alert. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Detected high-frequency multi-type network attacks from $src_ip$'], + ], + [ + 'name' => 'AlertDescription', + 'in' => 'formData', + 'schema' => ['description' => 'The description of the alert. You can use $$ to reference fields from the query output.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$'], + ], + [ + 'name' => 'AlertTypeMapping', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + [ + 'name' => 'AlertLevelMapping', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], + ], + [ + 'name' => 'AlertAttCkMapping', + 'in' => 'formData', + 'schema' => ['type' => 'string', 'description' => '', 'title' => '', 'example' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '508DCFFD-4508-54BF-A8A0-E97A0FA6****', - ], - 'DetectionRules' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '2023-03-21 13:47:01', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '2023-04-16 10:51:00', - ], - 'DetectionRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'jndi-attack-success_http_netstat', - ], - 'DetectionRuleName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Detect Discovery Behavior for Local Systems Groups'."\n", - ], - 'DetectionRuleDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.', - ], - 'DetectionRuleType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'custom', - ], - 'DetectionRuleStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'enabled', - ], - 'DetectionExpressionType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'playbook', - ], - 'DetectionExpressionContent' => [ - 'description' => '', - 'type' => 'string', - 'example' => '*|set session mode=scan;SELECT * FROM log'."\n" - .'WHERE schema = \'PROCESS_START_ACTIVITY\''."\n" - .'AND ('."\n" - .' proc_path LIKE \'%/groups\''."\n" - .' OR ('."\n" - .' ('."\n" - .' proc_path LIKE \'%/cat\''."\n" - .' OR proc_path LIKE \'%/head\''."\n" - .' OR proc_path LIKE \'%/tail\''."\n" - .' OR proc_path LIKE \'%/more\''."\n" - .' )'."\n" - .' AND cmdline LIKE \'%/etc/group%\''."\n" - .' )'."\n" - .')', - ], - 'LogCategoryId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'NETWORK_CATEGORY', - ], - 'LogSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'API_RISK_ACTIVITY', - ], - 'AlertSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ALERT_ACTIVITY', - ], - 'ScheduleType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'fixed_rate', - ], - 'ScheduleExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '5m', - ], - 'ScheduleMaxRetries' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'ScheduleBeginTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1733269771123', - ], - 'ScheduleWindow' => [ - 'description' => '', - 'type' => 'string', - 'example' => '5m', - ], - 'ScheduleMaxTimeout' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '60', - ], - 'AlertType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'WebShell', - ], - 'AlertLevel' => [ - 'description' => '', - 'type' => 'string', - 'example' => '1', - ], - 'AlertTacticId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'TA0042', - ], - 'AlertAttCk' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Discovery', - ], - 'AlertThresholdPeriod' => [ - 'description' => '', - 'type' => 'string', - 'example' => '5m', - ], - 'AlertThresholdCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'AlertThresholdGroup' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'alert_type,ip', - ], - 'IncidentAggregationType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'passthrough', - ], - 'IncidentAggregationExpression' => [ - 'description' => '', - 'type' => 'string', - 'example' => '5m', - ], - 'PlaybookUuid' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dde983ed-eb56-45ea-ac2e-3b12b2a9****', - ], - 'PlaybookParameters' => [ - 'description' => '', - 'type' => 'string', - 'example' => '{'."\n" - .' "ip": {'."\n" - .' "ip": "124.23.*.*"'."\n" - .' }'."\n" - .'}', - ], - 'Playbook' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'Flow' => [ - 'description' => '', - 'type' => 'string', - 'example' => '['."\n" - .' {'."\n" - .' "id": "EndEvent_1fqpq4h",'."\n" - .' "zIndex": 1,'."\n" - .' "data": {'."\n" - .' "nodeType": "endEvent",'."\n" - .' "appType": "basic",'."\n" - .' "valueData": {'."\n" - ."\n" - .' },'."\n" - .' "icon": "icon-radio-off-full"'."\n" - .' },'."\n" - .' "position": {'."\n" - .' "x": 1369,'."\n" - .' "y": 174'."\n" - .' }'."\n" - .' }'."\n" - .']', - ], - 'Config' => [ - 'description' => '', - 'type' => 'string', - 'example' => '['."\n" - .' {'."\n" - .' "name": "expireDay",'."\n" - .' "dataType": "Integer",'."\n" - .' "required": true,'."\n" - .' "isArray": false,'."\n" - .' "example": "7",'."\n" - .' "description": "desc",'."\n" - .' "typeName": "Integer",'."\n" - .' "dataClass": "normal",'."\n" - .' "stanchDefaultValue": "7"'."\n" - .' }'."\n" - .']', - ], - ], - ], - 'EntityMappings' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationSchemaId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ip', - ], - 'NormalizationFieldMappings' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'src_ip', - ], - 'MappingFieldName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ip', - ], - 'NormalizationFieldType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'vachar', - ], - ], - ], - ], - ], - ], - ], - 'AlertName' => [ - 'type' => 'string', - ], - 'AlertDescription' => [ - 'type' => 'string', - ], - ], - ], - ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '6', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'RequestId' => ['description' => 'The ID of the request.', 'type' => 'string', 'example' => 'B88A2D41-87B8-537E-A7D3-3416A39F****', 'title' => ''], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'UpdateDetectionRule', + 'summary' => 'Updates a detection rule.', + 'description' => 'Because this operation uses complex request parameters, a supporting tool class is provided to assist with the JSON configuration. For an example, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateDetectionRule', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'DetectionRule', 'arn' => 'acs:yundun-sas::{#accountId}:detection/{#DetectionRuleId}'], + ], ], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"508DCFFD-4508-54BF-A8A0-E97A0FA6****\\",\\n \\"DetectionRules\\": [\\n {\\n \\"CreateTime\\": 0,\\n \\"UpdateTime\\": 0,\\n \\"DetectionRuleId\\": \\"jndi-attack-success_http_netstat\\",\\n \\"DetectionRuleName\\": \\"Detect Discovery Behavior for Local Systems Groups\\\\n\\",\\n \\"DetectionRuleDescription\\": \\"Check the enumeration behavior of local system groups. An attacker may attempt to find the Local Systems group and its permission settings.\\",\\n \\"DetectionRuleType\\": \\"custom\\",\\n \\"DetectionRuleStatus\\": \\"enabled\\",\\n \\"DetectionExpressionType\\": \\"playbook\\",\\n \\"DetectionExpressionContent\\": \\"*|set session mode=scan;SELECT * FROM log\\\\nWHERE schema = \'PROCESS_START_ACTIVITY\'\\\\nAND (\\\\n proc_path LIKE \'%/groups\'\\\\n OR (\\\\n (\\\\n proc_path LIKE \'%/cat\'\\\\n OR proc_path LIKE \'%/head\'\\\\n OR proc_path LIKE \'%/tail\'\\\\n OR proc_path LIKE \'%/more\'\\\\n )\\\\n AND cmdline LIKE \'%/etc/group%\'\\\\n )\\\\n)\\",\\n \\"LogCategoryId\\": \\"NETWORK_CATEGORY\\",\\n \\"LogSchemaId\\": \\"API_RISK_ACTIVITY\\",\\n \\"AlertSchemaId\\": \\"ALERT_ACTIVITY\\",\\n \\"ScheduleType\\": \\"fixed_rate\\",\\n \\"ScheduleExpression\\": \\"5m\\",\\n \\"ScheduleMaxRetries\\": 1,\\n \\"ScheduleBeginTime\\": 1733269771123,\\n \\"ScheduleWindow\\": \\"5m\\",\\n \\"ScheduleMaxTimeout\\": 60,\\n \\"AlertType\\": \\"WebShell\\",\\n \\"AlertLevel\\": \\"1\\",\\n \\"AlertTacticId\\": \\"TA0042\\",\\n \\"AlertAttCk\\": \\"Discovery\\",\\n \\"AlertThresholdPeriod\\": \\"5m\\",\\n \\"AlertThresholdCount\\": 10,\\n \\"AlertThresholdGroup\\": \\"alert_type,ip\\",\\n \\"IncidentAggregationType\\": \\"passthrough\\",\\n \\"IncidentAggregationExpression\\": \\"5m\\",\\n \\"PlaybookUuid\\": \\"dde983ed-eb56-45ea-ac2e-3b12b2a9****\\",\\n \\"PlaybookParameters\\": \\"{\\\\n \\\\\\"ip\\\\\\": {\\\\n \\\\\\"ip\\\\\\": \\\\\\"124.23.*.*\\\\\\"\\\\n }\\\\n}\\",\\n \\"Playbook\\": {\\n \\"Flow\\": \\"[\\\\n {\\\\n \\\\\\"id\\\\\\": \\\\\\"EndEvent_1fqpq4h\\\\\\",\\\\n \\\\\\"zIndex\\\\\\": 1,\\\\n \\\\\\"data\\\\\\": {\\\\n \\\\\\"nodeType\\\\\\": \\\\\\"endEvent\\\\\\",\\\\n \\\\\\"appType\\\\\\": \\\\\\"basic\\\\\\",\\\\n \\\\\\"valueData\\\\\\": {\\\\n\\\\n },\\\\n \\\\\\"icon\\\\\\": \\\\\\"icon-radio-off-full\\\\\\"\\\\n },\\\\n \\\\\\"position\\\\\\": {\\\\n \\\\\\"x\\\\\\": 1369,\\\\n \\\\\\"y\\\\\\": 174\\\\n }\\\\n }\\\\n]\\",\\n \\"Config\\": \\"[\\\\n {\\\\n \\\\\\"name\\\\\\": \\\\\\"expireDay\\\\\\",\\\\n \\\\\\"dataType\\\\\\": \\\\\\"Integer\\\\\\",\\\\n \\\\\\"required\\\\\\": true,\\\\n \\\\\\"isArray\\\\\\": false,\\\\n \\\\\\"example\\\\\\": \\\\\\"7\\\\\\",\\\\n \\\\\\"description\\\\\\": \\\\\\"desc\\\\\\",\\\\n \\\\\\"typeName\\\\\\": \\\\\\"Integer\\\\\\",\\\\n \\\\\\"dataClass\\\\\\": \\\\\\"normal\\\\\\",\\\\n \\\\\\"stanchDefaultValue\\\\\\": \\\\\\"7\\\\\\"\\\\n }\\\\n]\\"\\n },\\n \\"EntityMappings\\": [\\n {\\n \\"NormalizationSchemaId\\": \\"ip\\",\\n \\"NormalizationFieldMappings\\": [\\n {\\n \\"NormalizationFieldName\\": \\"src_ip\\",\\n \\"MappingFieldName\\": \\"ip\\",\\n \\"NormalizationFieldType\\": \\"vachar\\"\\n }\\n ]\\n }\\n ],\\n \\"AlertName\\": \\"Detected high-frequency multi-type network attacks from $src_ip$\\",\\n \\"AlertDescription\\": \\"Alert from: $product_code$, detected network attack from $src_ip$, affected assets include: $dst_ip$\\"\\n }\\n ],\\n \\"PageNumber\\": 2,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 6,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"B88A2D41-87B8-537E-A7D3-3416A39F****\\"\\n}","type":"json"}]', ], - 'GetDetectionStatistic' => [ - 'summary' => '更新检测规则', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateNormalizationRule' => [ + 'summary' => 'Updates a normalization rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the Data Management center of threat analysis is located. Select a region based on the region where your assets are located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: an asset in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: an asset outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the content within the request and response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of a member. This parameter is used when an administrator switches to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], - ], - 'responses' => [ - 200 => [ - 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6FB890AC-90B2-5EEA-845B-F7C86FB2****', - ], - 'DetectionStatistic' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'DetectionRuleOnlineCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'DetectionRuleTestCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '5', - ], - 'DetectionRuleTemplateCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '20', - ], - 'GraphComputeRuleCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '12', - ], - 'WindowRuleCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '6', - ], - 'PassthroughRuleCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - ], - ], - ], - ], + [ + 'name' => 'NormalizationRuleId', + 'in' => 'formData', + 'schema' => ['description' => 'The ID of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'nr-z0b2ssjteut85uoh9nzp', 'title' => ''], ], - ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + [ + 'name' => 'NormalizationRuleName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''], ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', - ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6FB890AC-90B2-5EEA-845B-F7C86FB2****\\",\\n \\"DetectionStatistic\\": {\\n \\"DetectionRuleOnlineCount\\": 10,\\n \\"DetectionRuleTestCount\\": 5,\\n \\"DetectionRuleTemplateCount\\": 20,\\n \\"GraphComputeRuleCount\\": 12,\\n \\"WindowRuleCount\\": 6,\\n \\"PassthroughRuleCount\\": 2\\n }\\n}","type":"json"}]', - ], - 'GetIncident' => [ - 'summary' => '获取事件列表', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], - 'security' => [ [ - 'AK' => [], + 'name' => 'NormalizationRuleDescription', + 'in' => 'formData', + 'schema' => ['description' => 'The description of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'normalization_rule_Z57np', 'title' => ''], ], - ], - 'operationType' => 'read', - 'deprecated' => false, - 'systemTags' => [ - 'operationType' => 'get', - 'riskType' => 'none', - 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', + [ + 'name' => 'NormalizationRuleFormat', + 'in' => 'formData', + 'schema' => ['description' => 'The format of the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'SPL', 'title' => ''], ], - ], - 'parameters' => [ [ - 'name' => 'RegionId', + 'name' => 'NormalizationRuleExpression', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The expression for the normalization rule.', 'type' => 'string', 'required' => false, 'example' => '* | pack-fields -include=\'[\\s\\S]+\' as extend_content', 'title' => ''], ], [ - 'name' => 'Lang', + 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The ID of the normalization structure.', 'type' => 'string', 'required' => false, 'example' => 'HTTP_ACTIVITY', 'title' => ''], ], [ - 'name' => 'IncidentUuid', + 'name' => 'VendorId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], + 'schema' => ['description' => 'The vendor ID that corresponds to the normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'ProductId', + 'in' => 'formData', + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleMode', + 'in' => 'formData', + 'schema' => ['description' => 'The mode of the normalization rule. Valid values:'."\n" + ."\n" + .'- both'."\n" + ."\n" + .'- scan'."\n" + ."\n" + .'- realtime', 'type' => 'string', 'required' => false, 'example' => 'both', 'title' => ''], + ], + [ + 'name' => 'ExtendContentPacked', 'in' => 'formData', + 'schema' => ['description' => 'Specifies whether to package non-standard fields into the extend\\_content extension field. Valid values:'."\n" + ."\n" + .'- enabled: The feature is enabled.'."\n" + ."\n" + .'- disabled: The feature is disabled.', 'type' => 'string', 'title' => '', 'required' => false, 'example' => 'enabled'], + ], + [ + 'name' => 'OrderField', + 'in' => 'formData', + 'schema' => ['description' => 'The field to use for sorting the rule list. Valid values:'."\n" + ."\n" + .'- GmtModified: Sorts by modification time.'."\n" + ."\n" + .'- Id: Sorts by rule ID (default).', 'type' => 'string', 'required' => false, 'example' => 'Id', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleType', + 'in' => 'formData', + 'schema' => ['description' => 'The type of the normalization rule. Valid values:'."\n" + ."\n" + .'- predefined: predefined normalization rule.'."\n" + ."\n" + .'- custom: custom normalization rule.', 'type' => 'string', 'required' => false, 'example' => 'custom', 'title' => ''], + ], + [ + 'name' => 'NormalizationRuleIds', + 'in' => 'formData', + 'style' => 'json', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'type' => 'array', + 'items' => ['description' => 'A list of normalization rule IDs.', 'type' => 'string', 'required' => false, 'example' => 'nr-68unzx95g5avl0n7aife,nr-lc2gzp4ysxksl0ke7l2q', 'title' => ''], + 'description' => 'The list of normalization rule IDs.', + 'title' => '', + 'example' => '', 'required' => false, - 'example' => '113091674488****', ], ], + [ + 'name' => 'ExtendFieldStoreMode', + 'in' => 'formData', + 'schema' => ['description' => 'The storage mode for extension fields. Valid values: flat, pack, and reject.', 'type' => 'string', 'example' => 'flat', 'title' => '', 'required' => false], + ], + [ + 'name' => 'NormalizationCategoryId', + 'in' => 'formData', + 'schema' => ['description' => 'The normalization category.', 'type' => 'string', 'example' => 'HOST_CATEGORY', 'title' => '', 'required' => false], + ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', + 'title' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'Incident' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1757386075000', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1757386075000', - ], - 'IncidentUuid' => [ - 'description' => '', - 'type' => 'string', - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****', - ], - 'Owner' => [ - 'title' => '事件责任人', - 'type' => 'string', - 'example' => '1234567890xxxxxx', - ], - 'IncidentDescription' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Forti incident desc', - ], - 'IncidentName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Forti', - ], - 'ThreatLevel' => [ - 'description' => '', - 'type' => 'string', - 'example' => '2', - ], - 'IncidentAggregationType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'window', - ], - 'ThreatScore' => [ - 'description' => '', - 'type' => 'string', - 'example' => '90', - ], - 'DetectionRuleId' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dr-fy2zvgiykjifbiim****', - ], - 'RelateAlertCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '23', - ], - 'RelateAssetCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '2', - ], - 'IncidentRemark' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'Remark', - ], - 'AttckTactics' => [ - 'description' => '', - 'type' => 'any', - 'example' => '{'."\n" - .' "AttckTactics": ['."\n" - .' {'."\n" - .' "tacticName": "Reconnaissance",'."\n" - .' "alertNum": 0,'."\n" - .' "tacticId": "TA0040"'."\n" - .' }'."\n" - .' ]'."\n" - .'}', - ], - 'IncidentTags' => [ - 'description' => '', - 'type' => 'string', - 'example' => '["sys:data_source:waf"]', - ], - 'RelateDataSourceIds' => [ - 'description' => '', - 'type' => 'any', - 'example' => '["siem"]', - ], - 'RelateUserIds' => [ - 'description' => '', - 'type' => 'any', - 'example' => '["176618589410****","1130916744888****"]', - ], - 'IncidentStatus' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - ], - ], + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateNormalizationRule', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. For configuration examples, see the supporting tool class in the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateNormalizationRule', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationRule', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationrule/{#NormalizationRuleId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"Incident\\": {\\n \\"CreateTime\\": 1757386075000,\\n \\"UpdateTime\\": 1757386075000,\\n \\"IncidentUuid\\": \\"85ea4241-798f-4684-a876-65d4f0c3****\\",\\n \\"Owner\\": \\"1234567890xxxxxx\\",\\n \\"IncidentDescription\\": \\"Forti incident desc\\",\\n \\"IncidentName\\": \\"Forti\\",\\n \\"ThreatLevel\\": \\"2\\",\\n \\"IncidentAggregationType\\": \\"window\\",\\n \\"ThreatScore\\": \\"90\\",\\n \\"DetectionRuleId\\": \\"dr-fy2zvgiykjifbiim****\\",\\n \\"RelateAlertCount\\": 23,\\n \\"RelateAssetCount\\": 2,\\n \\"IncidentRemark\\": \\"Remark\\",\\n \\"AttckTactics\\": \\"{\\\\n\\\\t\\\\\\"AttckTactics\\\\\\": [\\\\n\\\\t\\\\t{\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticName\\\\\\": \\\\\\"Reconnaissance\\\\\\",\\\\n\\\\t\\\\t\\\\t\\\\\\"alertNum\\\\\\": 0,\\\\n\\\\t\\\\t\\\\t\\\\\\"tacticId\\\\\\": \\\\\\"TA0040\\\\\\"\\\\n\\\\t\\\\t}\\\\n\\\\t]\\\\n}\\",\\n \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:waf\\\\\\"]\\",\\n \\"RelateDataSourceIds\\": \\"[\\\\\\"siem\\\\\\"]\\",\\n \\"RelateUserIds\\": \\"[\\\\\\"176618589410****\\\\\\",\\\\\\"1130916744888****\\\\\\"]\\",\\n \\"IncidentStatus\\": 0\\n }\\n}","type":"json"}]', ], - 'ListIncidents' => [ - 'summary' => '获取事件列表', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateNormalizationSchema' => [ + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'list', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the threat analysis data management center resides. Specify the management center based on the region of your assets. Valid values:'."\n" + .'- cn-hangzhou: Your assets reside in the Chinese mainland.'."\n" + .'- ap-southeast-1: Your assets reside outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], - ], - [ - 'name' => 'IncidentName', - 'in' => 'query', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ECS unusual log in', - ], - ], - [ - 'name' => 'IncidentUuids', - 'in' => 'query', - 'style' => 'simple', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '85ea4241-798f-4684-a876-65d4f0c3****,90ea4241-798f-4684-a876-65d4f0c3****'."\n" - ."\n", - ], - 'required' => false, - ], - ], - [ - 'name' => 'IncidentStatus', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '0', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + .'- **zh** (default): Chinese.'."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'ThreatLevel', + 'name' => 'RoleFor', 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '2', - ], - 'required' => false, - 'maxItems' => 100, - ], + 'schema' => ['description' => 'The user ID of the member to which the administrator switches the view.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '113091674488****', 'title' => ''], ], [ - 'name' => 'RelateAssetId', + 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '6c740667-80b2-476d-8924-2e706feb****'."\n", - ], + 'schema' => ['title' => '', 'description' => 'The normalization schema ID.', 'type' => 'string', 'required' => true, 'example' => 'WAF_ALERT_ACTIVITY'], ], [ - 'name' => 'RelateEntityId', + 'name' => 'NormalizationSchemaName', 'in' => 'formData', - 'schema' => [ - 'type' => 'string', - ], + 'schema' => ['title' => '', 'description' => 'The normalization schema name.', 'type' => 'string', 'required' => true, 'example' => 'ProcessQuery'], ], [ - 'name' => 'IncidentTags', + 'name' => 'NormalizationSchemaType', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '[{\\"data_source\\":[\\"sas\\"]}]', - 'title' => '', - ], + 'schema' => ['title' => '', 'description' => 'The normalization schema type. Valid values:'."\n" + .'- log: Log.'."\n" + .'- entity: Entity.', 'type' => 'string', 'required' => true, 'example' => 'log'], ], [ - 'name' => 'AlertUuid', + 'name' => 'NormalizationSchemaDescription', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'sas_71e24437d2797ce8fc59692905a4****', - ], + 'schema' => ['title' => '', 'description' => 'The normalization schema description.', 'type' => 'string', 'required' => false, 'example' => 'ProcessQuery'], ], [ - 'name' => 'StartTime', + 'name' => 'NormalizationFields', 'in' => 'formData', + 'style' => 'repeatList', 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', + 'description' => 'The normalization fields.', + 'type' => 'array', + 'items' => [ + 'title' => '', + 'description' => 'The normalization fields.', + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['title' => '', 'description' => 'The normalization field name.', 'type' => 'string', 'required' => true, 'example' => 'cloud_user'], + 'NormalizationFieldType' => ['title' => '', 'description' => 'The normalization field type. Valid values: text, long, double, and json.', 'type' => 'string', 'required' => true, 'example' => 'varchar'], + 'NormalizationFieldRequired' => ['title' => '', 'description' => 'Specifies whether the normalization field is required.', 'type' => 'boolean', 'required' => false, 'example' => ''], + 'NormalizationFieldDescription' => ['title' => '', 'description' => 'The normalization field description.', 'type' => 'string', 'required' => false, 'example' => 'cloud_user'], + 'NormalizationFieldExample' => ['title' => '', 'description' => 'The normalization field example.', 'type' => 'string', 'required' => false, 'example' => '173326*******'], + 'NormalizationFieldFrom' => ['description' => 'The key source of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + 'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Specifies whether the normalization field is tokenized.', 'type' => 'boolean', 'required' => false, 'example' => ''], + 'NormalizationFieldJsonIndexAll' => ['title' => '', 'description' => 'Specifies whether indexes are created for all keys of the JSON-type normalization field.', 'type' => 'boolean', 'required' => false, 'example' => ''], + 'NormalizationFieldJsonKeys' => [ + 'title' => '', + 'description' => 'The key list of the JSON-type normalization field.', + 'type' => 'array', + 'items' => [ + 'description' => 'The key of the JSON-type normalization field.', + 'type' => 'object', + 'properties' => [ + 'NormalizationFieldName' => ['title' => '', 'description' => 'The key name of the JSON-type normalization field.', 'type' => 'string', 'required' => true, 'example' => 'alert_name'], + 'NormalizationFieldType' => ['title' => '', 'description' => 'The key type of the JSON-type normalization field. Valid values: text, long, double, and json.', 'type' => 'string', 'required' => true, 'example' => 'text'], + 'NormalizationFieldRequired' => ['title' => '', 'description' => 'Specifies whether the key of the JSON-type normalization field is required.', 'type' => 'boolean', 'required' => false, 'example' => ''], + 'NormalizationFieldDescription' => ['title' => '', 'description' => 'The key description of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'alert level'], + 'NormalizationFieldExample' => ['title' => '', 'description' => 'The key example of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'Enum values: 1, 2, 3, 4, 5'], + 'NormalizationFieldFrom' => ['description' => 'The key source of the JSON-type normalization field.', 'type' => 'string', 'required' => false, 'example' => 'preset', 'title' => ''], + 'NormalizationFieldTokenize' => ['title' => '', 'description' => 'Specifies whether the key of the JSON-type normalization field is tokenized.', 'type' => 'boolean', 'required' => false, 'example' => 'true'], + ], + 'required' => false, + 'title' => '', + 'example' => '', + ], + 'required' => false, + 'maxItems' => 50, + 'example' => '', + ], + ], + 'required' => false, + 'example' => '', + ], 'required' => false, - 'example' => '1690102943000', + 'maxItems' => 200, + 'title' => '', + 'example' => '', ], ], - [ - 'name' => 'EndTime', - 'in' => 'formData', + ], + 'responses' => [ + 200 => [ 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '1749090526055', + 'title' => '', + 'description' => 'Schema of Response', + 'type' => 'object', + 'properties' => [ + 'RequestId' => ['title' => '', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + ], + 'example' => '', ], ], - [ - 'name' => 'OrderFieldName', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'GmtModified', + ], + 'errorCodes' => [], + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'Update a normalization schema', + 'summary' => 'Updates a normalization schema.', + 'description' => 'The input parameter JsonConfig is a complex JSON configuration. A utility class is provided to help with specific configuration examples. For more information, refer to [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateNormalizationSchema', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'NormalizationSchema', 'arn' => 'acs:yundun-sas::{#accountId}:normalizationschema/{#NormalizationSchemaId}'], + ], ], ], + ], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + ], + 'UpdateProduct' => [ + 'summary' => 'Updates a product.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], + 'security' => [ [ - 'name' => 'OrderDirection', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'desc', - ], + 'AK' => [], ], + ], + 'operationType' => 'write', + 'deprecated' => false, + 'systemTags' => [ + 'operationType' => 'update', + 'riskType' => 'none', + 'chargeType' => 'free', + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + ], + 'parameters' => [ [ - 'name' => 'PageNumber', + 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'minimum' => '1', - 'example' => '1', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region for the Data Management center based on the region of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'PageSize', + 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => true, - 'maximum' => '100', - 'minimum' => '1', - 'example' => '10', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'en', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], - ], - [ - 'name' => 'RoleType', - 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '1', - ], + 'schema' => ['description' => 'The user ID of a member. An administrator can specify this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '1733269771123', 'title' => ''], ], [ - 'name' => 'MaxResults', + 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'required' => false, - 'example' => '10', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ - 'name' => 'NextToken', + 'name' => 'ProductName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'AAAAASLVeIxed4466E0LVmGkzwS6hJKd9DGVGMDRM6Lu****', - ], + 'schema' => ['description' => 'The product name.', 'type' => 'string', 'required' => false, 'example' => 'alibaba_cloud_sas', 'title' => ''], ], [ - 'name' => 'Owners', + 'name' => 'VendorName', 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'title' => '事件责任人账号uid', - 'type' => 'array', - 'items' => [ - 'title' => '事件责任人账号uid', - 'type' => 'string', - 'example' => '1234567890xxxxxx', - ], - 'maxItems' => 100, - ], + 'schema' => ['description' => 'The vendor name.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - 'Incidents' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'type' => 'object', - 'properties' => [ - 'IncidentName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'ECS unusual log in', - ], - 'ThreatLevel' => [ - 'description' => '', - 'type' => 'string', - 'example' => '2', - ], - 'IncidentStatus' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '0', - ], - 'Owner' => [ - 'title' => '事件责任人账号uid'."\n", - 'type' => 'string', - 'example' => '1234567890xxxxxx', - ], - 'CreateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1603248483000', - ], - 'UpdateTime' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '1603248483000', - ], - 'RelateAssetCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '4', - ], - 'IncidentUuid' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'dbb1d7211c9285c862aa89385098****', - ], - 'IncidentRemark' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'remark', - ], - 'RelateAlertCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '3', - ], - 'IncidentTags' => [ - 'title' => '事件标签。', - 'type' => 'string', - 'example' => '["sys:data_source:siem","sys:trigger_type:auto"]', - ], - 'DetectionRuleId' => [ - 'type' => 'string', - ], - ], - ], - ], - 'PageNumber' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '1', - ], - 'PageSize' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '10', - ], - 'TotalCount' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '57', - ], - 'MaxResults' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '50', - ], - 'NextToken' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateProduct', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. For an example of a supporting tool class with configuration examples, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateProduct', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Product', 'arn' => 'acs:yundun-sas::{#accountId}:product/{#ProductId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"Incidents\\": [\\n {\\n \\"IncidentName\\": \\"ECS unusual log in\\",\\n \\"ThreatLevel\\": \\"2\\",\\n \\"IncidentStatus\\": 0,\\n \\"Owner\\": \\"1234567890xxxxxx\\",\\n \\"CreateTime\\": 1603248483000,\\n \\"UpdateTime\\": 1603248483000,\\n \\"RelateAssetCount\\": 4,\\n \\"IncidentUuid\\": \\"dbb1d7211c9285c862aa89385098****\\",\\n \\"IncidentRemark\\": \\"remark\\",\\n \\"RelateAlertCount\\": 3,\\n \\"IncidentTags\\": \\"[\\\\\\"sys:data_source:siem\\\\\\",\\\\\\"sys:trigger_type:auto\\\\\\"]\\",\\n \\"DetectionRuleId\\": \\"dr-qo5ww6ux0uc28*****\\"\\n }\\n ],\\n \\"PageNumber\\": 1,\\n \\"PageSize\\": 10,\\n \\"TotalCount\\": 57,\\n \\"MaxResults\\": 50,\\n \\"NextToken\\": \\"AAAAAUqcj6VO4E3ECWIrFczs****\\"\\n}","type":"json"}]', ], - 'CreateExportTask' => [ - 'summary' => '创建导出任务', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateResponseRule' => [ + 'methods' => ['post'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], @@ -13381,802 +12382,575 @@ 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas104PTS'], ], 'parameters' => [ [ + 'name' => 'NextToken', + 'in' => 'formData', + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The token that is used to retrieve the next page of results. If you do not specify this parameter, the query starts from the first page.', 'type' => 'string', 'required' => false, 'title' => '', 'example' => 'AAAAAUqcj6VO4E3ECWIrFczs****'], + ], + [ + 'name' => 'MaxResults', + 'in' => 'formData', + 'allowEmptyValue' => true, + 'schema' => ['description' => 'The maximum number of results to return for a single request.', 'type' => 'integer', 'format' => 'int32', 'title' => '', 'required' => false, 'example' => '50'], + ], + [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the data management center of Cloud SIEM is located. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- `cn-hangzhou`: China (Hangzhou). For assets in the Chinese mainland.'."\n" + ."\n" + .'- `ap-southeast-1`: Asia Pacific SE 1 (Singapore). For assets in overseas regions.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'ExportTaskParameter', + 'name' => 'ResponseRuleId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '{'."\n" - .' "IncidentName": "name",'."\n" - .' "IncidentStatus": "1",'."\n" - .' "ThreatLevel":["1","2"],'."\n" - .' "IncidentUuids":"315EE627-39DC-560A-8DFD-CBF66AD9****"'."\n" - .'}', - ], + 'schema' => ['description' => 'The ID of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => '440918', 'title' => ''], ], [ - 'name' => 'ExportTaskType', + 'name' => 'ResponseRuleName', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'incident_list', - ], + 'schema' => ['description' => 'The name of the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => 'Send Notification When Generating Urgent Incident', 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'ResponseRulePriority', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The execution priority of the automatic response rule.', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '1', 'title' => ''], + ], + [ + 'name' => 'ResponseExecutionCondition', + 'in' => 'formData', + 'schema' => ['description' => 'The trigger conditions for the rule.', 'type' => 'string', 'required' => false, 'example' => '[{"left":{"value":"threat_level"},"operator":"equals","right":{"value":"suspicious"}}]', 'title' => ''], + ], + [ + 'name' => 'ResponseActionType', + 'in' => 'formData', + 'schema' => ['description' => 'The action for the automatic response rule. Valid values:'."\n" + ."\n" + .'- `doPlaybook`: Executes a playbook.'."\n" + ."\n" + .'- `changeEventStatus`: Updates the event status.'."\n" + ."\n" + .'- `changeThreatLevel`: Updates the event threat level.'."\n" + ."\n" + .'- `addEventTag`: Adds an event tag.'."\n" + ."\n" + .'- `deleteEventTag`: Deletes an event tag.'."\n" + ."\n" + .'- `alertWhitelist`: Adds the alert to a whitelist.', 'type' => 'string', 'required' => false, 'example' => 'alertWhitelist', 'title' => ''], + ], + [ + 'name' => 'ResponseTriggerType', + 'in' => 'formData', + 'schema' => ['description' => 'The trigger for the automatic response rule. Valid values:'."\n" + ."\n" + .'- `event`: The rule is triggered when an event occurs.'."\n" + ."\n" + .'- `event_update`: The rule is triggered when an event is updated.'."\n" + ."\n" + .'- `alert`: The rule is triggered when an alert is generated.', 'type' => 'string', 'required' => false, 'example' => 'event', 'title' => ''], + ], + [ + 'name' => 'ResponseActionConfig', + 'in' => 'formData', + 'schema' => ['description' => 'The action configuration for the automatic response rule.', 'type' => 'string', 'required' => false, 'example' => '[{"actionType":"doPlaybook","playbookName":"block waf IP","playbookUuid":"system_aliyun_waf_whole_process_book","disposeParam":{"period":"7d"}}]', 'title' => ''], + ], + [ + 'name' => 'ResponseRuleStatus', + 'in' => 'formData', + 'schema' => ['description' => 'The status of the rule. Valid values:'."\n" + ."\n" + .'- `0`: disabled'."\n" + ."\n" + .'- `100`: enabled', 'type' => 'integer', 'format' => 'int32', 'required' => false, 'example' => '0', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ - 'title' => 'Schema of Response', - 'description' => '', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], - 'FileName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'event_1193842352994186_17344888****.xlsx', - ], - 'Id' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '400151', - ], + 'RequestId' => ['description' => 'The request ID.', 'type' => 'string', 'title' => '', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'ResponseRuleId' => ['description' => 'The ID of the automatic response rule.', 'type' => 'string', 'example' => '440918', 'title' => ''], ], + 'title' => '', + 'description' => 'The response data.', + 'example' => '', ], ], ], - 'errorCodes' => [ - 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], - ], - ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'title' => 'UpdateResponseRule', + 'summary' => 'Updates an automatic response rule.', + 'description' => 'Some request parameters require complex JSON configurations. We provide a helper utility class with configuration examples.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n \\"Id\\": 400151\\n}","type":"json"}]', + 'ramActions' => [], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ResponseRuleId\\": \\"440918\\"\\n}","type":"json"}]', ], - 'GetExportTask' => [ - 'summary' => '获取导出任务进度', - 'methods' => [ - 'get', - 'post', - ], - 'schemes' => [ - 'https', - ], + 'UpdateVendor' => [ + 'summary' => 'Updates a vendor.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'read', + 'operationType' => 'write', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'get', + 'operationType' => 'update', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsasASHGE7', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management center for threat analysis. Select the region based on where your asset is located. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The asset is in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: The asset is outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ - 'name' => 'ExportId', + 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '200013', - ], + 'schema' => ['description' => 'The user ID of the member. This parameter allows an administrator to switch to the perspective of a member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******'."\n", 'title' => ''], ], [ - 'name' => 'RoleFor', + 'name' => 'VendorId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The ID of the vendor.', 'type' => 'string', 'required' => false, 'example' => 'vd-qlsw5eocx94w9', 'title' => ''], + ], + [ + 'name' => 'VendorName', + 'in' => 'formData', + 'schema' => ['description' => 'The name of the vendor.', 'type' => 'string', 'required' => false, 'example' => '111', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => '', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'description' => '', - 'type' => 'string', - 'example' => '9AAA9ED9-78F4-5021-86DC-D51C7511****', - ], - 'FileName' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'event_1193842352994186_17344888****.xlsx', - ], - 'Id' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'example' => '400185', - ], - 'ExportType' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'incident_list', - ], - 'ExportStatus' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'success', - ], - 'Progress' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int32', - 'example' => '66', - ], - 'GmtCreate' => [ - 'description' => '', - 'type' => 'string', - 'example' => '1605076118000', - ], - 'Link' => [ - 'description' => '', - 'type' => 'string', - 'example' => 'https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The ID of the request.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], 'errorCodes' => [ 400 => [ - [ - 'errorCode' => 'IdempotentParameterMismatch', - 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', - ], + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], ], ], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', + 'title' => 'UpdateVendor', + 'description' => 'The delivery of notifications is limited by frequency and time. A user can receive a maximum of two notifications per day between 08:00 and 20:00. Notifications are not sent outside this time period.', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'update', + 'ramAction' => [ + 'action' => 'yundun-sas:UpdateVendor', + 'authLevel' => 'resource', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'Vendor', 'arn' => 'acs:yundun-sas::{#accountId}:vendor/{#VendortId}'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"9AAA9ED9-78F4-5021-86DC-D51C7511****\\",\\n \\"FileName\\": \\"event_1193842352994186_17344888****.xlsx\\",\\n \\"Id\\": 400185,\\n \\"ExportType\\": \\"incident_list\\",\\n \\"ExportStatus\\": \\"success\\",\\n \\"Progress\\": 66,\\n \\"GmtCreate\\": \\"1605076118000\\",\\n \\"Link\\": \\"https://cloud-siem-user-dataset.oss-cn-shanghai.aliyuncs.com/export_file/17661858******5/event_17661858******5_175748****.xlsx\\"\\n}","type":"json"}]', ], - 'UpdateNormalizationSchema' => [ - 'summary' => '更新标准化结构', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', - ], + 'ValidateLogStore' => [ + 'summary' => 'Verify log storage.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'update', + 'operationType' => 'none', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], + 'tenantRelevance' => 'tenant', ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region of the Data Management Center for threat analysis. Select a region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: The Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Regions outside China.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], - ], - [ - 'name' => 'NormalizationSchemaType', - 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构类型，当前仅支持log。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'log', - ], + 'schema' => ['description' => 'The user ID of a member. This lets an administrator switch to the member\'s perspective.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaId', + 'name' => 'LogUserId', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构ID。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'WAF_ALERT_ACTIVITY', - ], + 'schema' => ['description' => 'The user ID for data access.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaName', + 'name' => 'LogRegionId', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构名称。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'ProcessQuery', - ], + 'schema' => ['description' => 'The ID of the log storage region.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaDescription', + 'name' => 'LogProjectName', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构描述', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ProcessQuery', - ], + 'schema' => ['description' => 'The name of the Simple Log Service project.', 'type' => 'string', 'required' => false, 'example' => 'aliyun-cloudsiem-data-173326*******-cn-hangzhou', 'title' => ''], ], [ - 'name' => 'NormalizationFields', + 'name' => 'LogStoreName', 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'title' => '', - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'title' => '标准化字段名。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'cloud_user', - ], - 'NormalizationFieldType' => [ - 'title' => '标准字段类型，支持text、long、double、json四种类型。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'varchar', - ], - 'NormalizationFieldRequired' => [ - 'title' => '标准字段是否必填。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - ], - 'NormalizationFieldDescription' => [ - 'title' => '标准字段描述。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_user', - ], - 'NormalizationFieldExample' => [ - 'title' => '标准字段示例', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '173326*******', - ], - 'NormalizationFieldFrom' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset', - ], - 'NormalizationFieldTokenize' => [ - 'title' => '标准字段是否分词。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - ], - 'NormalizationFieldJsonIndexAll' => [ - 'title' => 'json类型的标准字段是否针对所有key建立索引。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - ], - 'NormalizationFieldJsonKeys' => [ - 'title' => 'json类型的标准字段key列表。', - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'title' => 'json类型的标准字段key名称。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'alert_name', - ], - 'NormalizationFieldType' => [ - 'title' => 'json类型的标准字段key类型，支持text、long、double、json四种类型', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'text', - ], - 'NormalizationFieldRequired' => [ - 'title' => 'json类型的标准字段key是否必填。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - ], - 'NormalizationFieldDescription' => [ - 'title' => 'json类型的标准字段key描述。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '', - ], - 'NormalizationFieldExample' => [ - 'title' => 'json类型的标准字段key示例。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '', - ], - 'NormalizationFieldFrom' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset', - ], - 'NormalizationFieldTokenize' => [ - 'title' => 'json类型的标准字段key是否分词。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - ], - 'required' => false, - ], - 'required' => false, - 'maxItems' => 100, - ], - ], - 'required' => false, - ], - 'required' => false, - 'maxItems' => 100, - ], + 'schema' => ['description' => 'The name of the Simple Log Service Logstore.', 'type' => 'string', 'required' => false, 'example' => 'ssglauncher-log', 'title' => ''], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => '请求消息 ID。', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', - ], + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], ], + 'staticInfo' => ['returnType' => 'synchronous'], 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', - ], - 'CreateNormalizationSchema' => [ - 'summary' => '创建标准化结构', - 'methods' => [ - 'post', - ], - 'schemes' => [ - 'https', + 'title' => 'ValidateLogStore', + 'description' => 'The JsonConfig request parameter is a complex JSON configuration. A supporting tool class is provided to help you create the configuration. For a code sample, see the [Demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'none', + 'ramAction' => [ + 'action' => 'yundun-sas:CheckLogStore', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + ], + 'ValidateNormalizationRule' => [ + 'summary' => 'Validates a normalization rule.', + 'methods' => ['post', 'get'], + 'schemes' => ['https'], 'security' => [ [ 'AK' => [], ], ], - 'operationType' => 'write', + 'operationType' => 'readAndWrite', 'deprecated' => false, 'systemTags' => [ - 'operationType' => 'create', + 'operationType' => 'none', 'riskType' => 'none', 'chargeType' => 'free', - 'abilityTreeNodes' => [ - 'FEATUREsas5NAHBX', - ], + 'abilityTreeNodes' => ['FEATUREsas5NAHBX'], ], 'parameters' => [ [ 'name' => 'RegionId', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cn-hangzhou', - ], + 'schema' => ['description' => 'The region where the Data Management center for threat analysis is deployed. Select the region based on the location of your assets. Valid values:'."\n" + ."\n" + .'- cn-hangzhou: Your assets are in the Chinese mainland.'."\n" + ."\n" + .'- ap-southeast-1: Your assets are in regions outside the Chinese mainland.', 'type' => 'string', 'required' => false, 'example' => 'cn-hangzhou', 'title' => ''], ], [ 'name' => 'Lang', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'zh', - ], + 'schema' => ['description' => 'The language of the response messages. Valid values:'."\n" + ."\n" + .'- **zh** (default): Chinese.'."\n" + ."\n" + .'- **en**: English.', 'type' => 'string', 'required' => false, 'example' => 'zh', 'title' => ''], ], [ 'name' => 'RoleFor', 'in' => 'formData', - 'schema' => [ - 'description' => '', - 'type' => 'integer', - 'format' => 'int64', - 'required' => false, - 'example' => '113091674488****', - ], + 'schema' => ['description' => 'The user ID of the member. An administrator uses this parameter to switch to the perspective of the member.', 'type' => 'integer', 'format' => 'int64', 'required' => false, 'example' => '173326*******', 'title' => ''], ], [ - 'name' => 'NormalizationSchemaType', + 'name' => 'Data', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构类型，当前仅支持log。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'log', - ], + 'schema' => ['description' => 'The rule ID.', 'type' => 'string', 'required' => false, 'example' => '123456', 'title' => ''], + ], + [ + 'name' => 'NormalizationCategoryId', + 'in' => 'formData', + 'schema' => ['description' => 'The normalization category of the rule.', 'type' => 'string', 'example' => 'NETWORK_CATEGORY', 'required' => false, 'title' => ''], ], [ 'name' => 'NormalizationSchemaId', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构ID。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'PROCESS_QUERY_DNS_ACTIVITY', - ], + 'schema' => ['description' => 'The ID of the normalization pattern for the rule.', 'type' => 'string', 'example' => 'HTTP_ACTIVITY', 'required' => false, 'title' => ''], ], [ - 'name' => 'NormalizationSchemaName', + 'name' => 'VendorId', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构名称。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'ProcessQuery', - ], + 'schema' => ['description' => 'The vendor ID.', 'type' => 'string', 'example' => 'alibaba_cloud', 'title' => '', 'required' => false], ], [ - 'name' => 'NormalizationSchemaDescription', + 'name' => 'ProductId', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化结构描述', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'ProcessQuery', - ], + 'schema' => ['description' => 'The product ID.', 'type' => 'string', 'example' => 'alibaba_cloud_sas', 'title' => '', 'required' => false], ], [ - 'name' => 'NormalizationCategoryId', + 'name' => 'ExtendFieldStoreMode', 'in' => 'formData', - 'schema' => [ - 'title' => '标准化分类ID。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'NETWORK_CATEGORY', - ], + 'schema' => ['description' => 'The storage mode for extended fields. Valid values: \\`flat\\`, \\`pack\\`, and \\`reject\\`.', 'type' => 'string', 'example' => 'flat', 'title' => '', 'required' => false], ], [ - 'name' => 'TargetLogStore', + 'name' => 'NormalizationRuleMode', 'in' => 'formData', - 'schema' => [ - 'title' => '日志服务 LogStore。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'xxx-activity', - ], + 'schema' => ['description' => 'The mode of the normalization rule. Valid values: \\`both\\` and \\`realtime\\`.', 'type' => 'string', 'example' => 'realtime', 'title' => '', 'required' => false], ], [ - 'name' => 'NormalizationFields', + 'name' => 'LogSample', 'in' => 'formData', - 'style' => 'repeatList', - 'schema' => [ - 'description' => '', - 'type' => 'array', - 'items' => [ - 'title' => '', - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'title' => '标准化字段名。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'cloud_user', - ], - 'NormalizationFieldType' => [ - 'title' => '标准字段类型，支持text、long、double、json四种类型。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'varchar', - ], - 'NormalizationFieldRequired' => [ - 'title' => '标准字段是否必填。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - 'NormalizationFieldDescription' => [ - 'title' => '标准字段描述。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'cloud_user', - ], - 'NormalizationFieldFrom' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset', - ], - 'NormalizationFieldExample' => [ - 'title' => '标准字段示例', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '173326*******', - ], - 'NormalizationFieldTokenize' => [ - 'title' => '标准字段是否分词。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - 'NormalizationFieldJsonIndexAll' => [ - 'title' => 'json类型的标准字段是否针对所有key建立索引。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - 'NormalizationFieldJsonKeys' => [ - 'title' => 'json类型的标准字段key列表。', - 'description' => '', - 'type' => 'array', - 'items' => [ - 'description' => '', - 'type' => 'object', - 'properties' => [ - 'NormalizationFieldName' => [ - 'title' => 'json类型的标准字段key名称。', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'alert_name', - ], - 'NormalizationFieldType' => [ - 'title' => 'json类型的标准字段key类型，支持text、long、double、json四种类型', - 'description' => '', - 'type' => 'string', - 'required' => true, - 'example' => 'text', - ], - 'NormalizationFieldRequired' => [ - 'title' => 'json类型的标准字段key是否必填。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - 'NormalizationFieldDescription' => [ - 'title' => 'json类型的标准字段key描述。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '', - ], - 'NormalizationFieldFrom' => [ - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => 'preset', - ], - 'NormalizationFieldExample' => [ - 'title' => 'json类型的标准字段key示例。', - 'description' => '', - 'type' => 'string', - 'required' => false, - 'example' => '', - ], - 'NormalizationFieldTokenize' => [ - 'title' => 'json类型的标准字段key是否分词。', - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - ], - 'required' => false, - ], - 'required' => false, - 'maxItems' => 100, - ], - 'NormalizationFieldRequirement' => [ - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - 'NormalizationFieldReserved' => [ - 'description' => '', - 'type' => 'boolean', - 'required' => false, - 'example' => 'true', - ], - ], - 'required' => false, - ], - 'required' => false, - 'maxItems' => 100, - ], + 'schema' => ['description' => 'The sample log. The value must be in the JSON format.', 'type' => 'string', 'example' => '{"aaa":"bbb","xxx":"yyy"}', 'title' => '', 'required' => false], + ], + [ + 'name' => 'NormalizationRuleExpression', + 'in' => 'formData', + 'schema' => ['description' => 'The expression for the normalization rule.', 'type' => 'string', 'example' => '*', 'title' => '', 'required' => false], ], ], 'responses' => [ 200 => [ 'schema' => [ 'title' => 'Schema of Response', - 'description' => 'Schema of Response', + 'description' => 'The response body.', 'type' => 'object', 'properties' => [ - 'RequestId' => [ - 'title' => '请求消息 ID。', - 'description' => '', - 'type' => 'string', - 'example' => '6276D891-*****-55B2-87B9-74D413F7****', + 'RequestId' => ['title' => 'Id of the request', 'description' => 'The request ID.', 'type' => 'string', 'example' => '6276D891-*****-55B2-87B9-74D413F7****'], + 'ValidateResult' => [ + 'description' => 'The list of validation results.', + 'type' => 'array', + 'items' => [ + 'description' => 'The validation result.', + 'type' => 'object', + 'properties' => [ + 'FieldName' => ['description' => 'The field name.', 'type' => 'string', 'example' => 'host', 'title' => ''], + 'FieldValue' => ['description' => 'The field value.', 'type' => 'string', 'example' => 'ze', 'title' => ''], + 'NormalizationFieldName' => ['description' => 'The name of the normalized field.', 'type' => 'string', 'example' => 'host', 'title' => ''], + 'NormalizationFieldRequired' => ['description' => 'Indicates whether the normalized field is required.', 'type' => 'boolean', 'example' => 'true', 'title' => ''], + 'Result' => ['description' => 'The result of the validation. Valid values:'."\n" + ."\n" + .'- 1: The validation passed.'."\n" + ."\n" + .'- 0: A warning is returned.'."\n" + ."\n" + .'- -1: The validation failed.', 'type' => 'integer', 'format' => 'int32', 'example' => '1', 'title' => ''], + 'Message' => ['description' => 'The reason for the validation result. Valid values:'."\n" + ."\n" + .'- OperationDenied.TheValueIsRequired: A required parameter is empty.'."\n" + ."\n" + .'- OperationDenied.TheValueIsNull: The parameter value is empty.'."\n" + ."\n" + .'- OperationDenied.TheEnumValueNotSupport: The field value is not within the valid enumeration.'."\n" + ."\n" + .'- OperationDenied.TheValueLessThanMin: The field value is less than the minimum value.'."\n" + ."\n" + .'- OperationDenied.TheValueMoreThanMax: The field value is greater than the maximum value.'."\n" + ."\n" + .'- OperationDenied.TheValueNotMatchRegularExpression: The field value does not match the regular expression.'."\n" + ."\n" + .'- success: The validation passed.', 'type' => 'string', 'example' => 'success', 'title' => ''], + 'NormalizationFieldType' => ['description' => 'The type of the normalized field. Supported types: \\`text\\`, \\`long\\`, \\`double\\`, and \\`json\\`.', 'type' => 'string', 'example' => 'text', 'title' => ''], + 'NormalizationFieldFrom' => ['description' => 'The source of the normalized field. Valid values: \\`preset\\` (built-in) and \\`custom\\`.', 'type' => 'string', 'example' => 'preset', 'title' => ''], + 'NormalizationFieldReserved' => ['description' => 'Indicates whether the name of the normalized field is a built-in field name.', 'type' => 'boolean', 'title' => '', 'example' => ''], + 'NormalizationFieldValidationStatus' => ['description' => 'The validation status of the normalized field. Valid values: \\`pass\\` and \\`fail\\`.', 'type' => 'string', 'example' => 'pass', 'title' => ''], + 'NormalizationFieldValidationReason' => ['description' => 'The reason why the validation of the normalized field failed.', 'type' => 'string', 'example' => 'OperationDenied.TheValueIsRequired', 'title' => ''], + 'LogFieldName' => ['description' => 'The name of the log field.', 'type' => 'string', 'example' => 'aaa', 'title' => ''], + 'LogFieldValue' => ['description' => 'The value of the log field.', 'type' => 'string', 'example' => 'bbb', 'title' => ''], + ], + 'title' => '', + 'example' => '', + ], + 'title' => '', + 'example' => '', ], ], + 'example' => '', ], ], ], - 'errorCodes' => [], - 'staticInfo' => [ - 'returnType' => 'synchronous', + 'errorCodes' => [ + 400 => [ + ['errorCode' => 'IdempotentParameterMismatch', 'errorMessage' => 'The request uses the same client token as a previous, but non-identical request. Do not reuse a client token with different requests, unless the requests are identical.', 'description' => ''], + ], + ], + 'staticInfo' => ['returnType' => 'synchronous'], + 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\",\\n \\"ValidateResult\\": [\\n {\\n \\"FieldName\\": \\"host\\",\\n \\"FieldValue\\": \\"ze\\",\\n \\"NormalizationFieldName\\": \\"host\\",\\n \\"NormalizationFieldRequired\\": true,\\n \\"Result\\": 1,\\n \\"Message\\": \\"success\\",\\n \\"NormalizationFieldType\\": \\"text\\",\\n \\"NormalizationFieldFrom\\": \\"preset\\",\\n \\"NormalizationFieldReserved\\": false,\\n \\"NormalizationFieldValidationStatus\\": \\"pass\\",\\n \\"NormalizationFieldValidationReason\\": \\"OperationDenied.TheValueIsRequired\\",\\n \\"LogFieldName\\": \\"aaa\\",\\n \\"LogFieldValue\\": \\"bbb\\"\\n }\\n ]\\n}","type":"json"}]', + 'title' => 'ValidateNormalizationRule', + 'description' => 'The JsonConfig input parameter is a complex JSON configuration. A supporting tool class provides configuration examples. For more information, see the [demo](https://github.com/aliyun/cloud-siem-client/blob/master/src/main/java/com/aliyun/security/cloudsiem/client/sample/JobBuilderSample.java).', + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [], + ], + 'ramActions' => [ + [ + 'operationType' => 'none', + 'ramAction' => [ + 'action' => 'yundun-sas:ValidateNormalizationRule', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], - 'responseDemo' => '[{"errorExample":"","example":"{\\n \\"RequestId\\": \\"6276D891-*****-55B2-87B9-74D413F7****\\"\\n}","type":"json"}]', ], ], 'endpoints' => [ - [ - 'regionId' => 'cn-shanghai', - 'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com', + ['regionId' => 'cn-shanghai', 'regionName' => 'China (Shanghai)', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'endpoint' => 'cloud-siem.cn-shanghai.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.cn-shanghai.aliyuncs.com'], + ['regionId' => 'ap-southeast-1', 'regionName' => 'Singapore', 'areaId' => 'asiaPacific', 'areaName' => 'Asia Pacific', 'public' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com', 'vpc' => 'cloud-siem-vpc.ap-southeast-1.aliyuncs.com'], + ], + 'errorCodes' => [ + ['code' => 'AccessKey.NotFound', 'message' => 'Access Key not found, please add access key for siem.', 'http_code' => 400, 'description' => ''], + ['code' => 'AssumeRoleError', 'message' => 'Specified role "AliyunServiceRoleForSasCloudSiem" is not exists.', 'http_code' => 400, 'description' => 'AliyunServiceRoleForSasCloudSiem associated role is missing.'], + ['code' => 'CloudSiemCustomizeRuleDuplicateRuleNameExcepiton', 'message' => 'The rule name is duplicated.', 'http_code' => 400, 'description' => 'Custom rule naming conflict.'], + ['code' => 'Datasets with associated references cannot be deleted', 'message' => 'Delete the dataset-related references before attempting to delete the current dataset.', 'http_code' => 400, 'description' => 'Delete the dataset-related references before attempting to delete the current dataset.'], + ['code' => 'Expired.Log', 'message' => 'CloudFireWall Alert Log is expired, please select CloudFireWall Real-Time Alert Log.', 'http_code' => 400, 'description' => ''], + ['code' => 'Forbidden.UserDenied.RdAccount', 'message' => 'Forbidden User.', 'http_code' => 403, 'description' => 'The current user is a resource directory user, please contact the administrator to add as a delegated administrator for threat analysis.'], + ['code' => 'ForbiddenAction', 'message' => 'Unknown error.', 'http_code' => 400, 'description' => 'Illegal operation.'], + ['code' => 'ForbiddenOperation', 'message' => 'Please stop log import task.', 'http_code' => 400, 'description' => ''], + ['code' => 'IllegalParameter', 'message' => 'The specified parameter %s is not valid, only support %s.', 'http_code' => 400, 'description' => 'Parameters'], + ['code' => 'InternalError', 'message' => 'The request processing has failed due to some unknown error.', 'http_code' => 500, 'description' => ''], + ['code' => 'InvalidOperation', 'message' => 'Accesskey %s already bound.', 'http_code' => 400, 'description' => 'AccessKey has been bound.'], + ['code' => 'InvalidOperation', 'message' => 'Access key %s already bound.', 'http_code' => 400, 'description' => 'AK has been bound to account%.'], + ['code' => 'InvalidParameter', 'message' => 'The specified parameter %s is not valid.', 'http_code' => 400, 'description' => 'Parameter is not valid, try again.'], + ['code' => 'InvalidUpdateRecord.Conflict', 'message' => 'Only one of selectedEntityList or unSelectedEntityList can be specified.', 'http_code' => 400, 'description' => 'User fails in performing automatic disposal'], + ['code' => 'Need.CfwFlowLog', 'message' => 'Cloud FireWall Real-Time Alert Log is dependency Cloud FireWall Flow Log. Please open Cloud FireWall Flow Log for account %s first.', 'http_code' => 400, 'description' => 'Real-time alert logs of Cloud Firewall depend on the flow logs of Cloud Firewall. You must first add the Cloud Firewall flow logs of account %s.'], + ['code' => 'NeedCfwFlowLog', 'message' => 'Cloud Firewall Traffic Log must be integrated first.', 'http_code' => 400, 'description' => 'Cloud Firewall Traffic Log must be integrated first.'], + ['code' => 'OrderExpired', 'message' => 'Siem Order Not Found.', 'http_code' => 403, 'description' => 'No valid threat analysis order.'], + ['code' => 'RamAssumeException', 'message' => 'The request processing has failed due to ram service error.', 'http_code' => 500, 'description' => 'The request processing has failed due to ram service error.'], + ['code' => 'Siem.Analysis.IllegalParameter', 'message' => 'Start time should less than or equal to end time.', 'http_code' => 400, 'description' => ''], + ['code' => 'Siem.Analysis.SQLError', 'message' => 'Analysis SQL is error.', 'http_code' => 400, 'description' => ''], + ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 500, 'description' => ''], + ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 500, 'description' => ''], + ['code' => 'Siem.Delivery.MissingProductCode', 'message' => 'ProductCode is mandatory for this action.', 'http_code' => 400, 'description' => ''], + ['code' => 'SIEM.Region.Duplicate', 'message' => 'The region can be set only once.', 'http_code' => 400, 'description' => 'Region can only be set once.'], + ['code' => 'Siem.Storage.Exception', 'message' => 'The request timed out, try again.', 'http_code' => 500, 'description' => ''], + ['code' => 'Siem.TTL.Limit', 'message' => 'TTL should be set 30 days at least.', 'http_code' => 400, 'description' => ''], + ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => 'SLS service is unavailable.'], + ['code' => 'SLS.Index.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service takes several minutes to create an index. Please try again later.'], + ['code' => 'SLS.Operation.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 500, 'description' => ''], + ['code' => 'SLS.Project.Lost', 'message' => 'The SLS project initialization will take a few minutes, try again later.', 'http_code' => 400, 'description' => 'Log Service initialization takes several minutes. Please try again later.'], + ['code' => 'SLS.Ship.Error', 'message' => 'The Simple Log Service about data shipping is unavailable.', 'http_code' => 500, 'description' => ''], + ['code' => 'SLS.Sls4Service.Error', 'message' => 'The Simple Log Service about embedding console pages is unavailable.', 'http_code' => 500, 'description' => ''], + ['code' => 'UserDeliveryFailed', 'message' => 'failed in opening log delivery.', 'http_code' => 500, 'description' => 'Failed to open delivery.'], + ['code' => 'Siem.Delivery.ErrorMapping', 'message' => 'The Mapping between productCode and logCode is error.', 'http_code' => 400, 'description' => ''], + ['code' => 'Sls.Delivery.Error', 'message' => 'SLS service is unavailable.', 'http_code' => 400, 'description' => 'SLS service is unavailable.'], + ['code' => 'Siem.Delivery.ErrorProductCode', 'message' => 'ProductCode is error for this action.', 'http_code' => 400, 'description' => ''], + ], + 'changeSet' => [], + 'flowControl' => [ + 'flowControlList' => [ + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'ListIncidents'], + ['threshold' => '100', 'countWindow' => 1, 'regionId' => '*', 'api' => 'GetIncident'], ], - [ - 'regionId' => 'ap-southeast-1', - 'endpoint' => 'cloud-siem.ap-southeast-1.aliyuncs.com', + ], + 'ram' => [ + 'productCode' => 'ThreatDetection', + 'productName' => 'Security Center', + 'ramCodes' => ['threatdetection', 'yundun-aegis', 'yundun-sas'], + 'ramLevel' => 'OPERATION', + 'ramConditions' => [ + [ + 'name' => 'acs:ResourceGroupId', + 'schema' => ['type' => 'String', 'description' => '资源组ID'], + ], + ], + 'ramActions' => [ + [ + 'apiName' => 'GetAutoDisposeConfig', + 'description' => '', + 'operationType' => 'get', + 'ramAction' => [ + 'action' => 'yundun-aegis:GetAutoDisposeConfig', + 'authLevel' => 'operate', + 'actionConditions' => [], + 'resources' => [ + ['validationType' => 'always', 'product' => 'ThreatDetection', 'resourceType' => 'All Resource', 'arn' => '*'], + ], + ], + ], ], + 'resourceTypes' => [], ], ]; |